CEAI: CCM based Email Authorship Identification Model

In this paper we present a model for email authorship identification (EAI) by employing a Cluster-based Classification (CCM) technique. Traditionally, stylometric features have been successfully employed in various authorship analysis tasks; we extend the traditional feature-set to include some more interesting and effective features for email authorship identification (e.g. the last punctuation mark used in an email, the tendency of an author to use capitalization at the start of an email, or the punctuation after a greeting or farewell). We also included Info Gain feature selection based content features. It is observed that the use of such features in the authorship identification process has a positive impact on the accuracy of the authorship identification task. We performed experiments to justify our arguments and compared the results with other base line models. Experimental results reveal that the proposed CCM-based email authorship identification model, along with the proposed feature set, outperforms the state-of-the-art support vector machine (SVM)-based models, as well as the models proposed by Iqbal et al. [1, 2]. The proposed model attains an accuracy rate of 94% for 10 authors, 89% for 25 authors, and 81% for 50 authors, respectively on Enron dataset, while 89.5% accuracy has been achieved on authors' constructed real email dataset. The results on Enron dataset have been achieved on quite a large number of authors as compared to the models proposed by Iqbal et al. [1, 2]

Virus Propagation in Multiple Profile Networks

Suppose we have a virus or one competing idea/product that propagates over a multiple profile (e.g., social) network. Can we predict what proportion of the network will actually get "infected" (e.g., spread the idea or buy the competing product), when the nodes of the network appear to have different sensitivity based on their profile? For example, if there are two profiles $\mathcal{A}$ and $\mathcal{B}$ in a network and the nodes of profile $\mathcal{A}$ and profile $\mathcal{B}$ are susceptible to a highly spreading virus with probabilities $\beta_{\mathcal{A}}$ and $\beta_{\mathcal{B}}$ respectively, what percentage of both profiles will actually get infected from the virus at the end? To reverse the question, what are the necessary conditions so that a predefined percentage of the network is infected? We assume that nodes of different profiles can infect one another and we prove that under realistic conditions, apart from the weak profile (great sensitivity), the stronger profile (low sensitivity) will get infected as well. First, we focus on cliques with the goal to provide exact theoretical results as well as to get some intuition as to how a virus affects such a multiple profile network. Then, we move to the theoretical analysis of arbitrary networks. We provide bounds on certain properties of the network based on the probabilities of infection of each node in it when it reaches the steady state. Finally, we provide extensive experimental results that verify our theoretical results and at the same time provide more insight on the problem

An Email Attachment is Worth a Thousand Words, or Is It?

There is an extensive body of research on Social Network Analysis (SNA) based on the email archive. The network used in the analysis is generally extracted either by capturing the email communication in From, To, Cc and Bcc email header fields or by the entities contained in the email message. In the latter case, the entities could be, for instance, the bag of words, url's, names, phones, etc. It could also include the textual content of attachments, for instance Microsoft Word documents, excel spreadsheets, or Adobe pdfs. The nodes in this network represent users and entities. The edges represent communication between users and relations to the entities. We suggest taking a different approach to the network extraction and use attachments shared between users as the edges. The motivation for this is two-fold. First, attachments represent the "intimacy" manifestation of the relation's strength. Second, the statistical analysis of private email archives that we collected and Enron email corpus shows that the attachments contribute in average around 80-90% to the archive's disk-space usage, which means that most of the data is presently ignored in the SNA of email archives. Consequently, we hypothesize that this approach might provide more insight into the social structure of the email archive. We extract the communication and shared attachments networks from Enron email corpus. We further analyze degree, betweenness, closeness, and eigenvector centrality measures in both networks and review the differences and what can be learned from them. We use nearest neighbor algorithm to generate similarity groups for five Enron employees. The groups are consistent with Enron's organizational chart, which validates our approach.Comment: 12 pages, 4 figures, 7 tables, IML'17, Liverpool, U

Detecting Cohesive and 2-mode Communities in Directed and Undirected Networks

Networks are a general language for representing relational information among objects. An effective way to model, reason about, and summarize networks, is to discover sets of nodes with common connectivity patterns. Such sets are commonly referred to as network communities. Research on network community detection has predominantly focused on identifying communities of densely connected nodes in undirected networks. In this paper we develop a novel overlapping community detection method that scales to networks of millions of nodes and edges and advances research along two dimensions: the connectivity structure of communities, and the use of edge directedness for community detection. First, we extend traditional definitions of network communities by building on the observation that nodes can be densely interlinked in two different ways: In cohesive communities nodes link to each other, while in 2-mode communities nodes link in a bipartite fashion, where links predominate between the two partitions rather than inside them. Our method successfully detects both 2-mode as well as cohesive communities, that may also overlap or be hierarchically nested. Second, while most existing community detection methods treat directed edges as though they were undirected, our method accounts for edge directions and is able to identify novel and meaningful community structures in both directed and undirected networks, using data from social, biological, and ecological domains.Comment: Published in the proceedings of WSDM '1