Physical Sciences and Mathematics Commons^™

A Fuzzy Approach For Detecting Anomalous Behaviour In E-Mail Traffic, Mark Jynhuey Lim, Michael Negnevitsky, Jacky Hartnett

Australian Digital Forensics Conference

This paper investigates the use of fuzzy inference for detection of abnormal changes in email traffic communication behaviour. Several communication behaviour measures and metrics are defined for extracting information on the traffic communication behaviour of email users. The information from these behaviour measures is then combined using a hierarchy of fuzzy inference systems, to provide an abnormality rating for overall changes in communication behaviour of suspect email accounts. The use of fuzzy inference is then demonstrated with a case study investigating the email traffic behaviour of a person’s email accounts from the Enron email corpus.