Interest Profiling for Security Monitoring and Forensic Investigation

Abstract

User interest profiles are of great importance for security monitoring and forensic investigation. Once a specific topic becomes sensitive or suspected, being able to quickly determine who has shown an interest in that topic can assist investigators to focus their attention from massive data and develop effective investigation strategies. To automatically generate user interest profiles, we extend Author Topic model to explicitly model user's dynamic interest based on the text information posted by the user. Our model is able to monitor the evolution of user interest from time-stamped documents. Moreover, instead of modeling a topic as a multinomial distribution over words, we develop a model that can discover and output multi-word phrases to describe topics, which facilitates the human interpretation of unorganized texts. Therefore, our technique has the potential to reduce the cost of investigation and discover latent evidence that is often missed by expression-based searches. We evaluate the effectiveness and performance of our algorithm on a real-life forensic dataset Enron. The experiment results demonstrate that our algorithm can effectively discover user's dynamic interest. The generated user interest profiles can further assist investigator to discover the latent evidence effectively from textual forensic data and perform security monitoring.