{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,24]],"date-time":"2026-02-24T18:32:01Z","timestamp":1771957921407,"version":"3.50.1"},"reference-count":53,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2015,3,9]],"date-time":"2015-03-09T00:00:00Z","timestamp":1425859200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100000038","name":"Natural Sciences and Engineering Research Council of Canada","doi-asserted-by":"crossref","award":["356065-2013"],"award-info":[{"award-number":["356065-2013"]}],"id":[{"id":"10.13039\/501100000038","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Inf. Syst. Secur."],"published-print":{"date-parts":[[2015,3,27]]},"abstract":"<jats:p>The Internet provides an ideal anonymous channel for concealing computer-mediated malicious activities, as the network-based origins of critical electronic textual evidence (e.g., emails, blogs, forum posts, chat logs, etc.) can be easily repudiated. Authorship attribution is the study of identifying the actual author of the given anonymous documents based on the text itself, and for decades, many linguistic stylometry and computational techniques have been extensively studied for this purpose. However, most of the previous research emphasizes promoting the authorship attribution accuracy, and few works have been done for the purpose of constructing and visualizing the evidential traits. In addition, these sophisticated techniques are difficult for cyber investigators or linguistic experts to interpret. In this article, based on the End-to-End Digital Investigation (EEDI) framework, we propose a visualizable evidence-driven approach, namely VEA, which aims at facilitating the work of cyber investigation. Our comprehensive controlled experiment and the stratified experiment on the real-life Enron email dataset demonstrate that our approach can achieve even higher accuracy than traditional methods; meanwhile, its output can be easily visualized and interpreted as evidential traits. In addition to identifying the most plausible author of a given text, our approach also estimates the confidence for the predicted result based on a given identification context and presents visualizable linguistic evidence for each candidate.<\/jats:p>","DOI":"10.1145\/2699910","type":"journal-article","created":{"date-parts":[[2015,3,9]],"date-time":"2015-03-09T19:03:01Z","timestamp":1425927781000},"page":"1-30","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":18,"title":["A Visualizable Evidence-Driven Approach for Authorship Attribution"],"prefix":"10.1145","volume":"17","author":[{"given":"Steven H. H.","family":"Ding","sequence":"first","affiliation":[{"name":"Concordia Institute for Information Systems Engineering, Concordia University, QC, Canada"}]},{"given":"Benjamin C. M.","family":"Fung","sequence":"additional","affiliation":[{"name":"School of Information Studies, McGill University, QC, Canada"}]},{"given":"Mourad","family":"Debbabi","sequence":"additional","affiliation":[{"name":"Concordia Institute for Information Systems Engineering, Concordia University, Montreal, QC, Canada"}]}],"member":"320","published-online":{"date-parts":[[2015,3,9]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1007\/11760146_6"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/1344411.1344413"},{"key":"e_1_2_1_3_1","doi-asserted-by":"crossref","unstructured":"Seymour Bosworth Michel E. Kabay and Eric Whyne. 2012. Computer Security Handbook. Wiley.   Seymour Bosworth Michel E. Kabay and Eric Whyne. 2012. Computer Security Handbook. Wiley.","DOI":"10.1002\/9781118820650"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382448.2382450"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1093\/llc\/fqi067"},{"key":"e_1_2_1_6_1","unstructured":"Tantek \u00c7elik Chris Lilley and L. David Baron. 2012. CSS Color Module Level 3.  Tantek \u00c7elik Chris Lilley and L. David Baron. 2012. CSS Color Module Level 3."},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/1961189.1961199"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/2393347.2396398"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-37256-8_37"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1007\/11494683_28"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.5555\/2002472.2002510"},{"key":"e_1_2_1_12_1","volume-title":"Proceedings of the 2nd European Conference on Computational Learning Theory. 23--37","author":"Freund Yoav"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611972733.6"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/1187415.1187416"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1179\/000870403235002042"},{"key":"e_1_2_1_16_1","volume-title":"Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies. 65--70","author":"Hedegaard Steffen","year":"2011"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1007\/BF01830689"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1093\/llc\/13.3.111"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1007\/11861461_10"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2011.03.006"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1561\/1500000005"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.5555\/2388616.2388630"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/1866423.1866427"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.5555\/1273073.1273131"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/2009916.2009979"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/34.667881"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/1148170.1148304"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10579-009-9111-2"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1080\/0013838X.2012.668794"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.5555\/1314498.1314541"},{"key":"e_1_2_1_31_1","volume-title":"Proceedings of the 2011 CLEF Conference on Multilingual and Multimodal Information Access Evaluation (Lab and Workshop Notebook Papers).","author":"Kourtis Ioannis","year":"2011"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-03521-0_2"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1017\/S1351324911000313"},{"key":"e_1_2_1_34_1","first-page":"707","article-title":"Binary codes capable of correcting deletions, insertions and reversals","volume":"10","author":"Levenshtein Vladimir I.","year":"1966","journal-title":"Soviet Physics Doklady"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1093\/llc\/fqq013"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/1645953.1646291"},{"key":"e_1_2_1_37_1","unstructured":"Frederick Mosteller and David Wallace. 1964. Inference and Disputed Authorship: The Federalist. Addison-Wesley.  Frederick Mosteller and David Wallace. 1964. Inference and Disputed Authorship: The Federalist. Addison-Wesley."},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.46"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.3115\/1067807.1067843"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.5555\/1858842.1858850"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1016\/0306-4573(88)90021-0"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.5555\/1610075.1610142"},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-37256-8_38"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/2180868.2180874"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.5555\/2390665.2390728"},{"key":"e_1_2_1_46_1","volume-title":"Proceedings of the 15th Conference on Computational Natural Language Learning. 181--189","author":"Seroussi Yanir","year":"2011"},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.5555\/2468221.2468224"},{"key":"e_1_2_1_49_1","article-title":"Intuition versus algorithm: The case of forensic authorship attribution","volume":"21","author":"Solan Lawrence M.","year":"2013","journal-title":"Brooklyn Journal of Law and Policy"},{"key":"e_1_2_1_50_1","volume-title":"Proceedings of the 5th International Joint Conference on Natural Language Processing. 156--164","author":"Solorio Thamar","year":"2011"},{"key":"e_1_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1002\/asi.v60:3"},{"key":"e_1_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1007\/BF00054024"},{"key":"e_1_2_1_53_1","volume-title":"Proceedings of the 14th International Conference on Machine Learning (ICML). 412--420","author":"Yang Yiming"},{"key":"e_1_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/281250.281256"}],"container-title":["ACM Transactions on Information and System Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2699910","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2699910","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T06:16:59Z","timestamp":1750227419000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2699910"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,3,9]]},"references-count":53,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2015,3,27]]}},"alternative-id":["10.1145\/2699910"],"URL":"https:\/\/doi.org\/10.1145\/2699910","relation":{},"ISSN":["1094-9224","1557-7406"],"issn-type":[{"value":"1094-9224","type":"print"},{"value":"1557-7406","type":"electronic"}],"subject":[],"published":{"date-parts":[[2015,3,9]]},"assertion":[{"value":"2014-03-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2014-11-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2015-03-09","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}