{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,13]],"date-time":"2026-05-13T19:53:31Z","timestamp":1778702011761,"version":"3.51.4"},"reference-count":73,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2020,10,15]],"date-time":"2020-10-15T00:00:00Z","timestamp":1602720000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100006168","name":"Department of Energy\/National Nuclear Security Administration","doi-asserted-by":"crossref","award":["DE-NA0003946"],"award-info":[{"award-number":["DE-NA0003946"]}],"id":[{"id":"10.13039\/100006168","id-type":"DOI","asserted-by":"crossref"}]},{"name":"National Science Foundation","award":["NSF-1624668, NSF-1849113, DUE-1303362"],"award-info":[{"award-number":["NSF-1624668, NSF-1849113, DUE-1303362"]}]},{"DOI":"10.13039\/100000161","name":"National Institute of Standards and Technology","doi-asserted-by":"crossref","award":["70NANB18H263"],"award-info":[{"award-number":["70NANB18H263"]}],"id":[{"id":"10.13039\/100000161","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Air Force Office of Scientific Research (AFOSR) Dynamic Data-Driven Application Systems","award":["FA9550-18-1- 0427"],"award-info":[{"award-number":["FA9550-18-1- 0427"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Manage. Inf. Syst."],"published-print":{"date-parts":[[2020,12,31]]},"abstract":"<jats:p>With the advances in Internet technologies and services, social media has been gained extreme popularity, especially because these technologies provide potential anonymity, which in turn harbors hacker discussion forums, underground markets, dark web, and so on. Internet relay chat (IRC) is a real-time communication protocol actively used by cybercriminals for hacking, cracking, and carding. Hence, it is particularly urgent to identify the authors of threat messages and malicious activities in IRC. Unfortunately, author identification studies in IRC remain as an underexplored area. In this research, we perform novel IRC text feature extraction methods and propose the first author attribution version of the deep forest (DF) model that is an ensemble of ensembles that utilizes the fusion of ensemble learning techniques. Our approach is supported by autonomic IRC monitoring. Experiments show that our approach is highly effective for author attribution and attains high accuracy even when the number of candidates is large while training data is limited.<\/jats:p>","DOI":"10.1145\/3409455","type":"journal-article","created":{"date-parts":[[2020,10,16]],"date-time":"2020-10-16T04:29:06Z","timestamp":1602822546000},"page":"1-25","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":13,"title":["An Ensemble of Ensembles Approach to Author Attribution for Internet Relay Chat Forensics"],"prefix":"10.1145","volume":"11","author":[{"given":"Sicong","family":"Shao","sequence":"first","affiliation":[{"name":"NSF Center for Cloud and Autonomic Computing, University of Arizona, Tucson, AZ"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Cihan","family":"Tunc","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, University of North Texas, Denton, TX"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Amany","family":"Al-Shawi","sequence":"additional","affiliation":[{"name":"National Center for Cybersecurity Technology, King Abdulaziz City for Science and Technology, Riyadh, Saudi Arabia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Salim","family":"Hariri","sequence":"additional","affiliation":[{"name":"NSF Center for Cloud and Autonomic Computing, University of Arizona, Tucson, AZ"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2020,10,15]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"Proceedings of the IEEE 3rd Cybercrime and Trustworthy Computing Workshop 28--37","author":"Amuchi F."},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/MIS.2005.81"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/1344411.1344413"},{"key":"e_1_2_1_4_1","first-page":"5","article-title":"Arabic authorship attribution: An extensive study on Twitter posts","volume":"18","author":"Altakrori M. H.","year":"2018","journal-title":"ACM Trans. Asian Low-resour. Lang. Inf. Proc."},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2014.03.012"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1010933404324"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-47217-1_9"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382448.2382450"},{"key":"e_1_2_1_9_1","volume-title":"Proceedings of the IEEE International Conference on Intelligence and Security Informatics (ISI\u201914)","author":"Benjamin V."},{"key":"e_1_2_1_10_1","volume-title":"Proceedings of the IEEE International Conference on Intelligence and Security Informatics (ISI\u201915)","author":"Benjamin V."},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1080\/07421222.2016.1205918"},{"key":"e_1_2_1_12_1","volume-title":"Proceedings of the International Conference on Statistical Analysis of Textual Data. 29--37","author":"Baayen H."},{"key":"e_1_2_1_13_1","volume-title":"Proceedings of the SIGIR Workshop on Open Source Information Retrieval. 17","author":"Bia\u0142ecki A.","year":"2012"},{"key":"e_1_2_1_14_1","volume-title":"Proceedings of 7th International Conference on Complex Networks and their Applications. 578--589","author":"Bernard J."},{"key":"e_1_2_1_15_1","volume-title":"Proceedings of the Conference and Labs of the Evaluation Forum (CLEF\u201917)","author":"Castro-Castro D."},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/1961189.1961199"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.econlet.2011.11.015"},{"key":"e_1_2_1_18_1","volume-title":"Proceedings of the International Conference on Machine Learning.","author":"Chen H.","year":"2019"},{"key":"e_1_2_1_19_1","unstructured":"P. Y. Du and N. Zhang. 2018. Hacker web forum collection: IRC conversation for channel. University of Arizona Artificial Intelligence Lab AZSecure-data. Retrieved from http:\/\/www.azsecure-data.org\/.  P. Y. Du and N. Zhang. 2018. Hacker web forum collection: IRC conversation for channel. University of Arizona Artificial Intelligence Lab AZSecure-data. Retrieved from http:\/\/www.azsecure-data.org\/."},{"key":"e_1_2_1_20_1","volume-title":"Proceedings of the 10th Conference of the Pacific Association for Computational Linguistics. 263--272","author":"Estival D."},{"key":"e_1_2_1_21_1","doi-asserted-by":"crossref","unstructured":"H. M. Gomes A. Bifet J. Read J. Barddal F. Enembreck B. Pfharinger H. Geoff and T. Abdessalem. 2017. Adaptive random forests for evolving data stream classification. Mach. Learn. 106 (9-10) (2017) 1469--1495.  H. M. Gomes A. Bifet J. Read J. Barddal F. Enembreck B. Pfharinger H. Geoff and T. Abdessalem. 2017. Adaptive random forests for evolving data stream classification. Mach. Learn. 106 (9-10) (2017) 1469--1495.","DOI":"10.1007\/s10994-017-5642-8"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-006-6226-1"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/2523813"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1093\/llc\/fqm023"},{"key":"e_1_2_1_25_1","volume-title":"Proceedings of the International Conference on Social Computing (SocialCom\u201913)","author":"Inches G."},{"key":"e_1_2_1_26_1","volume-title":"Proceedings of the ACM Symposium on Applied Computing. 1591--1598","author":"Iqbal F."},{"key":"e_1_2_1_27_1","unstructured":"IBM Watson Assistant. 2018. IBM Watson Assistant service. Retrieved from https:\/\/www.ibm.com\/cloud\/watson-assistant\/.  IBM Watson Assistant. 2018. IBM Watson Assistant service. Retrieved from https:\/\/www.ibm.com\/cloud\/watson-assistant\/."},{"key":"e_1_2_1_28_1","unstructured":"IBM Watson Personality Insights. 2018. IBM Watson Personality Insights service. Retrieved from https:\/\/console.bluemix.net\/docs\/services\/personality-insights.  IBM Watson Personality Insights. 2018. IBM Watson Personality Insights service. Retrieved from https:\/\/console.bluemix.net\/docs\/services\/personality-insights."},{"key":"e_1_2_1_29_1","unstructured":"Imbalanced-learn API. 2019. RandomUnderSampler. Retrieved from https:\/\/imbalanced-learn.readthedocs.io\/en\/stable\/generated\/imblearn.under_sampling.RandomUnderSampler.html.  Imbalanced-learn API. 2019. RandomUnderSampler. Retrieved from https:\/\/imbalanced-learn.readthedocs.io\/en\/stable\/generated\/imblearn.under_sampling.RandomUnderSampler.html."},{"key":"e_1_2_1_30_1","unstructured":"IRC Abbreviations. 2018. Introduction to IRC Abbreviations. Retrieved from http:\/\/www.ircbeginner.com\/ircinfo\/abbreviations.html.  IRC Abbreviations. 2018. Introduction to IRC Abbreviations. Retrieved from http:\/\/www.ircbeginner.com\/ircinfo\/abbreviations.html."},{"key":"e_1_2_1_31_1","unstructured":"IRC Emoticons. 2018. Introduction to IRC Emoticons. Retrieved from http:\/\/www.ircbeginner.com\/ircinfo\/emoticons.html.  IRC Emoticons. 2018. Introduction to IRC Emoticons. Retrieved from http:\/\/www.ircbeginner.com\/ircinfo\/emoticons.html."},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3309706"},{"key":"e_1_2_1_33_1","doi-asserted-by":"crossref","unstructured":"K. Kavuri and M. Kavitha. 2020. A stylistic features based approach for author profiling. In Recent Trends in Communication and Intelligent Systems. Springer Singapore 185--193.  K. Kavuri and M. Kavitha. 2020. A stylistic features based approach for author profiling. In Recent Trends in Communication and Intelligent Systems. Springer Singapore 185--193.","DOI":"10.1007\/978-981-15-0426-6_20"},{"key":"e_1_2_1_34_1","volume-title":"Proceedings of the Conference on Advances in Neural Information Processing Systems. 3146--3154","author":"Ke G."},{"key":"e_1_2_1_35_1","volume-title":"Understanding Random Forests: From Theory to Practice. Dissertation","author":"Louppe G."},{"key":"e_1_2_1_36_1","volume-title":"Proceedings of the 22nd International Conference on Computational Linguistics (COLING\u201908)","author":"Luyckx K."},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/2676869"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/2070710.2070716"},{"key":"e_1_2_1_39_1","volume-title":"Proceedings of the 3rd IEEE Cybercrime and Trustworthy Computing Workshop. 7--13","author":"Layton R."},{"key":"e_1_2_1_40_1","volume-title":"Proceedings of the Conference and Labs of the Evaluation Forum and Workshop (CLEF'13)","author":"Layton R."},{"key":"e_1_2_1_41_1","article-title":"Exploratory undersampling for class-imbalance learning","volume":"39","author":"Liu X.","year":"2009","journal-title":"IEEE Trans. Syst., Man, Cybernetics, Part B (Cyber.)"},{"key":"e_1_2_1_42_1","volume-title":"Proceedings of the International Symposium on Privacy Enhancing Technologies Symposium. Springer","author":"McDonald A."},{"key":"e_1_2_1_43_1","doi-asserted-by":"crossref","unstructured":"C. D. Manning P. Raghavan and H. Schuetze. 2008. Introduction to Information Retrieval. Cambridge University Press 234--265.  C. D. Manning P. Raghavan and H. Schuetze. 2008. Introduction to Information Retrieval. Cambridge University Press 234--265.","DOI":"10.1017\/CBO9780511809071"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1007\/s13369-015-1945-x"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2017.2691702"},{"key":"e_1_2_1_46_1","volume-title":"Proceedings of the Textlink Workshop at IJCAI.","author":"Mukras R."},{"key":"e_1_2_1_47_1","doi-asserted-by":"crossref","unstructured":"A. Rajaraman and J. D. Ullman. 2011. Mining of Massive Datasets. Cambridge University Press.  A. Rajaraman and J. D. Ullman. 2011. Mining of Massive Datasets. Cambridge University Press.","DOI":"10.1017\/CBO9781139058452"},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.5555\/1527090.1527102"},{"key":"e_1_2_1_49_1","doi-asserted-by":"crossref","volume-title":"The Coming Swarm: DDOS Actions, Hacktivism, and Civil Disobedience on the Internet","author":"Sauter M.","DOI":"10.5040\/9781628926705"},{"key":"e_1_2_1_50_1","unstructured":"NIST. 2018. Glossary of key information security terms. Retrieved from https:\/\/csrc.nist.gov\/glossary.  NIST. 2018. Glossary of key information security terms. Retrieved from https:\/\/csrc.nist.gov\/glossary."},{"key":"e_1_2_1_51_1","unstructured":"Scikit-Learn API. 2019. Scikit-learn: machine learning in Python. Retrieved from https:\/\/scikit-learn.org\/stable\/.  Scikit-Learn API. 2019. Scikit-learn: machine learning in Python. Retrieved from https:\/\/scikit-learn.org\/stable\/."},{"key":"e_1_2_1_52_1","unstructured":"Scikit-Learn MinMaxScaler. 2019. Sklearn Preprocessing MinMaxScaler. Retrieved from https:\/\/scikit-learn.org\/stable\/modules\/generated\/sklearn.preprocessing.MinMaxScaler.html.  Scikit-Learn MinMaxScaler. 2019. Sklearn Preprocessing MinMaxScaler. Retrieved from https:\/\/scikit-learn.org\/stable\/modules\/generated\/sklearn.preprocessing.MinMaxScaler.html."},{"key":"e_1_2_1_53_1","unstructured":"Scikit-Learn Neural Network Models. 2019. Neural Network Models (Supervised). Retrieved from https:\/\/scikit-learn.org\/stable\/modules\/neural_networks_supervised.html.  Scikit-Learn Neural Network Models. 2019. Neural Network Models (Supervised). Retrieved from https:\/\/scikit-learn.org\/stable\/modules\/neural_networks_supervised.html."},{"key":"e_1_2_1_54_1","volume-title":"Proceedings of the IEEE Conference on Intelligence and Security Informatics (ISI\u201916)","author":"Samtani S."},{"key":"e_1_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1080\/07421222.2017.1394049"},{"key":"e_1_2_1_56_1","volume-title":"Proceedings of the IEEE Conference on Intelligence and Security Informatics (ISI\u201916)","author":"Samtani S."},{"key":"e_1_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSP.2015.2451111"},{"key":"e_1_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1162\/089120100750105920"},{"key":"e_1_2_1_59_1","volume-title":"Proceedings of the International Joint Conference on Natural Language Processing. 156--164","author":"Solorio T."},{"key":"e_1_2_1_60_1","volume-title":"Proceedings of the Conference on Empirical Methods in Natural Language Processing. 1631--1642","author":"Socher R."},{"key":"e_1_2_1_61_1","volume-title":"Proceedings of the IEEE\/ACS 15th International Conference on Computer Systems and Applications (AICCSA\u201918)","author":"Shao S."},{"key":"e_1_2_1_62_1","volume-title":"Proceedings of IEEE\/ACS 16th International Conference on Computer Systems and Applications (AICCSA\u201919)","author":"Shao S."},{"key":"e_1_2_1_63_1","volume-title":"Proceedings of the IEEE\/ACS 16th International Conference on Computer Systems and Applications (AICCSA\u201919)","author":"Shao S."},{"key":"e_1_2_1_64_1","unstructured":"R. Sedgewick and K. Wayne. 2018. Algorithms fourth edition: Algorithms 3.5 searching applications stop words. Retrieved from https:\/\/algs4.cs.princeton.edu\/35applications\/stopwords.txt.  R. Sedgewick and K. Wayne. 2018. Algorithms fourth edition: Algorithms 3.5 searching applications stop words. Retrieved from https:\/\/algs4.cs.princeton.edu\/35applications\/stopwords.txt."},{"key":"e_1_2_1_65_1","unstructured":"The Register Security. 2012. UK cops: How we sniffed out convicted anonops admin \u201cnerdo.\u201d Retrieved from https:\/\/www.theregister.co.uk\/2012\/12\/14\/uk_anon_investigation\/.  The Register Security. 2012. UK cops: How we sniffed out convicted anonops admin \u201cnerdo.\u201d Retrieved from https:\/\/www.theregister.co.uk\/2012\/12\/14\/uk_anon_investigation\/."},{"key":"e_1_2_1_66_1","volume-title":"Proceedings of the International Conference on Cyberworlds (CW\u201910)","author":"Tan R. H. R."},{"key":"e_1_2_1_67_1","volume-title":"Proceedings of the Conference and Labs of the Evaluation Forum and Workshop (CLEF'17)","author":"Tschuggnall M."},{"key":"e_1_2_1_68_1","volume-title":"Proceedings of the ACM Symposium on Document Engineering. 143--146","author":"Williams K."},{"key":"e_1_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jcss.2013.03.001"},{"key":"e_1_2_1_70_1","doi-asserted-by":"crossref","volume-title":"Ensemble Methods: Foundations and Algorithms","author":"Zhou Z.","DOI":"10.1201\/b12207"},{"key":"e_1_2_1_71_1","volume-title":"Proceedings of the 26th International Joint Conference on Artificial Intelligence. 3553--3559","author":"Zhou Z."},{"key":"e_1_2_1_72_1","volume-title":"Proceedings of the 4th Australasian Data Mining Workshop. 141--156","author":"Zheng F."},{"key":"e_1_2_1_73_1","doi-asserted-by":"publisher","DOI":"10.1002\/asi.20316"}],"container-title":["ACM Transactions on Management Information Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3409455","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3409455","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3409455","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T22:38:40Z","timestamp":1750199920000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3409455"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,10,15]]},"references-count":73,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2020,12,31]]}},"alternative-id":["10.1145\/3409455"],"URL":"https:\/\/doi.org\/10.1145\/3409455","relation":{},"ISSN":["2158-656X","2158-6578"],"issn-type":[{"value":"2158-656X","type":"print"},{"value":"2158-6578","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,10,15]]},"assertion":[{"value":"2019-11-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2020-06-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2020-10-15","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}