Authorship Attribution of IRC Messages Using Inverse Author Frequency

Internet Relay Chat (IRC) is a useful and relatively simple protocol for text based chat online, used in a variety of areas online such as for discussion and technical support. IRC is also used for cybercrime, with online rooms selling stolen credit card details, botnet access and malware. The reasons for the use of IRC in cybercrime include the widespread adoption and ease of use, but also focus around the anonymity granted by the protocol, allowing users to hide behind aliases that can be changed regularly. In this research, we apply authorship analysis techniques to be able to attribute chat messages to known aliases. A preliminary experiment shows that this application is very difficult, due to the short messages and repeated information. To improve the accuracy, we apply inverse-author-frequency (iaf) weighting, which gives higher weights to features used by fewer authors. This research is the first time that iaf has been applied to character n-gram models, previously being applied to word based models of authorship. We find that this improves the accuracy significantly for the RLP method and provides a platform for successful applications of authorship analysis in the future. Overall, the method achieves accuracies of over 55% in a very difficult application domain.