Detecting Related Message Traffic

Governments routinely intercept messages as part of counterterrorism efforts. We consider the problem of identifying and associating messages between members of a threat group when the content is apparently innocuous and senders and/or receivers are not identifiable as particular people. We show that clusters of related messages can be identified when they use words in correlated ways (which all conversations do) and the words are used with the ‘wrong’ frequency. The proposed technique therefore complements the use of a watch list of words, since the greater the awareness that particular words should not be used, the greater the use of inappropriate words that will reveal the existence of related groups of messages.