Disclosing user relationships in email networks

To reveal patterns of communications of users in a network, an attacker may repeatedly obtain partial information on behavior and finally derive relationships between pairs of users through the modeling of this statistical information. This work is an enhancement of a previously presented statistical disclosure attack. The improvement of the attack is based on the use of the EM algorithm to improve the estimation of messages sent by users and to derive what pairs of users really communicate. Two methods are presented using the EM algorithm and the best method is used over real email data over 32 different network domains. Results are encouraging with high classification and positive predictive value rates.