{'fraction_non_alphanumeric': 0.028358902835890282, 'fraction_numerical': 0.007810320781032078, 'mean_word_length': 5.2317497103128625, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Statistics-based email communication security behavior recognition

With the development of information technology, e-mail has become a popular communication medium. It has great significant to determine the relationship between the two sides of the communication. Firstly, this paper analysed and processed the content and attachment of e-mail using the skill of steganalysis and malware analysis. And it also conducts the following feature extracting and behaviour model establishing which based on Naive Bayesian theory. Then a behaviour analysis method was employed to calculate and evaluate the communication security. Finally, some experiments about the accuracy of the behavioural relationship of communication identifying has been carried out. The result shows that this method has a great effects and correctness as eighty-four percent.


Introduction
With the development of the Internet, e-mail can be found in all aspects of people's lives due to its effectiveness, immediacy and low cost. Meanwhile, social security of emails is more and more valuable, information and evidence involved in network crimes are increasingly significant. So it is a new challenge to analyse email information quickly and effectively, as well as the content and relationship of emails accurately, so as to specify communication behaviour of email contacts.
Currently there are mainly two methods below to classify emails at home and abroad: one is based on analysis of text content and the other one is based on analysis of email attachments such as texts, pictures, etc. The ultimate purpose of classification is to recognize and filter spam, among which Bayesian Classification Algorithm is the most common method [1][2][3]. Put forward by Pearl in 1988, it is a model composed of a directed acyclic graph and a set of probability distribution. Naive Bayesian classification algorithm, via structure expansion, is indeed a very powerful classifier and has outstanding performance in the practical application, it has achieved great success in many areas, especially in spam classification and disease diagnosis. It assumes that the features are independent of each other, but in real life, this assumption is simply not established. However, it is still very good, even the assumption is not established. Especially in the case of small-scale samples, it has a solid mathematical foundation and a relatively stable classification efficiency. At the same time, the Naive Bayesian classification model is less sensitive to data loss, with less parameter estimation and digestible algorithm.
In the field of text classification research, in the early 1950s researcher H. P. Luhn firstly put forth the theory based on frequency that characteristics of the entries appear in the text to calculate classification information. After that, some scholars put forth a new text model, called Vector Space Model (short for VSM). It can be represented by vector space composed of a series of characteristics, which reduces the complexity of text representation greatly and improves the efficiency of text classification. With the development of research, machine learning algorithm replaced the previous classification algorithm gradually. There are multiple classification learning methods used in message text classification, such as Naive Bayes, Neural Network, Support Vector Machine (SVM), etc. Naive Bayes, K-nearest Neighbor Algorithm and SVM are more commonly used. Text Feature Selection is the key step of automatic text classification. It is a process that applying computer technology, under the predefined classification system, according to the document content to be classified, attributes it to one or more categories. Automatic text classification technology research began in the 1950s, but now many classification models based on different theories have appeared, among which VSM is used to represent documents. For example, the letter T presents vocabulary collection contained by the document. Each word and its weight in the text are regarded as feature items, so the document can be expressed as the vector d = (t1, t2 … tm) (ti ∈ T, 1 ≤ i ≤ m), and then according to the document vector and category vector, calculate the similarity, so as to determine document category. This paper proposes a new analysis method of email communication security behavior. Communication behavior is a behavior relationship between both sides while communicating via email. Naive Bayesian classification principle in applied statistics is to classify communication behavior between the sender and the receiver of email [4][5]. The fundamental principle of this method is firstly to analyze all documents in both email and its attachments such as text content and pictures via relatively mature file analysis technology, for example, steganalysis, as well as the set of characteristic attribute of email content generated by technology. Take the characteristic attribute of email content as input set of Naive Bayesian Classifier, and the communication behavior relationship between the sender and the receiver as classified results. Then the classifier will be generated by training samples. Finally, this classifier will be applied to classify communication behavior relationship of the sender and the receiver of new email.

Naive Bayesian Classification Principle
Naive Bayesian classification is an easy and effective method, and applied widely. With excellent performance compared with Decision Tree and Neural Network Classification Algorithm, in some cases it is even better than other classifiers. Naive Bayes fundamental principle is to calculate the probability that all types appear on the condition of items to be classified. The item with the biggest probability will be regarded as that type. The definition of Naive Bayesian classification is as follows: set X={a1, a2, … , am} as an item to be classified; every a is the characteristic attribute of X, category set C={y1, y2, … , yn}, then calculate P(y1|x), P(y2|x), … , P(yn|x). If P(yk|x)={P(y1|x), P(y2|x), … , P(yn|x)}, then x∈yK, among which the key step is to calculate every conditional probability of P(y1|x), P(y2|x), … , P(yn|x).

Date Collection
Some of email data from Enron email data sets and one security company, and some emails collected by ourselves at spare time, are selected 10,000 randomly as the test set, among which are selected 1000 as training samples to classify. See the classification of communication behavior relationship of the sender and the receiver according to characteristic attribute in Table 1. There are 730 normal emails, 192 emails that one of two sides belongs to malicious attack, 44 emails that both sides belong to leaked relationship, 34 emails that both sides have no relationship.

Data characteristic of Pre-extraction and Processin
Characteristic attributes of email contents will be extracted and divided before classifying communication behavior relationship between sender and receiver of email. Firstly, texts and attachments in email are extracted, and characteristic attributes come the second by means of steganalysis. This method is to extract keywords from text, and to analyze hidden information such as pictures and videos in the attachments. The process of analysis on emails and extraction of characteristic attributes is shown in Figure 2.  The detection process of texts and attachments in email will apply specific steganalysis and malware detection technology. Both of them have been mature, and own high reliability. The results are shown in Table 2. However, when malware is detected in attachments, it may not be a real one. Sometimes it may be an important file the receiver needs. Therefore, under such circumstance, other characteristic attributes should be analyzed together, so as to judge whether it is a malicious email or not.

4.1.3.
Characteristic of times that leaked information appears. Emails can be used to pass on secret messages via multimedia files like pictures and videos, as well as other office files. There are many methods of file encryption such as hidden information in file storage structure, adding vital messages to postfix of file name, etc. During the detection process of the whole email content, analysis software can identify and find out the file with hidden information effectively, which can help judge entity relationship of both sides in email communication better. In the experiment, times that leaked information appears are also taken interval partition as 3 intervals: (0, 3), [3,6), [6, +∞).

Classifier Construction of Email Behavior Relationship
If tests the set manually, it will cost lots of manpower and material resources, and it is poor efficient. On the contrary, if automatic monitoring mechanism can be introduced, work efficiency will be dramatically increased. Consequently, in order to classify email communication behavior relationship, classification types should be given: C=0 stands for normal communication; C=1 stands for one side belonging to malicious attack; C=2 stands for both sides belonging to leaked relationship; C=3 stands for both sides being in sensitive area. According to last part, 3 characteristic attributes are selected: a1: times that keywords appear in file; a2: whether malware exists in file; a3: times that leaked information appears. Divide them in accordance with data characteristics: a1:

Sample training
Based on the previous conclusion, applied Naive Bayesian classification method, 1000 emails selected randomly taken as training samples, Naive Bayesian classifier will be established. See characteristics and details of email entity relationship in Table 3, see part of sample training data in Table 4. Finally, train sample data and establish basic Bayes classifier model.

Experimental Results and Analysis
Based on classifier model, our system will classify the following 3,500 emails data, and monitor the accuracy of classifier. With the increasing of email data examples continuously, the classification results are shown in Table 5 below: It is shown in figure 3 below that with the increasing of testing data, the classification accuracy is gradually to be steady as over 84%, which means classification results by classifier is reliable.

Conclusion
This paper aims to propose a new email communication security behavior analysis method by theoretical analysis and experimental data verification. This method can effectively analyze the relationship between the two sides of e-mail communication. At present, one simple system of classification system has been mainly completed, and has gained good impact in the field of email communication behavior. The method can also be improved by optimizing the Bayesian classification.