Individual and Collective Analysis of Anomalies in Message Traffic

We consider four properties by which intercepted messages can be selected for deeper analysis: their external properties, their content, their authorship, and the mental state of their authors. We argue that, rather than trying to differentiate directly between ‘good’ messages and ‘bad’ messages, it is better to use a two-pronged approach, where a simple detection scheme triggers a reaction in authors of ‘bad’ messages. This reaction is easier to detect than the original difference. We also suggest that differentiation is more effective when it is done for sets of messages, rather than on a message by message basis.