Authorship attribution is considered a vital tool in cybersecurity, primarily for identifying malicious actors behind anonymous text. In cyber threat intelligence and digital forensics, attributing textual content, such as phishing emails, underground forum posts, anonymous documents, and threat messages, to their original authors remains a challenging task. This challenge is further evident in Arabic, due to its rich morphology, high stylistic variability, and the prevalence of short, noisy texts in real-world scenarios. This paper proposes a two-level supervised learning approach for Arabic authorship attribution that integrates document-level and sentence-level analysis to enhance classification performance. In the preliminary learning phase, documents are represented using binary stylometric features and classified using a linear logistic regression model optimized via Stochastic Gradient Descent (SGD). A Document-based Probability Indication Procedure (DPIP) is introduced to distinguish between significant and non-significant documents using class-probability information. Non-significant documents are processed in a final learning phase. A refined sentence-level dataset is constructed using a sentence-based elicitation procedure (SEP) that selects the most discriminative sentences per author. A sentence-level classifier is then trained and applied. Final document labels are determined using the Sentence-based Majority Procedure (SMP). The proposed approach is evaluated on a benchmark Arabic dataset comprising texts from 10 authors across multiple topics. Experimental results demonstrate that the proposed approach achieves an overall accuracy of 99.28%, outperforming several state-of-the-art approaches. Furthermore, the final-level phase significantly improves classification performance for non-significant documents, from 59.51 to 71.17%. Collectively, these results confirm the effectiveness of the proposed approach in accurately identifying the author of Arabic documents, including short and multi-topic documents.
Aldebei et al. (Thu,) studied this question.