Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{197891,
        author = {Sangeetha.K and Arithiran R G and Arul Raj V and Jeremiah Renswick J},
        title = {Network-Based Suspicious User Identification in Encrypted Chat Platforms Using Metadata Correlation and Machine Learning Techniques},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {12},
        number = {11},
        pages = {7377-7383},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=197891},
        abstract = {End-to-end encrypted messaging platforms such as WhatsApp and Telegram provide strong privacy guarantees by preventing unauthorized access to message content. However, these protections also create challenges for digital forensic in- vestigators attempting to detect suspicious user behavior across encrypted communication environments. Traditional forensic ap- proaches depend heavily on message content inspection, which is no longer feasible in modern encrypted messaging systems.
This paper proposes a metadata-driven suspicious-user iden- tification framework capable of detecting coordinated communi- cation patterns across encrypted chat platforms without violating encryption integrity. The proposed system analyzes timestamps, packet size distributions, session durations, communication fre- quencies, device identifiers, and network traffic characteristics to identify anomalous behavioral patterns. A machine learning pipeline combining clustering, classification, and correlation scor- ing is introduced to detect suspicious users with high accuracy while preserving user privacy.
Experimental evaluation demonstrates that the proposed framework improves anomaly detection performance compared with baseline statistical methods and supports lightweight de- ployment in forensic analysis environments.},
        keywords = {Encrypted Messaging, Metadata Analysis, Dig- ital Forensics, Suspicious User Detection, Machine Learning, Network Behavior Analytics},
        month = {April},
        }