Benford's Law as a Forensic Tool for Identifying Anomalous Chat Behavior in Instant Messaging Data

Abstract

Digital evidence in mobile forensic investigations involves parsing chat messages to identify suspicious artifacts in a case. With an increasing number of instant messaging apps, many individual chat conversations must be manually categorized as relevant. Chats may include spam and artificially generated messages by AI chatbots or Large Language Models (LLMs). In larger cases, this is a time-consuming process with no recommended method of categorization. Benford's law, a statistical method, is used to detect fraudulent or artificially generated entries. Also known as the “law of leading digits,” this law states that in natural sequential datasets, the first digit is 30 % more likely to be the number “1,” with subsequent digits occurring at progressively lower frequencies. This method has been applied in fraud analysis, financial account manipulation, and anomaly detection within forensic accounting and election fraud investigations. Digital forensics applications include detecting cryptocurrency ledger manipulation and the legitimacy of social network followers. This paper applies Benford's Law for the first time on chat histories to identify AI or spam content. We categorize legitimate chats using the timestamp and character count in each conversation. The results indicate that the character count in spam content shows a statistically significant deviation. Only legitimate chat messages exhibit the typical downward trend associated with the Benford distribution. Record deletion is not detectable using this method. Incorporating this approach into forensic tools may be feasible, requiring minimal additional computational resources, operator training, and transformation of the acquired evidence.