General information
The new "Account-Linking Suggestions" program feature was developed to allow Maltego Evidence to independently identify profiles of the same person and mark them as potential account links. This feature provides an efficient way to identify and manage duplicates or different accounts of the same user.
The detection logic has been designed in a modular way to allow the seamless integration of new detection factors. This allows the system to remain flexible and adapt to changing requirements and environments.
In addition, account-linking provides a user-friendly interface through which the user can manage all recognized potential account links. This central interface allows the user to merge or separate accounts to optimize account management.
The implementation of the account-linking feature significantly improves the efficiency and usability of Maltego Evidence by eliminating redundant accounts and optimizing the management of user profiles.
Recognition logic
The implementation initially enables the recognition of account links based on the data of a single profile. These are in particular:
- User ID
- User ID number
- Vanity name (username)
Factors for recognizing similar profiles can include:
- Same username
Similar username - similar spellings or general similarity of words are taken into account
Examples:
"Michael Mustermann" -> "Michael Muster" "Michael Mustermann" -> "Michael Musterman" - Components of the user name in the user ID
Examples:
"Michael Mustermann" -> michael.mustermann.234 "Michael Mustermann" -> MichaelMustermann234 - Components of the user name are also similar in the user ID
Examples:
"Michael Mustermann" -> michael.muster.234 "Michael Mustermann" -> MichaelMuster234
Detection accuracy
Each detection is assigned a probability (0% to 100%).
For better usability, Maltego Evidence offers a filter of account linking suggestions in three modes
Mode "Conservative"
The "Conservative" mode displays account linkings with an accuracy of between 85% and 100%.
Mode "Normal"
The "Normal" mode displays account linkings whose accuracy is between 65% and 85%. In addition, all hits in "Conservative" mode are also displayed.
Mode "Creative"
The "Creative" mode displays account linkings whose accuracy is below 65%. In addition, all hits from the "Conservative" and "Normal" modes are also displayed.
Confirm account linkings
The automatic detection of account linkings is an algorithm-based automatic suggestion function. Therefore, the detected suggestions are not applied automatically. Each suggestion must be checked and confirmed manually.
You can tell whether account-linking suggestions are available in your project by the account linking icon in the project system bar. The number at the top of the icon displays the number of account links detected, depending on the selected mode.
To open Account-Linking Suggestions, click on the icon in the top right.
Alternatively, each account that is opened in the right-hand data panel also shows whether an account linking has been detected for this account.
Account-Linking Suggestions window consists of two areas. In the left panel, you can set the account-linking mode and filter the detected account links.
The table on the right shows you the detected account links.
Mode selection
Click on "Conservative", "Normal" or "Creative" to set the accuracy of the displayed account linkings.
Account linking table
All account links corresponding to the mode are displayed in the account-linking table. Each presumably related account linking is framed in gray.
To confirm an account linking, mark the checkbox next to the account names you would like to link and click on "Apply". The checkbox in the greyed our bar lets you select all accounts linked to the name at the same time.
After confirming the account linkings, they will be displayed in the data explorer in the same way as the manual account linkings.
If the account linking proposal is not correct, you can discard it. To do this, select the checkbox in front of each account whose suggestion you want to discard and click on "Don't show again".
If you want to confirm several account linking proposals at the same time, select all the relevant accounts and click on "Apply all selected".
Existing projects
With the introduction of account linking suggestions, an automatic comparison is carried out in all new projects after each new data collection and account linking suggestions are identified.
This function must first be set for existing projects.
- Open the project in question from your project list.
- Open the project settings
- Scroll down to the sub-item "Account Linking Suggestions"
- Move the slider to "Enabled" and click on "Calculate".
The calculation may take a few seconds, depending on the number of profiles in the project.
