## The Investigation Framework
### Dimensions of the Investigation
#### 4.1.1. Feature Extraction  
In order to apply the classification technique, we need to extract features to classify from texts, in order to obtain a different representation of texts. We decided to adopt the _n-gram model_, that is widely adopted in text classification. Hereafter, we shortly introduce the four basic n-gram patterns we adopted in our investigation. * **Uni-gram patterns. ** In our model, a _uni-gram_ is a single word (or token) that is present in the text. Uni-gram patterns are singleton patterns, i.e., a single word is a pattern itself (i.e., n-grams with \(n=1\)). Uni-gram patterns do not consider the relative position of words in the text. * **Bi-gram patterns. ** A _bi-gram_ is a sequence of two consecutive uni-grams (n-grams with \(n=2\)), i.e., two consecutive words in the text. * **Tri-gram patterns. ** A _tri-gram_ is a sequence of three consecutive uni-grams (n-grams with \(n=3\)), i.e., three consecutive words in the text. * **Quad-gram patterns. ** A _quad-gram_ is a sequence of four consecutive uni-grams (n-grams with \(n=4\)), i.e., four consecutive words in the text. With these premises, we can represent a document \(d\) (a message text, in our context) as a vector of terms, i.e., \(d[j]\) is the \(j\)-th term in the document. When we consider n-grams, the document is represented as a vector of n-grams, i.e., \(d[j]\) is the n-gram whose first word is in position \(j\) in the original document (of course, if \(n=1\), the vector of uni-grams and the vector of words coincide.). Table 1 reports four different ways of representing a sample document, based on uni-grams, bi-grams, tri-grams and quad-grams, by reporting the different vectors that represent the same document. For example, if we consider the case \(n=3\) in Table 1, \(d\) contains only two items, i.e., \(d[1]\) and \(d[2]\). Figure 2: Dimensions of the investigation. Moving from the methodology proposed in [36], we consider also combined features, i.e., features obtained by combining basic features (i.e., uni-grams, bi-grams, tri-grams and quad-grams). Given \(z\) sets of basic features \(BF_{i}\), with \(1\leq i\leq z\), a set \(CF\) of complex features is obtained by means of the Cartesian product of sets \(BF_{i}\), i.e., \(CF=BF_{1}\times BF_{2}\times\cdots\times BF_{z}\). Thus, a feature in \(CF\) is a tuple of \(z\) basic features (n-grams). As an example, consider Table 1. A feature obtained by combining a uni-gram and a bi-gram is the tuple \(\langle\)\"this\", \"a sentence\"\(\rangle\). In our framework, we considered the four basic feature patterns and five complex feature patterns. In Table 2, we report them and the corresponding abbreviation we will use throughout the paper. **Feature weight. ** In order to help the construction of the classification model, features are weighted. Typically, in text classification the most-frequently adopted metric is _Term Frequency-Inverse Document Frequency_ (TF-IDF) [37]. It is a numerical score which denotes the importance of a term in a collection of documents. TF-IDF is the combination of two scores which are called _Term Frequency_ and _Inverse Document Frequency_. The comparative analysis in [38] demonstrated that TF-IDF significantly improves the effectiveness of classifiers. The score balances the importance of a term for a given document with respect to its capability of characterizing a small number of documents. The rationale is that if a term is highly frequent in the collection, it does not characterize a subset of documents; thus, terms that appear in many documents cannot be considered relevant features for any document. Consider a set \(D=\{d_{1},\ldots d_{n}\}\) of documents, where each document \(d_{i}\in D\) is a vector of terms (in the broadest sense, i.e., terms can be either n-grams or tuples of n-grams). The Term Frequency \(Tf(t,d)\) of a term \(t\) in a document \(d\) is the number of times \(t\) appears within \(d\) on the total number of terms in \(d\) (see [39]).