Creating Proprietary Terms Using Lightweight Ontology: A Case Study - - PowerPoint PPT Presentation

▶
creating proprietary terms using lightweight ontology a
SMART_READER_LITE
LIVE PREVIEW

Creating Proprietary Terms Using Lightweight Ontology: A Case Study - - PowerPoint PPT Presentation

Apr 02, 2023 17 likes •501 views

Creating Proprietary Terms Using Lightweight Ontology: A Case Study on Acquisition Phase in a Cyber Forensic Process Tamer Gayed Hakim Lounis Moncef Bari July 2014 1 Agenda Introduction & Definitions Research Motivations

slide-1
SLIDE 1

Tamer Gayed Hakim Lounis Moncef Bari

Creating Proprietary Terms Using Lightweight Ontology: A Case Study on Acquisition Phase in a Cyber Forensic Process

1 July 2014

slide-2
SLIDE 2

Agenda

  • Introduction & Definitions
  • Research Motivations
  • Research Problems
  • CF-CoC Framework
  • Creating Proprietary terms
  • Conclusions

2

slide-3
SLIDE 3

Agenda

  • Introduction & Definitions
  • Research Motivations
  • Research Problems
  • CF-CoC Framework
  • Creating Proprietary terms
  • Conclusions

2

slide-4
SLIDE 4

Introduction

Thesis title :

  • Representing and Managing Chain of Custody in the

Cyber Forensics using Linked Data Principles

3

  • Creating Proprietary terms using lightweight ontology : A

case study on acquisition phase in a cyber forensic process Today’ discussions :

slide-5
SLIDE 5

Introduction

What is the Cyber Forensics (CF) ?

  • Is a technique for identifying, collecting, preserving,

analyzing, and presenting digital evidence (DE) in a form useful to the court so that the cybercriminals face justice in the court of law (digital investigation).

  • Thus, digital investigation is about investigate digital

incidents to determine the root-cause of an incident and successfully prosecute a perpetrator.

  • Each forensic phase is accomplished by a role player.

CF Definitions 4

slide-6
SLIDE 6

Introduction

What is the Chain of Custody (CoC) – Les chaînes de traçabilité ?

  • Is a chronological tangible document that accompanies

each phase in the forensic process to answer 6 questions:

  • What
  • Why
  • When
  • Where
  • Who
  • How
  • This known as the 5Ws and 1H

CF Definitions 5

slide-7
SLIDE 7

Introduction

Classical way to publish data on web

B C

HTML HTML HTML Web Browsers Search Engines hyper- links

A

Web Aspects :

  • URL
  • HTTP
  • HTML

SW Definitions

hyper- links

6

slide-8
SLIDE 8
  • Before 2006, most of ontologies are published in dump

files and most of them are not interlinked.

  • 2006 : Tim Berners-Lee underlined set of rules to follow

(Guidelines) for publishing data on the web inspired from the same principles of web aspects.

  • Rules are :
  • Use URIs as names for things.
  • Use HTTP as universal access mechanism.
  • Include RDF statements that link to other URIs.
  • A query Language SPARQL can be used to provide

useful information from the represented data.

SW Definitions

Before and after 2006

7

Introduction

slide-9
SLIDE 9

How this can be realized ?

  • URL
  • HTTP
  • HTML

B C

RDF RDF link

A D E

RDF links RDF links RDF links RDF RDF RDF RDF RDF RDF RDF RDF RDF

  • URI
  • HTTP
  • RDF

+

SPARQL

+ +

SW Definitions 8

Introduction

slide-10
SLIDE 10
  • Oct 2007, The LOD Project has been started.

SW Definitions

Emerging of Linked Opened Data (LOD),

9

Introduction

slide-11
SLIDE 11

Introduction

LOD (Cont.)

  • Linked Open Data (LOD) Project : is the most visible

project using the LDP (URLs, HTTP, and RDF).

  • This project created a shift in the community of research

and development of the semantic web.

  • Nowadays, the web is not just concentrated for the

interrelation between web documents but also between the raw data within these documents.

  • Today, the semantic web is a web of data

SW Definitions 10

slide-12
SLIDE 12

Forensic Process

Role players

Jury

CF-CoC

e-CoC

Introduction

CF-CoC Web Application

11

slide-13
SLIDE 13

Agenda

  • Introduction & Definitions
  • Research Motivations
  • Research Problems
  • CF-CoC Framework
  • Creating Proprietary terms
  • Conclusions

12

slide-14
SLIDE 14

Agenda

  • Introduction & Definitions
  • Research Motivations
  • Research Problems
  • CF-CoC Framework
  • Creating Proprietary terms
  • Conclusions

12

slide-15
SLIDE 15

Research Motivations

Why LDP to represent and manage CoC in CF ?

  • Similar Nature between LDP and CF :
  • Each forensic phase can lead to another.
  • LD allows the connection between different resources

in different forensic phase.

  • Thus, LDP allow role players & juries to navigate

between different forensic phases through the RDF typed links

13

slide-16
SLIDE 16
  • Linked data consumption applications are able to interpret

any data even it is represented with unknown vocabulary :

  • URI dereferenceable
  • Mapping between URIs

All forensic data will be resolvable Research Motivations

Why LDP to represent and manage CoC in CF ? (Cont)

14

slide-17
SLIDE 17
  • RDFS and OWL vocabularies can be used with RDF model

allowing the subsumption and relationships between terms

Useful for juries to infer more information from the data Research Motivations

Why LDP to represent and manage CoC in CF ? (Cont.)

15

slide-18
SLIDE 18
  • Accompanied with different provenance metadata to provide

the answer to other six questions, related the data origin

Provenance metadata can be used concurrently with the

published/forensic data to describe their provenance and complement the missing answers related to the forensics investigation. 5WS and 1H, on the level of data origin Why LDP to represent and manage CoC in CF ? (Cont.)

Research Motivations

16

slide-19
SLIDE 19
  • LDP is a way to represent different forensic concepts and

able to realize KR objectives

Representation of data allows :

  • Surrogate of concepts & Ontological commitments
  • Medium of the Role player to express different details

about forensic process

  • RDF model is a standard language that avoid the

ambiguity

Why LDP to represent and manage CoC in CF ? (Cont.)

Research Motivations

17

slide-20
SLIDE 20

Research Motivations

  • Investigation process is a common task between different

role players (Social Environment)

LDP allow mapping between different terms in

different forensic phases

  • Level of URIs
  • Level of terms

Why LDP to represent and manage CoC in CF ? (Cont.)

18

slide-21
SLIDE 21

Research Motivations

  • Naming Resources using URI, allows its deferenceability

Forensic resources will be deferenceable

(retrieve a description of term/resource that is identified by this URI), allow the jury to understand the resource in hand Why LDP to represent and manage CoC in CF ? (Cont.)

19

slide-22
SLIDE 22

Agenda

  • Introduction & Definitions
  • Research Motivations
  • Research Problems
  • CF-CoC Framework
  • Creating Proprietary terms
  • Conclusions

20

slide-23
SLIDE 23

Agenda

  • Introduction & Definitions
  • Research Motivations
  • Research Problems
  • CF-CoC Framework
  • Creating Proprietary terms
  • Conclusions

20

slide-24
SLIDE 24
  • role players : Need to securely record, describe, and

manage the results of their forensic investigation

  • Juries : Need to understand and consume, securely, the

digital evidences and take the proper decision about the provided information

Research Problems

Generally

21

slide-25
SLIDE 25
  • CoC need to undergo a radical transformation from tangible

document into electronic data to not be only used by human, but also by machine

  • e-CoCs need to be secured since their publication by the

role player till their consumption by the juries.

  • Provenance of information is crucial to guarantee the

trustworthiness and confidence of the information provided.

  • Judges’ awareness and understanding the digital evidences

are not enough to evaluate and take the proper decisions.

Research Problems

We need a solution to solve the following issues :

22

slide-26
SLIDE 26

Agenda

  • Introduction & Definitions
  • Research Motivations
  • Research Problems
  • CF-CoC Framework
  • Creating Proprietary terms
  • Conclusions

23

slide-27
SLIDE 27

Agenda

  • Introduction & Definitions
  • Research Motivations
  • Research Problems
  • CF-CoC Framework
  • Creating Proprietary terms
  • Conclusions

23

slide-28
SLIDE 28

CF-CoC Framework

24

slide-29
SLIDE 29

Agenda

  • Introduction & Definitions
  • Research Motivations
  • Research Problems
  • CF-CoC Framework
  • Creating Proprietary terms
  • Conclusions

25

slide-30
SLIDE 30

Agenda

  • Introduction & Definitions
  • Research Motivations
  • Research Problems
  • CF-CoC Framework
  • Creating Proprietary terms
  • Conclusions

25

slide-31
SLIDE 31

– Why ?

  • Terms of the semantic web are not enough/adequate to describe

certain data set or a new domain context.

  • => New Proprietary terms need to be defined

– Lightweight ontology of LD (Linked Data) is the RDFS++. – RDFS++ combines the RDFS constructors and some primitives constructors from OWL. – The primitives constructors imported from OWL are those which are used to equivalent and map between different class and property terms

First Three Layers of CF-CoC

Creating Proprietary (Custom) – Using Lightweight Ontology

26

slide-32
SLIDE 32
  • 7 Commandments to create new terms on the LD :

– Don’t create a term if an existing one will suffice. – When you define a new term, you need to have a namespace that you own and control. – When you create new terms, it is recommended to map these terms to those in existing vocabularies. – Apply all the LDP (HTTP, URL, and RDF) to the term. – If your term is a property (predicate), you have to define its domain and range using the constructors of RDFS++ (RDFS, OWL Primitives) and do not overload your new term with

  • ntological axioms

– If at later time, you discover that another term was enough, an RDF link should be set between the new created term and the existing one. – Label and comment each term you create

First Three Layers of CF-CoC

Creating Proprietary (Custom) - Forensic Term

26

slide-33
SLIDE 33
  • 7 Commandments to create new terms on the LD :

– Don’t create a term if an existing one will suffice. – When you define a new term, you need to have a namespace that you own and control. – When you create new terms, it is recommended to map these terms to those in existing vocabularies. – Apply all the LDP (HTTP, URL, and RDF) to the term. – If your term is a property (predicate), you have to define its domain and range using the constructors of RDFS++ (RDFS, OWL Primitives) and do not overload your new term with

  • ntological axioms

– If at later time, you discover that another term was enough, an RDF link should be set between the new created term and the existing one. – Label and comment each term you create

First Three Layers of CF-CoC

Creating Proprietary (Custom) - Forensic Term

26

slide-34
SLIDE 34

Any term should have a label. A label is used to provide a human- readable name for a resource. Label is an instance of rdf : Property rdfs : label Any term should have a comment. A comment is used to provide a human-readable description of a resource. Comment is an instance of rdf : Property rdfs : comment Common Constructors between Property and Class terms When the term X is of type Class, it can bee also a sub class of another Class term. The subClassOf of a property term is a term of type Class rdfs : subClassOf If X is a term of type ( rdf : type ) Class ( rdfs : Class ) The domain of a property term is always a Class. A domain of a property term X states that the subject slot of the X (i.e., where X is a predicate, because X is a property), interpreted by a reasoners as an instance of said domain of X rdfs : domain The range of a property term is always a Class. A range of a property term X states that the object slot of the X (i.e., where X is a predicate, because X is a property), interpreted by a reasoners as an instance of said range of X rdfs : range When the term X is of type property it can be also a sub property of another property term. The subPropertyOf of a property term is a term

  • f type Property

rdfs : subPropertyOf If X is a term of type ( rdf : type ) Property ( rdfs : Property / owl : ObjectProperty )

RDFS++ - RDFS Constructors

27

slide-35
SLIDE 35

RDFS++ - OWL Primit. Constructors

When the type ( rdf:type ) of a property term X is defined to be of InverseFuntionalProperty, Whenever X property is used as a predicate in a triple, its object will have one and only one subject. Thus, each object should be able to uniquely identify a subject. This constructor is a sub class of owl : objectProperty

  • wl :

InverseFunctionalProperty This constructor is used to state that one property is the inverse of

  • another. It is use to describe inverse relation between properties

(i.e., exactly like the passive voice in the grammar)

  • wl : InverseProperty

This constructor is used to map between two terms of type Property

  • wl : equivalentProperty

Same idea as the last constructor, but here, when X is defined to be

  • f type FunctionalProperty, each subject, where X is a predicate,

can have at most one object. This constructor is a subclass of rdf : property

  • wl : FunctionalProperty

Two URI terms can be mapped together using the sameas

  • constructor. This constructor indicates that these two terms actually

refer to the same thing. It can be used as well to map between two

  • ntologies.
  • wl : sameas

Common Constructors between Property and Class terms This constructor is used to map between two terms of type Class

  • wl : equivalentClass

If X is a term of type ( rdf : type ) Class ( rdfs : Class ) If X is a term of type ( rdf : type ) Property ( rdfs : Property / owl : ObjectProperty )

28

slide-36
SLIDE 36

Lightweight Ontology (Vocabulary) Forensic Phase

Forensic Task 1 Forensic Task 2 Forensic Task 3 Category 1 Category 2 Category 3 Category n Forensic Task n Term 2-1 Term 2-2 Term 2-m Forensic Term 2-1 Forensic Term 2-2 Forensic Term 2-m

Creating Proprietary terms

  • Creating the forensic phase ontology
  • Determine the forensic tasks
  • Identification of terms
  • Creating/Defining of terms

29

slide-37
SLIDE 37

Creating Proprietary terms

Forensic Process

Analysis : examining the data in order to identify pieces of evidence and determine their significance Authentication : ensuring that the acquired evidence has not been altered and kept its integrity Acquisition : acquiring evidence from suspect storage devices

Example : Kruse Model

Acquisition Phase containing 3 forensics tasks :

  • State Preservation
  • Recovery
  • Copying

30

slide-38
SLIDE 38

Creating Proprietary terms

  • Example : The Tangible CoC of a state preservation

“The first responder name of the acquisition phase is Jean-Pierre. He is the role player of this phase, and he preserved the state of the digital media, PDA device, which has the SN: 0G-4023-32-362. The date he did this task is 21 Feb 2014”

31

slide-39
SLIDE 39

Property preserve Object 0G-4023-32-362 Subject/Object PDA-device Subject/Object Jean-Pierre A- Box (publication) Property SN Property preservedby Class Digital_media Ontology Acquisition Class Role_player Class First_responder T- Box (design) Type Term name

Creating Proprietary terms

  • Identification of terms

32

slide-40
SLIDE 40

Creating Proprietary terms

  • Creation of Acquisition Object

Definition of Acquisition Ontology

33

slide-41
SLIDE 41
  • Creation of terms

Lightweight ontology of Forensic Preservation task

34

slide-42
SLIDE 42

Lightweight ontology of Forensic Preservation task (Cont)

34

slide-43
SLIDE 43

Lightweight ontology of Forensic Preservation task (Cont)

34

slide-44
SLIDE 44

https://127.0.0.1/roleplayer/Acquisition#Jean-Pierre cf-coc-Acq:preserve PDA device cf-coc-Acq:preservedby 0G-4023-32-362 cf-coc-Acq:SN

e-CoC of Forensic Preservation State

35

slide-45
SLIDE 45

Agenda

  • Introduction & Definitions
  • Research Motivations
  • Research Problems
  • CF-CoC Framework
  • Creating Proprietary terms
  • Conclusions

36

slide-46
SLIDE 46

Agenda

  • Introduction & Definitions
  • Research Motivations
  • Research Problems
  • CF-CoC Framework
  • Creating Proprietary terms
  • Conclusions

36

slide-47
SLIDE 47

Conclusions

  • 1. This work guarantees the construction of a complete e-CoC,

where forensic data and documentary data can be integrated under a unified framework.

  • 2. PKI approach is used to ensure the identity of each role

player participating in the forensics process and bending the LDP to a small scale (Notion of LCD).

  • 3. Adding provenance metadata to each e-CoC NG, answers

the questions related to the origin of information

  • 4. This framework will foster the subject matter content and

provide descriptive chains of custody

37

slide-48
SLIDE 48

Thanks Any Question ?