Cyber Forensics Ontology for Cyber Criminal Investigation

Park, Heum; Cho, SunHo; Kwon, Hyuk‐Chul

doi:10.1007/978-3-642-02312-5_18

Cited by 39 publications

(16 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Park and colleagues [2] propose a cyber forensics ontology for criminal investigation in cyber space. The proposed ontology emphasizes on the definitions of the different types of cyber crimes such as cyber terrorism, general cyber crimes, hacking, fraud, etc.…”

Section: Related Workmentioning

confidence: 99%

Method ontology for intelligent network forensics analysis

Saad

Traoré

2010

2010 Eighth International Conference on Privacy, Security and Trust

View full text Add to dashboard Cite

Network forensics is an after the fact process to investigate malicious activities conducted over computer networks by gathering useful intelligence. Recently, several machine learning techniques have been proposed to automate and develop intelligent network forensics systems. An intelligent network forensics system that reconstructs intrusion scenarios and makes attack attributions requires knowledge about intrusions signatures, evidences, impacts, and objectives. In addition, problem solving knowledge that describes how the system can use domain knowledge to analyze malicious activities is essential for the design of intelligent network forensics systems. In this paper we adapt recent researches in semantic-web, information architecture, and ontology engineering to design a method ontology for network forensics analysis. The proposed ontology represents both network forensics domain knowledge and problem solving knowledge. It can be used as a knowledge-base for developing sophisticated intelligent network forensics systems to support complex chain of reasoning. We use a real life network intrusion scenario to show how our ontology can be integrated and used in intelligent network forensics systems.

show abstract

Section: Related Workmentioning

confidence: 99%

Method ontology for intelligent network forensics analysis

Saad

Traoré

2010

2010 Eighth International Conference on Privacy, Security and Trust

View full text Add to dashboard Cite

show abstract

“…Although the characteristics of each device class are discussed, the ontology is not used in any computer-assisted examination. The work of [13] also proposes a high level ontology for the concepts of cyber crime investigation. The ontology includes concepts related to general procedures, such as collection and identification of evidence.…”

Section: Related Workmentioning

confidence: 99%

A framework for semantic annotation of digital evidence

Hoelz

Ralha

2013

Proceedings of the 28th Annual ACM Symposium on Applied Computing

View full text Add to dashboard Cite

Most tools used during the forensic examination process emphasize data and metadata extraction without a formal definition of the concepts used in their outputs. These vary not only in the terminology used, but also in the way values are represented. These differences hinder the adoption of computer-assisted analysis, since the elements to be analyzed are not well-defined, requiring ad hoc parsers to process and interpret the output of each tool. A framework for semantic annotation of digital evidence is presented in this work. Semantic annotations use concepts that are defined in an ontology to describe the annotated object. They can replace raw metadata, user-defined labels and tool-specific analysis results with computer-readable, formally defined terms that can be used in semantically advanced queries. The framework's components provide means to extract, analyze and index the contents of the digital evidence. The framework allows the augmentation of a base ontology, by adding domain and case-specific concepts to it. A prototype implementation is described and a case study is conducted to illustrate its potential uses and improvements to the forensic examination process.

show abstract

“…Heum Park et al [17] developed Cyber Forensics Ontology for the cyber investigations in cyberspace. The authors classified Cybercrime into two classes-cyberterror and general cybercrime-and how these two classes are related.…”

Section: Literature Reviewmentioning

confidence: 99%

An Ontology Based on the Timeline of Log2timeline and Psort Using Abstraction Approach in Digital Forensics

Bhandari

Jusas

2020

Symmetry

View full text Add to dashboard Cite

Digital forensics practitioners encounter numerous new terminologies during time-intensive digital investigation processes because of the explosive growth of the web, an immense amount of data, and rapid changes in technology. In such a scenario, the time needed to find and interpret the cause of the potential digital incident can be affected by the complexity involved in understanding the meaning of newly encountered terminologies. Although various approaches have been designed to assist digital practitioners in understanding the newly encountered terminologies during the investigation of the accident, none of them is capable of supporting investigators to interpret new terminologies. Our work focuses on reconstructing and analyzing the timeline of events and artifacts backed by the abstraction concept to help practitioners in reasoning about the perceived meaning of different digital forensics terminologies that are encountered during the investigation. This paper introduces an ontological approach based on the abstraction concept to reconstruct the timeline provided by command-based digital forensic tools, i.e., Log2timeline and Psort in the L2TCSV format, and assist in resolving the meaning of new encountered concepts. The performed experiments show that the novel methodology is capable of enhancing the timeline and assisting practitioners in determining the significance of encountered terminologies or concepts.

show abstract

Cyber Forensics Ontology for Cyber Criminal Investigation

Cited by 39 publications

References 6 publications

Method ontology for intelligent network forensics analysis

Method ontology for intelligent network forensics analysis

A framework for semantic annotation of digital evidence

An Ontology Based on the Timeline of Log2timeline and Psort Using Abstraction Approach in Digital Forensics

Contact Info

Product

Resources

About