The Evolution of Expressing and Exchanging Cyber-Investigation Information in a Standardized Form

Abstract

Motivation This paper describes the evolution of a community-developed, standardized specification language for representing and exchanging information in the broadest possible range of cyber-investigation domains, including digital forensic science, incident response, and counter terrorism. This initiative was originally called the Digital Forensic Analysis eXpression (DFAX), which has evolved into the Cyber-investigation Analysis Standard Expression (CASE). These standardization efforts include development of the Unified Cyber Ontology (UCO) to provide the scaffolding necessary to satisfy the requirements of a wide range of use cases in multiple specializations. A primary motivation for this community driven initiative is interoperability-to enable the exchange of cyber-investigation information between tools, organizations, and countries. The CASE specification language and UCO ontology are a rational progression from the foundational work on Digital Forensic Analysis eXpression (DFAX), which focused on digital forensic information and provenance context (Casey, Back, Barnum, 2015). "When investigating a single incident, being able to combine the results from multiple tools that are used to extract information from the digital evidence supports forensic reconstruction, including timeline creation and link analysis. In addition, being able to automate the comparison of similar results from multiple tools facilitates dual-tool verification. When crime spans borders, sharing of information between investigative agencies is crucial for a successful resolution. A fundamental requirement in digital forensics is to maintain information about evidence provenance as it is exchanged and processed, to help establish authenticity and trustworthiness. Furthermore, without a standardized approach to representing and sharing digital forensic information, investigators in different jurisdictions may never know that they are investigating crimes committed by the same criminal."

A Multi-Layer Semantic Approach for Digital Forensics Automation for Online Social Networks

“…Few approaches exist for representing and exchanging cyber-investigation data when combining data sources from diverse organizations or dealing with large amounts of data from multiple tools. Casey et al [ 31 ] used an open community-developed specification language called Cyber-Investigation Analysis Standard Expression (CASE) to address this need for information exchange and tool interoperability. The outcome demonstrated a proof-of-concept Application Program Interface (API) to facilitate CASE tool implementation.…”

“…The outcome demonstrated a proof-of-concept Application Program Interface (API) to facilitate CASE tool implementation. Thus, community members can develop and implement CASE and the Unified Cyber Ontology (UCO) [ 31 ]. However, these approaches are focused on unifying and structuring the evidence data for exchange purposes.…”

SoK

“…Indeed AI techniques could potentially assist any time there is a need to correlate data from multiple sources, either from multiple suspects, devices or cases. Non-AI based efforts such as standard form of representations, e.g., CASE [18] will be critical for such efforts.…”

Standard Representation for Digital Forensic Processing

“…The CASE framework and its compatibility with the underlying Unified Cyber Ontology (UCO) [29] are based on years long effort for enabling open ICT ecosystems in different security domains and the development of knowledge-based tools 6 .…”