Ontology-Driven Data Semantics Discovery for Cyber-Security

The analysis of forensic investigation results has generally been identified as the most complex phase of a digital forensic investigation. This phase becomes more complicated and time consuming as the storage capacity of digital devices is increasing, while at the same time the prices of those devices are decreasing. Although there are some tools and techniques that assist the investigator in the analysis of digital evidence, they do not adequately address some of the serious challenges, particularly with the time and effort required to conduct such tasks. In this paper, we consider the use of semantic web technologies and in particular the ontologies, to assist the investigator in analyzing digital evidence. A novel ontology-based framework is proposed for forensic analysis tools, which we believe has the potential to influence the development of such tools. The framework utilizes a set of ontologies to model the environment under investigation. The evidence extracted from the environment is initially annotated using the Resource Description Framework (RDF). The evidence is then merged from various sources to identify new and implicit information with the help of inference engines and classification mechanisms. In addition, we present the ongoing development of a forensic analysis tool to analyze content retrieved from Android smart phones. For this purpose, several ontologies have been created to model some concepts of the smart phone environment.

2017

The analysis of forensic investigation results has generally been identified as the most complex phase of a digital forensic investigation. This phase becomes more complicated and time consuming as the storage capacity of digital devices is increasing, while at the same time the prices of those devices are decreasing. Although there are some tools and techniques that assist the investigator in the analysis of digital evidence, they do not adequately address some of the serious challenges, particularly with the time and effort required to conduct such tasks. In this paper, we consider the use of semantic web technologies and in particular the ontologies, to assist the investigator in analyzing digital evidence. A novel ontology-based framework is proposed for forensic analysis tools, which we believe has the potential to influence the development of such tools. The framework utilizes a set of ontologies to model the environment under investigation. The evidence extracted from the env...

International Journal of Computer Applications, 2016

Cloud Computing, a relatively new concept and all its associated methodologies offer uncountable advantages nowadays. These advantages range from integrating different systems, offering guarantee over searching mean distribution and to software tools integration, used by various cloud service providers and consumers. So all these provisions are not only making our lives easier but attract lots of intruders and malicious actors to perform various cloud crimes. This paper aims to contribute towards the design of an ontology based cloud forensic framework with a view to identify the malicious actors. The proposed framework consists of mainly two components-Ontology-Enabled Forensic Blackboard (OFB) and Ontology-Enabled Forensic Controller and Processor (OFCP). The main function of OFB is to communicate with the investigators after receiving the classified crime incident scene collected from VM snapshots where ontology base is used spontaneously to distribute the investigators" request for proper information relevant to the investigation. Whereas, the function of the OFCP is to interact with different Cloud Malicious Actor Identifier (CMAI) so that accurate information can be gathered based on the distributed request with the help of a meta-ontology framework that acquire and restructure data using different AI reasoning tools and finally the mapping with its corresponding requests is done.

INTERNATIONAL JOURNAL OF COMPUTERS & TECHNOLOGY

The abundance in the usage of Internet, in every arena of life from social to personal, commercial to domestic and other aspects of life as well, leads the rise in cybercrime at an upsetting speed. More illegal activities as a result of cyber crime, reason to tempts many network attacks and threats. Network forensics is the branch of fornesics that deals in the detection of network attacks. Botnet is one of the most common attacks, but hazardos. It  is a network of hacked computers It  involves the capturing, storing and then analysis of the network packets, in order to identify the source of the attack.  Various methods based on this approach for botnet detection are suggested in literature but there is no generalized method to represent the basic methodology used by any of the botnet detection method. With such guidelines, the comparison among the various implementations, a roadmap for the new implementation, development of reusable implementations can be addressed. According...

Proceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research - CSIIRW '10, 2010

Current intrusion detection systems (IDS) generate a large number of specific alerts, but do not provide actionable information. Many times, these alerts must be analyzed by a network defender, a time consuming and tedious task which can occur hours or days after an attack. Improved understanding of the cyberspace domain can lead to great advancements in cyberspace situational awareness research and development. This thesis applies the Cross Industry Standard Process for Data Mining (CRISP-DM) to develop an understanding about a host system under attack. Data is generated by launching scans and exploits at a machine outfitted with a set of hostbased data collectors. Through knowledge discovery, features are identified within the data collected which can be used to enhance host-based intrusion detection. By discovering relationships between the data collected and controlled events, false positive alerts were reduced by over 91% when compared to a leading open source IDS. This method of searching for hidden forensic evidence relationships enhances understanding of novel attacks and vulnerabilities, bolstering ones ability to defend the cyberspace domain. The methodology presented in this thesis, as well as the features identified, can be used to further situational awareness research. iv Dedicated to Grammy and Grampy, who have filled my childhood and beyond with warm and happy memories.

2003

Abstract We have produced an ontology specifying a model of computer attack. Our ontology is based upon an analysis of over 4,000 classes of computer intrusions and their corresponding attack strategies and is categorized according to: system component targeted, means of attack, consequence of attack and location of attacker. We argue that any taxonomic characteristics used to define a computer attack be limited in scope to those features that are observable and measurable at the target of the attack.

Digital Investigation, 2006

Ontology Model Cyber forensics Curriculum Certification Specialization a b s t r a c t

ArXiv, 2020

Despite the potential of Machine learning (ML) to learn the behavior of malware, detect novel malware samples, and significantly improve information security (InfoSec) we see few, if any, high-impact ML techniques in deployed systems, notwithstanding multiple reported successes in open literature. We hypothesize that the failure of ML in making high-impacts in InfoSec are rooted in a disconnect between the two communities as evidenced by a semantic gap---a difference in how executables are described (e.g. the data and features extracted from the data). Specifically, current datasets and representations used by ML are not suitable for learning the behaviors of an executable and differ significantly from those used by the InfoSec community. In this paper, we survey existing datasets used for classifying malware by ML algorithms and the features that are extracted from the data. We observe that: 1) the current set of extracted features are primarily syntactic, not behavioral, 2) datase...

Digital Investigation, 2009

This paper presents DIALOG (Digital Investigation Ontology); a framework for the management, reuse, and analysis of Digital Investigation knowledge. DIALOG provides a general, application independent vocabulary that can be used to describe an investigation at different levels of detail. DIALOG is defined to encapsulate all concepts of the digital forensics field and the relationships between them. In particular, we concentrate on the Windows Registry, where registry keys are modeled in terms of both their structure and function. Registry analysis software tools are modeled in a similar manner and we illustrate how the interpretation of their results can be done using the reasoning capabilities of ontology.

2010

Digital investigation involves examining large volumes of data from heterogeneous sources. We offer a framework for facilitating examination and synthesis of this mountain of data using ontology matching and machine learning technology.