An ontology-based approach for the reconstruction and analysis of digital incidents timelines

• DOI: 10.1016/j.diin.2015.07.005
• Publication Date: 2015-08-05T22:23:51Z
• Authors: Yoan Chabot; Aurélie Bertaux; Christophe Nicolle; Tahar Kechadi
• Keywords: Knowledge Extraction; [INFO.INFO-AI] Computer Science [cs]/Artificial Intelligence [cs.AI]; [INFO.INFO-WB] Computer Science [cs]/Web; Ontology Population; [INFO.INFO-OH]Computer Science [cs]/Other [cs.OH]; [INFO.INFO-WB]Computer Science [cs]/Web; Event Reconstruction; 02 engineering and technology; [INFO.INFO-AI]Computer Science [cs]/Artificial Intelligence [cs.AI]; [INFO.INFO-OH] Computer Science [cs]/Other [cs.OH]; Digital Forensics; [INFO.INFO-CY] Computer Science [cs]/Computers and Society [cs.CY]; [INFO.INFO-CY]Computer Science [cs]/Computers and Society [cs.CY]; Forensic Ontology; Timeline Analysis; 0202 electrical engineering, electronic engineering, information engineering

Due to the democratisation of new technologies, computer forensics investigators have to deal with volumes of data which are becoming increasingly large and heterogeneous. Indeed, in a single machine, hundred of events occur per minute, produced and logged by the operating system and various software. Therefore, the identification of evidence, and more generally, the reconstruction of past events is a tedious and time-consuming task for the investigators. Our work aims at reconstructing and analysing automatically the events related to a digital incident, while respecting legal requirements. To tackle those three main problems (volume, heterogeneity and legal requirements), we identify seven necessary criteria that an efficient reconstruction tool must meet to address these challenges. This paper introduces an approach based on a three-layered ontology, called ORD2I, to represent any digital events. ORD2I is associated with a set of operators to analyse the resulting timeline and to ensure the reproducibility of the investigation.