Summary
Information security incident handling strategies or models are important to ensure the security of organisations, particularly in cloud and big data environments. However, existing strategies or models may not adequate as cloud data are generally virtualised, geographically distributed and ephemeral, presenting both technical and jurisdictional challenges. We present an integrated cloud incident handling and forensic-by-design model. We then seek to validate the model using a set of controlled experiments on a cloud-related incident. Three popular cloud storage applications were deployed namely, Dropbox, Google Drive, and OneDrive. This study demonstrates the utility of the model for organisational cloud users to undertake incident investigations (e.g. collect and analyse residual data from cloud storage applications). Copyright © 2016 John Wiley & Sons, Ltd.

Cloud incident handling and forensic‐by‐design: cloud storage as a case study

Tabular data to Knowledge Graph matching is the process of assigning semantic tags from knowledge graphs (e.g., Wikidata or DBpedia) to the elements of a table. This task is a challenging problem for various reasons, including the lack of metadata (e.g., table and column names), the noisiness, heterogeneity, incompleteness and ambiguity in the data. The results of this task provide significant insights about potentially highly valuable tabular data, as recent works have shown, enabling a new family of data analytics and data science applications. Despite significant amount of work on various flavors of this problem, there is a lack of a common framework to conduct a systematic evaluation of state-of-the-art systems. The creation of the Semantic Web Challenge on Tabular Data to Knowledge Graph Matching (SemTab) aims at filling this gap. In this paper, we report about the datasets, infrastructure and lessons learned from the first edition of the SemTab challenge.

/pdf/semtab-2019-resources-to-benchmark-tabular-data-to-knowledge-2r3azgwpw2.pdf

SemTab 2019: Resources to Benchmark Tabular Data to Knowledge Graph Matching Systems

Internet of Things (IoT) is increasingly permeating peoples’ lives, gradually revolutionizing our way of life. Due to the tight connection between people and IoT, now civil and criminal investigations or internal probes must take IoT into account. From the forensic perspective, the IoT environment contains a rich set of artifacts that could benefit investigations, while the forensic investigation in IoT paradigm may have to alter to accommodate characteristics of IoT. Therefore, in this article, we analyze the impact of IoT on digital forensics and systematize the research efforts made by previous researchers from 2010 to 2018. We sketch the landscape of IoT forensics and examine the state of IoT forensics under a 3-D framework. The 3-D framework consists of a temporal dimension, a spatial dimension, and a technical dimension. The temporal dimension walks through the standard digital forensic process while the spatial dimension explores where to identify sources of evidence in IoT environment. These two dimensions attempt to provide principles and guidelines for standardizing digital investigations in the context of IoT. The technical dimension guides a way to the exploration of tools and techniques to ensure the enforcement of digital forensics in the ever-evolving IoT environment. Put together, we present a holistic overview of digital forensics in IoT. We also highlight open issues and outline promising suggestions to inspire future study.

A Survey on Digital Forensics in Internet of Things

An ontology-based approach for the reconstruction and analysis of digital incidents timelines

As a popular data management and computation tool, ontology is widely used in material science, biological genetics, chemistry, biology and pharmaceuticals. It can be regarded as a dictionary or a database, and the key of various ontology applications is similarity measuring between concepts in ontology. In this paper, we propose a new ontology learning algorithm for ontology similarity measuring and ontology mapping by means of singular value decomposition method and deterministic sampling iteration. Then, the new ontology learning is applied in plant science, gene biology, bionics and physics ontologies. The data results show the high efficiency of our singular value decomposition based ontology learning algorithm for ontology similarity measuring and ontology mapping.

Ontology algorithm using singular value decomposition and applied in multidisciplinary

A complete formalized knowledge representation model for advanced digital forensics timeline analysis

In this paper, we present the DAGOBAH system which tackles the Tabular Data to Knowledge Graph Matching (TDKGM) challenge. DAGOBAH aims to semantically annotate tables with Wikidata and DBpedia entities, and more precisely performs cell and column annotation and relationship identification, via a pipeline starting from pre-processing to enriching an existing knowledge graph using the table information. This paper presents techniques for typing columns with fine-grained concepts while ensuring good coverage, and for valuing these types when disambiguating the cell content. This system obtains promising results in the CEA and CTA tasks on the challenge test datasets.

/pdf/dagobah-an-end-to-end-context-free-tabular-data-semantic-3gcgoh5uu2.pdf

DAGOBAH: An End-to-End Context-Free Tabular Data Semantic Annotation System

To determine the circumstances of an incident, investigators need to reconstruct events that occurred in the past. The large amount of data spread across the crime scene makes this task very tedious and complex. In particular, the analysis of the reconstructed timeline, due to the huge quantity of events that occurred on a digital system, is almost impossible and leads to cognitive overload. Therefore, it becomes more and more necessary to develop automatic tools to help or even replace investigators in some parts of the investigation. This paper introduces a multi-layered architecture designed to assist the investigative team in the extraction of information left in the crime scene, the construction of the timeline representing the incident and the interpretation of this latter.

/pdf/automatic-timeline-construction-and-analysis-for-computer-9lvv2amywj.pdf

Automatic Timeline Construction and Analysis for Computer Forensics Purposes

Having a clear view of events that occurred over time is a difficult objective to achieve in digital investigations (DI). Event reconstruction, which allows investigators to understand the timeline of a crime, is one of the most important step of a DI process. This complex task requires exploration of a large amount of events due to the pervasiveness of new technologies nowadays. Any evidence produced at the end of the investigative process must also meet the requirements of the courts, such as reproducibility, verifiability, validation, etc. For this purpose, we propose a new methodology, supported by theoretical concepts, that can assist investigators through the whole process including the construction and the interpretation of the events describing the case. The proposed approach is based on a model which integrates knowledge of experts from the fields of digital forensics and software development to allow a semantically rich representation of events related to the incident. The main purpose of this model is to allow the analysis of these events in an automatic and efficient way. This paper describes the approach and then focuses on the main conceptual and formal aspects: a formal incident modelization and operators for timeline reconstruction and analysis.

Yoan Chabot

Papers

A complete formalized knowledge representation model for advanced digital forensics timeline analysis

An ontology-based approach for the reconstruction and analysis of digital incidents timelines

DAGOBAH: An End-to-End Context-Free Tabular Data Semantic Annotation System

Automatic Timeline Construction and Analysis for Computer Forensics Purposes

A complete formalized knowledge representation model for advanced digital forensics timeline analysis