Unified Cyber Forensics: Developing a Semantic Bridge Between Digital Evidence and Law
Cyber Forensics Ontology for Cyber Criminal Investigation
The paper introduces a specialized "Cyber Forensics Ontology" designed for systematic criminal investigations. Using OWL-DL and Protégé, it creates a formal knowledge representation that links crime cases, suspects, and digital evidence with legal frameworks, achieving a structured approach to cyber crime data mining.
TL;DR
This research presents a formal Cyber Forensics Ontology that moves beyond simple database storage. By defining the relationships between crime types (like hacking), specific evidence (volatile vs. non-volatile), and the relevant statutes (Law), it provides a roadmap for intelligent data mining in criminal investigations. This framework enables investigators to automatically link a "memory dump" to a specific criminal act and its legal consequences.
Background: Beyond the Byte Level
Cyber crime investigation is no longer just a technical challenge; it is a knowledge management crisis. Investigators are drowning in high-volume traffic and diverse digital artifacts. The authors argue that the missing link in current SOTA methods is an "Integration Layer" that understands the context of a crime—meaning we need to know not just what was found, but how it maps to a specific Criminal Act or Information Protection Law.
Methodology: The Five Cylinders of Cyber Forensics
The proposed ontology is built using OWL-DL, providing a balance between expressive power and computational decidability. It is structured around five core pillars:
- Crime_Case: The central hub connecting all other concepts.
- Evidence: Categorized into Volatile (RAM, CPU logs) and Non-volatile (HDD, Hacking tools), including the "OrderedProcessSet" which dictates the legal procedure for evidence collection.
- Crime_Type: A taxonomy distinguishing between "Cyber Terror" (Infrastructural attacks) and "General Cyber Crime" (Fraud, Harassment).
- Law: A mapping of technical acts to the specific Korean legal statutes (e.g., Telecommunications Business Act).
- Criminal: Tracking the entities and their associations with various cases.
Logic Check: By defining the property hasBaseLaw, the system can automatically suggest which statutes apply based on the evidence collected, reducing the cognitive load on investigators.
Detailed Evidence Taxonomy
A standout feature of this work is the granular detail of the Evidence Class. It doesn't treat evidence as a static file but as part of a Process. It includes subclasses for specialized investigators, timestamps, and specific actions like getmemoryDump or getRouting.
Impact on Data Mining
This ontology isn't just for documentation; it's a foundation for Advisory Information Systems. With this structured knowledge, data mining techniques can perform:
- Clustering: Grouping similar crime cases by their "Modus Operandi" (Method of Operation).
- Association: Finding links between seemingly unrelated hacking tools and criminal organizations.
- Detection: Identifying deviations from standard investigation processes to ensure legal admissibility in court.
Critical Insight & Conclusion
The true value of this paper lies in its Inductive Bias toward the procedural reality of law enforcement. While other ontologies focused on academic "certification" (e.g., Brinson et al.), this model prioritizes the investigative pipeline.
Limitations: The current ontology is heavily grounded in the Korean legal context (KNPA guidelines). For global application, a cross-jurisdictional "Legal Mapping" layer would be required to handle international cyber-extradition and harmonized cyber-laws.
As cyber threats evolve into AI-driven attacks, this ontological approach provides the necessary semantic infrastructure to build automated, law-aware forensic systems that can keep pace with digital criminals.