An Ontology for Digital Forensics in IT Security Incidents - OPUS

34 CHAPTER 5. ONTOLOGY
5.1.1 Creating an ontology
This section describes one possible approach to develop an ontology. It is
mainly based on [Noy and McGuinness, 2001] and the author's experiences
when creating the forensic ontology.
There is not the one perfect way to do this. The method depends on
the application it is designed for and the possible extensions that should be
possible. It is recommendable to use the technical terms of the domain in
the ontology. A guideline which steps should be taken is outlined in the
following.
1. Identify the domain and the scope. This includes nding out which
domains the ontology should deal with. Another aspect is the eld
it will be used for and the questions that should be answered. An
important point is the person to use and maintain the ontology. For
the forensic ontology these questions are answered in chapters 3 and 4.
2. Can existing ontologies or structuring be reused? This issue is important
in many ways. If an ontology exists, it saves much time as it can
be used as it is or can be adapted. If there is a structuring for data
that should be used, this can be a lead for the creation of the ontology.
In the current case for the hard disk and the random access memory
structures already exist, as explained in section 4.2.1 and 4.2.2.
3. List all terms that belong to the subject. It is useful to write down all
terms regardless of implied structure so that nothing is forgotten.
4. Dene classes and class hierarchy, properties of the classes and restrictions
of the properties. This step rst requires to realize which terms
should be represented as classes and which as properties. This question
will be explained more thoroughly at the end of this section. As the
next step, the classes, then the properties, and nally the restrictions
need to be identied. The restrictions can be compared to data types
in typed programming languages. It has to be decided about the representation
the data types need to have in the ontology. For example,
the property that identies the forensic tool a piece of information was
retrieved by needs a restriction to such an extent that the value needs
to be of the type forensic tool.
5. Build instances of the specied classes. As a last step, instances belonging
to the ontological side of the structure need to be specied.
Whether an instance is part of the ontology or part of the data that is
stored is in the eye of the beholder. For example, the specic forensic
tools can be counted to the ontology because they are known prior to
the examination. On the other hand it can be argued that the ontology
has to be independent of the tools and the tools belong to the data
that is identied in the course of the examination.