An Ontology for Digital Forensics in IT Security Incidents - OPUS

7.6. SPARQL 61
1 SELECT DISTINCT ? nrun ? name ? command
2 WHERE {
3 ? win rdf : type reg : Key .
4 ? win reg : name [ rdf : value " Windows " ] .
5 ? win reg : hasSubKey [ rdf : value ? cv ] .
6 ? cv rdf : type reg : Key .
7 ? cv reg : name [ rdf : value " CurrentVersion " ] .
8 ? cv reg : hasSubKey [ rdf : value ? run ] .
9 ? run reg : name [ rdf : value ? nrun ] .
10 FILTER ( regex ( str (? nrun ), " Run ", "i ")) .
11 ? run reg : hasValue [ rdf : value ? value ] .
12 ? value reg : key [ rdf : value ? name ] .
13 ? value reg : value [ cnt : ContentAsText ? command ] .
14 }
Listing 7.6: Autorun Query
says that the pro:parent predicate can be matched not, once or multiple
times. So the variable ?parent is bound to the one of the ancestors of ?child
regarding the pro:parent relation. The structure of the process part of the
ontology requires that the most basic parent process has itself as parent as
demanded in section 6.5. Along with line seven this leads to the fact that
the ?parent variable must be the most basic root. The lter in line eight
ensures that the predicate in line six is not applied zero times. If any of
the restrictions in the OPTIONAL block does not match the variable ?parent
is not bound. This case is ltered in line ten, so only those processes are
included in the result that do not have a parent according to the restrictions
in the OPTIONAL block.
1 SELECT DISTINCT ? parent ? child ? childname
2 WHERE {
3 ? child rdf : type pro : Process .
4 ? child pro : Name [ rdf : value ? childname ] .
5 OPTIONAL {
6 ? child pro : parent * ? parent .
7 ? parent pro : parent ? parent .
8 FILTER (? child != ? parent )
9 }
10 FILTER (! BOUND (? parent ))
11 }
Listing 7.7: Parent Process SELECT query