An Ontology for Digital Forensics in IT Security Incidents - OPUS

62 CHAPTER 7. IMPLEMENTATION
Another possibility to achieve the result is to use the query from listing
7.8. A CONSTRUCT query returns a RDF graph.
The rst line species that the triples in the result graph are built using
the variables ?s, ?p and ?o. The UNION keyword species that one of the
two restriction blocks before or after the word needs to match.
The rst block denes that ?s and ?o must be of the type pro:Process,
that ?o is the parent process of ?s. Line eight says that for this block the
predicate of the result triple is a relation between ?s and ?o.
Line twelve species that ?s is of the type pro:Process. The next two
lines bind ?o to the name of the process in ?s and ?p to a relation between
?s and ?o. The lter in line fteen is needed because there is more than one
possible binding for ?p. This is not needed in the other block because there
is no other connection between two processes. If the query is issued in the
Sesame web front end, the resulting triples are shown and the RDF graph
can be downloaded. The downloaded le can then be analysed in other tools
like RDF Gravity. An example graph that contains malicious processes that
tried to hide by removing the connection to their parent process and is being
visualized with RDF Gravity, is shown in the appendix in gure C.2. The
processes can be found in the upper left corner of the drawing layer.
1 CONSTRUCT { ?s ?p ?o . }
2 WHERE
3 {
4 {
5 ?s rdf : type pro : Process .
6 ?o rdf : type pro : Process .
7 ?s pro : parent ?o .
8 ?s ?p ?o .
9 }
10 UNION
11 {
12 ?s rdf : type pro : Process .
13 ?s pro : Name [ rdf : value ?o ] .
14 ?s ?p [ rdf : value ?o ] .
15 FILTER ( regex ( str (? p), str ( pro : Name )))
16 }
17 }
Listing 7.8: Parent Process CONSTRUCT query