An Ontology for Digital Forensics in IT Security Incidents - OPUS

Chapter 9
Summary
The goal of this work has been dened as developing an ontology that makes
it easier to investigate security incidents. The required features include automatic
extraction of evidence from a computer and a way to gather evidence
from the extracted data.
The ontology was created, using existing generic structures for the different
forensically interesting parts of the computer. In this work the hard
disk and the random access memory were dealt with. To accomplish the
extraction of the data from these sources, existing forensic tools are used
and their output is converted to a format that conforms with the structure
of the ontology. To gather evidence from the converted data, it is stored in a
queryable triple store. A collection of queries has been developed and tested
on real malware samples (section 7.6 and chapter 8).
A problem with the visualization of ontologies is that in contrast to other
markup language, for example UML, the graphical representation of the
individual elements is not specied.
What cannot yet be found by the ontology are traces that are located
in the content of the les on the hard disk or in the code respectively the
data of the random access memory. Such information can be integrated in
the developed ontology by including additional forensic tools. Any other
information that may be useful to investigate a case can be included in the
ontology as it is shown in section 7.7.
An advantage of the XML based structure of RDF is the easiness of
generating it from the output of dierent tools.
That the provided queries can be used to nd traces of malware was
shown in chapter 8.
Traces of malware can also be found by virus scanning programs. But in
contrast to these, the ontological approach allows to nd malware for which
there does not yet exist a signature or behaviour prole or any other characteristic
for detection. Additionally it is not the purpose of this approach
to compete with such programs, as forensic analysis most times takes place
69