Generalising Event Forensics Across Multiple Domains

In cases involving computer related crime, event oriented evidence such as computer event logs, and telephone call records are coming under increased scrutiny. The amount of technical knowledge required to manually interpret event logs encompasses multiple domains of expertise, ranging from computer networking to forensic accounting. Automated methods of classifying events and patterns of events into higher level terminology and vocabulary hold promise for assisting investigators to cope with voluminous, low-level event oriented evidence. In a previous paper, we showed that the semantic web language OWL was an effective means of representing domain-specific event based knowledge, and when combined with a rule language, was sufficient to apply standard correlation techniques to the task of automated forensic investigation. We also described a prototype implementation of this approach, called FORE. In this paper, we demonstrate that the approach can be extended to be rapidly applied to ...

• Type: Conference
• Year: 2004
• Where: AUSFORENSICS
• Authors: Bradley Schatz, George M. Mohay, Andrew Clark
• Keywords: AUSFORENSICS 2004, Computer Event Logs, Event Logs, Event Oriented Evidence, Forensic Engineering