6th European Conference - Academic Conferences

Vincent Garramone and Daniel Likarish
forensics course was used to evaluate whether the literature based taxonomy approach would
produce an acceptable description of the material. The result of the evaluation confirmed that a
literature based seeded taxonomy was a good starting point, but that refinement is necessary. The
digital forensics topic was chosen as our initial case because Regis University wanted to make lab
materials from its computer forensics course available on the PRISM site and felt these materials
would be representative of content for a graduate forensics class. The weekly lab materials were
qualitatively evaluated using the list of forensics terms derived from current forensics literature. These
results were then compared to actual terms in the lab topic descriptions given in the course syllabus.
4.1 Granularizing PRISM taxonomies
One of the major goals of PRISM is to make searching for content intuitive and efficient. To achieve
this, content must be tagged in a way that allows keyword and guided searches to return accurate
results. Since IA terminology varies widely among researchers and practitioners, we have tried to
accommodate the broadest possible group of users by developing several taxonomies to tag content.
After a resource has been associated with a particular taxonomy term, it can automatically be
included in guided searches and is reachable with the advanced search function of PRISM. At the
conclusion of the first major development phase, PRISM was equipped with both the International
Information Systems Security Certification Consortium (Theoharidou and Gritzalis 2007) and U.S.
Department of Homeland Security CBK vocabularies (Shoemaker, Drommi, Ingalsbe and Mead
2007). However, in simple use cases existing vocabularies did not offer a sufficient level of specificity.
Rather than create arbitrary lists of terms a researcher might personally want to search for, it was
decided to review the literature and attempt to distill vocabularies that would reflect common usage
among curriculum developers.
The first effort to granularize the PRISM taxonomies was in the area of digital forensics. Digital
forensics is its own discipline within the realm of information security (Berghel 2003). On this basis,
forensics is considered an ideal candidate for a descriptive taxonomy within PRISM. PRISM
researchers analyzed nine recent publications, primarily from curriculum developers, to identify a
common taxonomic structure and current terminology usage. These publications were selected for
their recent contribution and, based on the level of repetition of terms observed, were considered
adequate in number and scope to generate an initial forensics vocabulary for PRISM. The digital
forensics vocabulary currently being used in PRISM contains the most commonly observed digital
forensics terms from these nine papers, and will explicitly specify relationships between synonyms as
they are identified through site analytics. Table 1 shows the initial list of terms implemented within
PRISM (See Appendix 1 for the complete table). To keep the list to a manageable size, only terms
referenced in at least one third of the papers analyzed were included in this initial vocabulary.
Table 1: PRISM’s initial digital forensics vocabulary
Forensics Topics
Reference Count
Legal Process
6
Log Analysis
6
Data Acquisition 5
Data Decryption 5
Deleted Data Recovery 5
Email Forensics 5
Hidden Data Discovery 5
Steganography 5
Documentation 4
Ethics 4
Network Forensics 4
Incident Response 3
Live System Forensics 3
Malware Detection 3
Password Cracking 3
Registry Analysis 3
78