6th European Conference - Academic Conferences

Vincent Garramone and Daniel Likarish
Note: A positive in the Match column indicates that the seeded taxonomy terms were closely or
exactly reflected in the Regis lab topic.
This rudimentary analysis demonstrated that seeding the forensics vocabulary with terms extracted
from a public literature search might be sufficient to allow a moderator to characterize the uploaded
material without intimate knowledge of its contents. See Appendix 2 for a visual representation of this
mapping in table form for the course MSIA 682, Network Forensics. It is clear, however, that the initial
vocabulary could benefit from adjustments. For example, the lab description in row 2 of Table 2
mentions, “packet capture”. While this is not in the initial vocabulary, it is closely related to “Network
Forensics” and “Packet Analysis”. Network Forensics was included in the initial list and Packet
Analysis, while identified in the literature, was not for reasons described above. To address this, it
might be appropriate to replace “Network Forensics” with “Packet Analysis” in the PRISM vocabulary.
Alternatively, defining the relationship of these terms in PRISM (synonyms, subtopics, etc.) might
create a more inclusive and useful search environment.
4.4 Honing the vocabulary
The artifact constructed through literature review is, as mentioned, a starting point in the development
of an optimized digital forensics vocabulary for PRISM. It remains to be seen if these terms resonate
with other users of the web portal or if different descriptors will be favored. Moreover, terminology
changes over time, and PRISM’s vocabularies should be able to accommodate those changes. The
authors plan to utilize new content and analytics data to identify discrepancies between the
vocabulary defined above, and actual topics and terms utilized by PRISM users. PRISM records all
searches performed on the site and generates reports listing common phrases. Searches are also
tracked by Google Analytics, which provides a more in-depth view of searches executed on the site,
as well as visitor behavior before and after the search. After a particular search is executed, Google
services can be used to determine user’s preferred or selected materials. This capability can provide
insight into how accurate and relevant the taxonomies are at any given time. As long as usage of the
site continues, these tools will help PRISM moderators to maintain relevant IA vocabularies from
which content can be described.
5. Conclusions
IA is a rapidly changing field, and maintaining relevance is a difficult task. We are attempting to keep
PRISM responsive to changes in the IA landscape. PRISM developers will continue to make
adjustments based on the needs of the user community by allowing current literature and actual
usage statistics to guide the development of organizational taxonomies. Explicitly attaching these
relevant descriptors to site content allows administrators to produce intuitive, guided search
functionalities, making it easier for users to locate the materials they need. Results using our own
materials as a test case suggest that taxonomies constructed in this way could be effective for other
users. A more rigorous evaluation will only be possible if site utilization increases and is sustained
over a significant period of time. To this end, PRISM moderators recognize, and are prepared to
absorb, the increased work required to properly organize content on the site as taxonomic complexity
increases. This will hopefully make using the site more attractive to content developers and, in turn, to
those seeking educational resources.
6. Appendix 1: Terminology usage matrix
Forensics Topics Totals
Legal Process [1] [3] [5] [6] [11] [12] 6
Log Analysis [1] [3] [5] [6] [11] [13] 6
Data Acquisition [1] [2] [3] [12] [13] 5
Data Decryption [1] [2] [5] [11] [12] 5
Deleted Data Recovery [1] [3] [6] [11] [12] 5
Email Forensics [2] [3] [5] [6] [13] 5
Hidden Data Discovery [1] [2] [3] [11] [12] 5
Steganography [1] [5] [11] [12] [13] 5
Documentation [1] [2] [5] [13] 4
Ethics [6] [11] [12] [13] 4
80