An Ontology for Digital Forensics in IT Security Incidents - OPUS

Chapter 7
Implementation
This chapter presents the parts that were implemented and the diculties
that were overcome. At rst an overview of the architecture is outlined and
then some details of the implementation and used tools are presented.
7.1 Overview
The rst thing that was implemented was the ontology. It consists of the
nine les described in chapter 6. Afterwards, a converting tool was written
in Java that converts the output of several forensic tools to RDF les that t
to the ontology denitions specied in the RDFS les. Then the RDF les
were then automatically loaded to the selected database. In the end several
SPARQL queries were developed to nd evidence in the database.
7.2 RDFS
The structure of the ontology is written with RDFS. The les were generated
with SemanticWorks from section 5.2.1 and later edited by hand with a
normal text editor. A problem when creating the les was that some tools,
that can create RDF les, for example Protégé from section 5.2.2, use OWL
elements or produce too much unneeded elements. A main problem is that
only few tools support importing other les for namespaces as SematicWorks
does.
The structure of the ontology was chosen to be intuitively comprehensible.
It was started from hardware view with the hard disk, the random
access memory and the network interface card. Then the software structures
were modelled as they can be found in operating systems.
55