Smarter Cyber Investigations with Ontology-Backed Knowledge

Written By Chris Daywalt

CKE actively supports and extends the Cyber-investigation Analysis Standard Expression (CASE) and Unified Cyber Ontology (UCO). We are pleased to announce the release of version 1.5.0 of CASE/UCO, which enables us to express techniques, validated expertise, and knowledge-base refinements in a more consistent, interoperable way.

The centerpiece of version 1.5.0 is Technique, UCO’s first meta-class, which bridges general-to-specific actions in cyber-investigations and enables one knowledge base to refine another with subclassing. The knowledge bases that CKE develops use ontologies to codify validated expertise into structured, semantic knowledge resources.

Specific details and practical applications of this added capability are covered in this DFRWS.org blog post:

Adding Clarity to a Foundational Concept in Cyber Investigations: Technique (https://dfrws.org/adding-clarity-to-a-foundational-concept-in-cyber-investigations-technique/)

Chris Daywalt
Previous

NIST Digital Forensics Artifact Catalog: Where Digital Evidence Becomes Forensic Science