Aurélie Bertaux

A complete formalized knowledge representation model for advanced digital forensics timeline analysis

Having a clear view of events that occurred over time is a difficult objective to achieve in digital investigations (DI). Event reconstruction, which allows investigators to understand the timeline of a crime, is one of the most important step of a DI process. This complex task requires exploration of a large amount of events due to the pervasiveness of new technologies nowadays. Any evidence produced at the end of the investigative process must also meet the requirements of the courts, such as reproducibility, verifiability, validation, etc. For this purpose, we propose a new methodology, supported by theoretical concepts, that can assist investigators through the whole process including the construction and the interpretation of the events describing the case. The proposed approach is based on a model which integrates knowledge of experts from the fields of digital forensics and software development to allow a semantically rich representation of events related to the incident. The main purpose of this model is to allow the analysis of these events in an automatic and efficient way. This paper describes the approach and then focuses on the main conceptual and formal aspects: a formal incident modelization and operators for timeline reconstruction and analysis.

An ontology-based approach for the reconstruction and analysis of digital incidents timelines

Due to the democratisation of new technologies, computer forensics investigators have to deal with volumes of data which are becoming increasingly large and heterogeneous. Indeed, in a single machine, hundred of events occur per minute, produced and logged by the operating system and various software. Therefore, the identification of evidence, and more generally, the reconstruction of past events is a tedious and time-consuming task for the investigators. Our work aims at reconstructing and analysing automatically the events related to a digital incident, while respecting legal requirements. To tackle those three main problems (volume, heterogeneity and legal requirements), we identify seven necessary criteria that an efficient reconstruction tool must meet to address these challenges. This paper introduces an approach based on a three-layered ontology, called ORD2I, to represent any digital events. ORD2I is associated with a set of operators to analyse the resulting timeline and to ensure the reproducibility of the investigation.

Using DL-Reasoner for Hierarchical Multilabel Classification applied to Economical e-News

This work is part of a global project to develop a recommender system of economic news articles. Its objectives are threefold: (i) automatically multi-classify the economic new articles, (ii) recommend the articles by comparing the profiles of the users and the multi-classification of the articles, and (iii) managing the vocabulary of the economic news domain to improve the system based on the seamlessly intervention of the documentalists. In this paper we focus on the automatic multi-classification of the articles and the respective description and justification to the documentalists. While several multi-classification solutions exist they are not automatically adaptable to the problem in hands as their description of the resulting multi-classification lacks substantial correlation with the documentalists perspective. In fact, we need to consider not only the automatic classification but also the supervision of the classification and its evolution based on the documentalists supervision of the automatic classification. Accordingly, it is necessary to provide a mechanism that bridges the gap between the automatic classification mechanisms and the documentalists thesaurus, in order to support their seamless supervision of classification and of thesaurus management. Ontologies are central to our proposal, as they are used to represent and manage the thesaurus, to describe the content of the articles, and finally to automatically multi-classify them via inference process. Also, we adopt a machine learning approach for generating a prediction model for supporting the automatic classification. This paper presents a proposal for enriching the documentalist-oriented ontology with the model prediction rules, which provides the necessary capabilities to the DL reasoner for automatic multi-classification.

Semantic HMC: A Predictive Model Using Multi-label Classification for Big Data

One of the biggest challenges in Big Data is the exploitation of Value from large volume of data. To exploit value one must focus on extracting knowledge from Big Data sources. In this paper we present a new simple but highly scalable process to automatically learn the label hierarchy from huge sets of unstructured text. We aim to extract knowledge from these sources using a Hierarchical Multi-Label Classification process called Semantic HMC. Five steps compose the Semantic HMC: Indexation, Vectorization, Hierarchization, Resolution and Realization. The first three steps construct the label hierarchy from data sources. The last two steps classify new items according to the hierarchy labels. To perform the classification without heavily relying on the user, the process is unsupervised, where no thesaurus or label examples are required. The process is implemented in a scalable and distributed platform to process Big Data.

Semantic HMC for big data analysis

Analyzing Big Data can help corporations to improve their efficiency. In this work we present a new vision to derive Value from Big Data using a Semantic Hierarchical Multi-label Classification called Semantic HMC based in a non-supervised Ontology learning process. We also propose a Semantic HMC process, using scalable Machine-Learning techniques and Rule-based reasoning.

Ontology-based approach for unsupervised and adaptive focused crawling

Information from the web is a key resource exploited in the domain of competitive intelligence. These sources represent important volumes of information to process everyday. As the amount of information available grows rapidly, this process becomes overwhelming for experts. To leverage this challenge, this paper presents a novel approach to process such sources and extract only the most valuable pieces of information. The approach is based on an unsupervised and adaptive ontology-learning process. The resulting ontology is used to enhance the performance of a focused crawler. The combination of Big Data and Semantic Web technologies allows to classify information precisely according to domain knowledge, while maintaining optimal performances. The approach and its implementation are described, and an presents the feasibility and performance of the approach.

Automatic Timeline Construction and Analysis for Computer Forensics Purposes

To determine the circumstances of an incident, investigators need to reconstruct events that occurred in the past. The large amount of data spread across the crime scene makes this task very tedious and complex. In particular, the analysis of the reconstructed timeline, due to the huge quantity of events that occurred on a digital system, is almost impossible and leads to cognitive overload. Therefore, it becomes more and more necessary to develop automatic tools to help or even replace investigators in some parts of the investigation. This paper introduces a multi-layered architecture designed to assist the investigative team in the extraction of information left in the crime scene, the construction of the timeline representing the incident and the interpretation of this latter.

Semantic-Based Recommender System with Human Feeling Relevance Measure

This work presents a recommender system of economic news articles. Its objectives are threefold: (i) managing the vocabulary of the economic news domain to improve the system based on the seamlessly intervention of the documentalist (ii) automatically multi-classify the economic new articles and users profiles based on the domain vocabulary, and (iii) recommend the articles by comparing the multi-classification of the articles and profiles of the users. While several solutions exist to recommend news, multi-classify document and compare representations of items and profiles. They are not automatically adaptable to provide a mutual answer to previous points. Even more, existing approaches lacks substantial correlation with the human and in particular with the documentalist perspective.

Intelligent Cloud Storage Management for Layered Tiers

Today, the cloud offers a large array of possibilities for storage, with this flexibility comes also complexity. This complexity stems from the variety of storage mediums, such as, blob storage or NoSQL tables, and also from the different cost tiers within these systems. A strategic thinking to navigate this complex cloud storage landscape is important, not only for cost saving but also for prioritizing information, this prioritization has wider implications in other domains such as the Big Data realm, especially for governance and efficiency. In this paper we propose a strategy centered around probabilistic graphical model (PGM), this heuristic oriented management and organizational strategy allows more tractability and efficiency, we also illustrate this approach with a case study applied to the insurance field.

Scenario analysis, from BigData to black swan

Abstract Scenario analysis is a set of methodologies and techniques with the goal of generating strategic insight for decision and policy makers. Our aim for this paper is to overview the scenario analysis field in relation to the relatively new paradigms of BigData. The purpose of such an effort is to clarify where scenario analysis stands today relative to the myriad of data analytics approaches. In an era where the hype about BigData is growing at a breakneck speed, what role scenario analysis can still play? And what kind of synergy it can use to leverage the advances made in other forecasting methods? This paper tries to provide some elements for an answer.