Advancing coordinated cyber-investigations and tool interoperability using a community developed specification language

Published

September 1, 2017

Author(s)

Eoghan Casey, Sean Barnum, Ryan Griffith, Jonathan Snyder, Harm van Beek, Alexander J. Nelson

Abstract

Any investigation can have a digital dimension, often involving information from multiple data sources, organizations and jurisdictions. Existing approaches to representing and exchanging cyber-investigation information are inadequate, particularly when combining data sources from numerous organizations or dealing with large amounts of data from various tools. To perform digital investigations effectively, there is a pressing need to harmonize how information relevant to cyber-investigations is represented and exchanged. This paper addresses this need for information exchange and tool interoperability with an open community-developed specification language called Cyber-investigation Analysis Standard Expression (CASE). To further promote a common structure, CASE aligns with and extends the Unified Cyber Ontology (UCO) construct, which provides a format for representing information in all cyber domains. This ontology abstracts objects and concepts that are not CASE-specific, so that they can be used across other cyber disciplines that may extend UCO. This work is a rational evolution of the Digital Forensic Analysis eXpression (DFAX) for representing digital forensic information and provenance. CASE is more flexible than DFAX and can be utilized in any context, including criminal, corporate and intelligence. CASE also builds on the Hansken data model developed and implemented by the Netherlands Forensic Institute (NFI). CASE enables the fusion of information from different organizations, data sources, and forensic tools to foster more comprehensive and cohesive analysis. This paper includes illustrative examples of how CASE can be implemented and used to capture information in a structured form to advance sharing, interoperability and analysis in cyber-investigations. In addition to capturing technical details and relationships between objects, CASE provides structure for representing and sharing details about how cyber-information was handled, transferred, processed

Citation

Digital Investigation

Volume

22

Pub Type

Journals

Download Paper

https://doi.org/10.1016/j.diin.2017.08.002

Local Download

Keywords

cyber-investigations, digital forensics, specification language, standard representation, Unified Cyber Ontology, information sharing, digital evidence exchange, evidence provenance, DFAX, DFXML, CybOX

Citation

Casey, E. , Barnum, S. , Griffith, R. , Snyder, J. , van Beek, H. and Nelson, A. (2017), Advancing coordinated cyber-investigations and tool interoperability using a community developed specification language, Digital Investigation, [online], https://doi.org/10.1016/j.diin.2017.08.002, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=924126 (Accessed September 1, 2025)