casework / CASE

Cyber-investigation Analysis Standard Expression (CASE) Ontology
https://caseontology.org
Apache License 2.0
65 stars 22 forks source link

Investigations should be specializations of Event #138

Open ajnelson-nist opened 7 months ago

ajnelson-nist commented 7 months ago

Background

UCO Issue 541 introduced general uco-core:Events.

CASE's Investigation class has, to date, been encoded as a uco-core:ContextualCompilation. (This class design predates my own involvement in CASE, so I can only guess to motives for this.)

ContextualCompilation provides a "Set" construct that lets arbitrary items be grouped together, using uco-core:object.

Requirements

Requirement 1

Investigation should exercise Event.

Requirement 2

Investigations must maintain the ability to link InvestigativeActions, ProvenanceRecords, and other CASE classes that tie to investigative contexts.

This proposal does not impose a requirement they need to be linked with the same predicate as today, but other developments in UCO might mean they would no longer be linked the same way.

Risk / Benefit analysis

Benefits

Risks

Competencies demonstrated

(Competencies deferred for discussion.)

Competency 1

Competency Question 1.1

Result 1.1

Competency Question 1.2

Result 1.2

Solution suggestion

For CASE 1.x.0, BEFORE merging of UCO Issue 544, add to Investigation's definition:

investigation:Investigation
    rdfs:subClassOf uco-core:Event ;
    .

AFTER merging of Issue 544 (assuming UCO Ontology Committee votes so), subtract this subclassing:

investigation:Investigation
    rdfs:subClassOf uco-core:ContextualCompilation ;
    .

uco-core:object can retain its usage on Investigation, but I suggest this is thanks to a lack of specification, which does not feel future-proofed. This SHACL shape can be added to maintain current data behavior, but Issue 544 could also obviate the property:

investigation:Investigation
    sh:property [
        a sh:PropertyShape ;
        sh:class uco-core:UcoObject ;
        sh:nodeKind sh:IRI ;
        sh:path uco-core:object ;
    ] ;
    .

Note: That shape also omits the minimum-1 constraint on uco-core:object. I am not sure if that constraint was purposefully intended to fail SHACL validation on an investigation containing no objects, or if it was an overzealous translation of an owl:someValuesFrom restriction.

By the time of UCO 2.0.0's release and CASE 2.0.0's release, I think Investigation should no longer be a ContextualCompilation.


Coordination