search

casework / CASE

Cyber-investigation Analysis Standard Expression (CASE) Ontology
https://caseontology.org
Apache License 2.0
67 stars 22 forks source link

endTime and startTime shoulbe be in the domain of Investigation:Authorization #40

Closed panosprotopapas closed 3 years ago

panosprotopapas commented 3 years ago

Hi all and @ajnelson-nist in particular.

Since Investigation:Authorization was wrongly mentioned in the uco-core-da.ttl file (https://github.com/ucoProject/UCO/issues/209 ), I should mention that either investigation:endTime rdfs:domain investigation:Authorization (and same for startTime), or these two properties should not be listed in blank nodes under investigation:Authorization.

ajnelson-nist commented 3 years ago

Hi, @panosprotopapas ,

Thanks for these reports. CASE and UCO prefer to process issues through Jira, so if you file future issues there in the future, that would help them get the attention they need.

As for this matter: There's a couple points. The initial practice of using rdfs:domain statements caused some problems with inference engines, which is why they were moved to an "Optional" import track of separate -da.ttl files. A proposal to move to SHACL is currently under consideration in UCO. See UCO OC-68 if you'd like to track that.

As for the blank nodes - I'm not sure what you're referring to here. If you mean line 44 and 50, then that may be a point of confusion with specifying restrictions. Those blank nodes are anonymous "Class" nodes, which only exist for the purpose of having a thing to subclass - in the case of line 44, that node has the name no marker could fit on a party nametag, "A class that uniquely exists to define a restriction on uco-core:endTime for exactly one other class to inherit". Using blank nodes here is a normal practice in OWL subclassing, and has no impact on whether an instance of Authorization should be a blank node or not.

If I wildly mis-guessed your meaning, please let me know. Otherwise, I think this Issue can be closed.

panosprotopapas commented 3 years ago

Apologies, I mistakenly read that in line 46 and 52 investigation:endTime (and startTime) was mentioned, instead of core:endTime (and startTime).