ucoProject / UCO

This repository is for development of the Unified Cyber Ontology.
Apache License 2.0
78 stars 34 forks source link

Represent sensor outputs #404

Open cyberinvestigationexpress opened 2 years ago

cyberinvestigationexpress commented 2 years ago

Background

Need to represent a wide range of outputs from smart devices, including sensors on IoT devices. Representation should include output of sensors used to monitor health and environment. This need motivates the need to use an ontology of sensors and measurements, available in the Semantic Sensor Network Ontology (https://www.w3.org/TR/vocab-ssn/). Measurement units can be represented using the QUDT (http://www.qudt.org/).

Requirements

Requirement 1

UCO must be able to represent various types of repeatable measurements, including activity (e.g., walking), state (e.g., temperature), and distance.

Requirement 2

The SOSA ontology defines a class sosa:Sensor that appears to meet UCO needs of making measurements. UCO must make an ontological joining point relating observable:Device and sosa:Sensor.

E.g. if UCO makes a class observable:Sensor that is a subclass of both observable:Device and sosa:Sensor, UCO's observable:Sensor would gain all of the expressiveness from both subclass hierarchies.

Requirement 3

The sosa:Observation class is defined as the act of estimating or calculating a value of a property of a feature of interest. UCO has a class observable:Observation that to date has not been demonstrated in any public example, and its only hint of usage is being an action:Action subclass.

Requirement: UCO must align its observable:Observation class with the sosa:Observation. If observable:Observation remains a subclass of action:Action, then either guidance, or ontology-joining subproperties, must be provided to align properties that share matching purpose, especially sosa:hasResult with action:Result, and sosa:madeBySensor with a constrained action:instrument.

Risk / Benefit analysis

Benefits

Adoption of SSN/SOSA/QUDT expands UCO's ability to represent a wider range of event log formats, including sensor data.

Risks

Competencies demonstrated

Competency 1

Represent a device being unlocked by an authenticated user. This type of event can be significant when individuals deny responsibility for device usage, such as texting while driving at the time of a fatal accident. Claim: I was not texting while driving, the screen must have been activated accidentally by the screen rubbing against the car seat fabric.

Competency Question 1.1

Did the user unlock the device with biometric authentication (fingerprint) during the time of interest?

Result 1.1

Query returns all biometric authentication unlock events during the time of interest.

Competency 2

Represent a device being unlocked by an authenticated user. This type of event can be significant when individuals deny responsibility for device usage, such as texting while driving at the time of a fatal accident. Claim: I was not texting while driving, the screen must have been activated accidentally by the screen rubbing against the car seat fabric.

Competency Question 2.1

Represent activity sensor measurements such as health tracking information.

Result 2.1

How many steps did the user take during the time of interest?

Competency 3

Represent the value of a cryptowallet as a measurement of the value of a given cryptocurrency at a specific time.

Competency Question 3.1

What was the balance amount of the cryptowallet at a specific time?

Result 3.1

Query returns the balance amount of the cryptowallet at the time of interest

Solution suggestion

Coordination