The Use of Artificial Intelligence in Digital Forensics and Incident Response in a Constrained Environment

Digital investigators often have a hard time spotting evidence in digital information. It has become hard to determine which source of proof relates to a specific investigation. A growing concern is that the various processes, technology, and specific procedures used in the digital investigation are not keeping up with criminal developments. Therefore, criminals are taking advantage of these weaknesses to commit further crimes. In digital forensics investigations, artificial intelligence (AI) is invaluable in identifying crime. Providing objective data and conducting an assessment is the goal of digital forensics and digital investigation, which will assist in developing a plausible theory that can be presented as evidence in court. This research paper aims at developing a multiagent framework for digital investigations using specific intelligent software agents (ISAs). The agents communicate to address particular tasks jointly and keep the same objectives in mind during each task. The rules and knowledge contained within each agent are dependent on the investigation type. A criminal investigation is classified quickly and efficiently using the case-based reasoning (CBR) technique. The proposed framework development is implemented using the Java Agent Development Framework, Eclipse, Postgres repository, and a rule engine for agent reasoning. The proposed framework was tested using the Lone Wolf image files and datasets. Experiments were conducted using various sets of ISAs and VMs. There was a significant reduction in the time taken for the Hash Set Agent to execute. As a result of loading the agents, 5% of the time was lost, as the File Path Agent prescribed deleting 1,510, while the Timeline Agent found multiple executable files. In comparison, the integrity check carried out on the Lone Wolf image file using a digital forensic tool kit took approximately 48 minutes (2,880 ms), whereas the MADIK framework accomplished this in 16 minutes (960 ms). The framework is integrated with Python, allowing for further integration of other digital forensic tools, such as AccessData Forensic Toolkit (FTK), Wireshark, Volatility, and Scapy.

An Ontology for Investment in Chinese Steel Company

In the era of big data, public investors are faced with more complicated information related to investment decisions than ever before. To survive in the fierce competition, it has become increasingly urgent for investors to combine multi-source knowledge and evaluate the companies’ true value efficiently. For this, a rule-based ontology reasoning method is proposed to support steel companies’ value assessment. Considering the delay in financial disclosure and based on cost-benefit analysis, this paper introduces the supply chain enterprises financial analysis and constructs the ontology model used to value the value of steel company. In addition, domain knowledge is formally expressed with the help of Web Ontology Language (OWL) language and SWRL (Semantic Web Rule Language) rules. Finally, a case study on a steel company in China proved the effectiveness of the method we proposed.

Inferential Reasoning for Heterogeneous Multi-Agent Mission

We describe issues bedeviling the coordination of heterogeneous (different sensors carrying agents) multi-agent missions such as belief conflict, situation reasoning, etc. We applied Bayesian and agents' presumptions inferential reasoning to solve the outlined issues with the heterogeneous multi-agent belief variation and situational-base reasoning. Bayesian Belief Network (BBN) was used in modeling the agents' belief conflict due to sensor variations. Simulation experiments were designed, and cases from agents’ missions were used in training the BBN using gradient descent and expectation-maximization algorithms. The output network is a well-trained BBN for making inferences for both agents and human experts. We claim that the Bayesian learning algorithm prediction capacity improves by the number of training data and argue that it enhances multi-agents robustness and solve agents’ sensor conflicts.

The Desire to Know: Arnold’s Contribution to a Psychological Conceptualization of Academic Motivation

Arnold’s redefinition of human motives can sustain a psychology of education which emphasizes the beauty of knowledge and the exercise of intellectual functions. Thus, education instead of focusing on skills and learning by doing would be centered on ‘the widest reaches of the human spirit’. One way to attain it is by developing children’s inherent interest. Arnold takes into account the fact that the desire to know is the inherent interest which leads students to explore and learn. She also emphasizes the need of exercising human functions as thinking, judging and reasoning. According to Arnold, the influence of psychological theories of motivation in education has derived in considering that all learning and school tasks should derive from children’s needs and impulses. The desire to know and the curiosity have not been considered as basic and active as any instinctive drive or basic need, so there has been an attempt to justify and understand how biological drives guide student’s learning. However, understanding motives and motivation not as a drive, an instinct or an impulse guided by our basic needs, but as a want that leads to action can help to understand, from a psychological perspective, how teachers can motivate students to learn, strengthening their desire and interest to reason and discover the whole new world of knowledge.

Developing Proof Demonstration Skills in Teaching Mathematics in the Secondary School

The article describes the theoretical concept of teaching secondary school students proof demonstration skills in mathematics. It describes in detail different levels of mastery of the concept of proof-which correspond to Piaget’s idea of there being three distinct and progressively more complex stages in the development of human reflection. Lessons for each level contain a specific combination of the visual-figurative components and deductive reasoning. It is vital at the transition point between levels to carefully and rigorously recalibrate teaching to reflect the development of more complex reflective understanding. This can apply even within the same age range, since students will develop at different speeds and to different potential. The authors argue that this requires an aware and adaptive approach to lessons to reflect this complexity and variation. The authors also contend that effective teaching which enables students to properly understand the implementation of proof arguments must develop specific competences. These are: understanding of the importance of completeness and generality in making a valid argument; being task focused; having an internalised locus of control and being flexible in approach and evaluation. These criteria must be correlated with the systematic application of corresponding methodologies which are best likely to achieve success. The particular pedagogical decisions which are made to deliver this objective are illustrated by concrete examples from the existing secondary school mathematics courses. The proposed theoretical concept formed the basis of the development of methodological materials which have been tested in 47 secondary schools.

Role-Governed Categorization and Category Learning as a Result from Structural Alignment: The RoleMap Model

The paper presents a symbolic model for category learning and categorization (called RoleMap). Unlike the other models which implement learning in a separate working mode, role-governed category learning and categorization emerge in RoleMap while it does its usual reasoning. The model is based on several basic mechanisms known as reflecting the sub-processes of analogy-making. It steps on the assumption that in their everyday life people constantly compare what they experience and what they know. Various commonalities between the incoming information (current experience) and the stored one (long-term memory) emerge from those comparisons. Some of those commonalities are considered to be highly important, and they are transformed into concepts for further use. This process denotes the category learning. When there is missing knowledge in the incoming information (i.e. the perceived object is still not recognized), the model makes anticipations about what is missing, based on the similar episodes from its long-term memory. Various such anticipations may emerge for different reasons. However, with time only one of them wins and is transformed into a category member. This process denotes the act of categorization.

Extending BDI Multiagent Systems with Agent Norms

Open Multiagent Systems (MASs) are societies in which heterogeneous and independently designed entities (agents) work towards similar, or different ends. Software agents are autonomous and the diversity of interests among different members living in the same society is a fact. In order to deal with this autonomy, these open systems use mechanisms of social control (norms) to ensure a desirable social order. This paper considers the following types of norms: (i) obligation — agents must accomplish a specific outcome; (ii) permission — agents may act in a particular way, and (iii) prohibition — agents must not act in a specific way. All of these characteristics mean to encourage the fulfillment of norms through rewards and to discourage norm violation by pointing out the punishments. Once the software agent decides that its priority is the satisfaction of its own desires and goals, each agent must evaluate the effects associated to the fulfillment of one or more norms before choosing which one should be fulfilled. The same applies when agents decide to violate a norm. This paper also introduces a framework for the development of MASs that provide support mechanisms to the agent’s decision-making, using norm-based reasoning. The applicability and validation of this approach is demonstrated applying a traffic intersection scenario.

Mobile Augmented Reality for Collaboration in Operation

Mobile augmented reality (MAR) tracking targets from the surroundings and aids operators for interactive data and procedures visualization, potential equipment and system understandably. Operators remotely communicate and coordinate with each other for the continuous tasks, information and data exchange between control room and work-site. In the routine work, distributed control system (DCS) monitoring and work-site manipulation require operators interact in real-time manners. The critical question is the improvement of user experience in cooperative works through applying Augmented Reality in the traditional industrial field. The purpose of this exploratory study is to find the cognitive model for the multiple task performance by MAR. In particular, the focus will be on the comparison between different tasks and environment factors which influence information processing. Three experiments use interface and interaction design, the content of start-up, maintenance and stop embedded in the mobile application. With the evaluation criteria of time demands and human errors, and analysis of the mental process and the behavior action during the multiple tasks, heuristic evaluation was used to find the operators performance with different situation factors, and record the information processing in recognition, interpretation, judgment and reasoning. The research will find the functional properties of MAR and constrain the development of the cognitive model. Conclusions can be drawn that suggest MAR is easy to use and useful for operators in the remote collaborative works.

A Reasoning Method of Cyber-Attack Attribution Based on Threat Intelligence

With the increasing complexity of cyberspace security, the cyber-attack attribution has become an important challenge of the security protection systems. The difficult points of cyber-attack attribution were forced on the problems of huge data handling and key data missing. According to this situation, this paper presented a reasoning method of cyber-attack attribution based on threat intelligence. The method utilizes the intrusion kill chain model and Bayesian network to build attack chain and evidence chain of cyber-attack on threat intelligence platform through data calculation, analysis and reasoning. Then, we used a number of cyber-attack events which we have observed and analyzed to test the reasoning method and demo system, the result of testing indicates that the reasoning method can provide certain help in cyber-attack attribution.

Ontologies for Social Media Digital Evidence

Online Social Networks (OSNs) are nowadays being used widely and intensively for crime investigation and prevention activities. As they provide a lot of information they are used by the law enforcement and intelligence. An extensive review on existing solutions and models for collecting intelligence from this source of information and making use of it for solving crimes has been presented in this article. The main focus is on smart solutions and models where ontologies have been used as the main approach for representing criminal domain knowledge. A framework for a prototype ontology named SC-Ont will be described. This defines terms of the criminal domain ontology and the relations between them. The terms and the relations are extracted during both this review and the discussions carried out with domain experts. The development of SC-Ont is still ongoing work, where in this paper, we report mainly on the motivation for using smart ontology models and the possible benefits of using them for solving crimes.

Modeling the Impact of Controls on Information System Risks

Information system risk management helps to reduce or eliminate risk by implementing appropriate controls. In this paper, we propose a quantification model of controls impact on information system risks by automatizing the residual criticality estimation step of FMECA which is based on a inductive reasoning. For this, we defined three equations based on type and maturity of controls. For testing, the values obtained with the model were compared to estimated values given by interlocutors during different working sessions and the result is satisfactory. This model allows an optimal assessment of controls maturity and facilitates risk analysis of information system.

Ontology for Semantic Enrichment of Radio Frequency Identification Systems

Radio Frequency Identification (RFID) has become a key technology in the emerging concept of Internet of Things (IoT). Naturally, business applications would require the deployment of various RFID systems developed by different vendors that use different data formats and structures. This heterogeneity poses a challenge in developing real-life IoT systems with RFID, as integration is becoming very complex and challenging. Semantic integration is a key approach to deal with this challenge. To do so, ontology for RFID systems need to be developed in order to annotated semantically RFID systems, and hence, facilitate their integration. Accordingly, in this paper, we propose ontology for RFID systems. The proposed ontology can be used to semantically enrich RFID systems, and hence, improve their usage and reasoning.

Building a Hierarchical, Granular Knowledge Cube

A knowledge base stores facts and rules about the world that applications can use for the purpose of reasoning. By applying the concept of granular computing to a knowledge base, several advantages emerge. These can be harnessed by applications to improve their capabilities and performance. In this paper, the concept behind such a construct, called a granular knowledge cube, is defined, and its intended use as an instrument that manages to cope with different data types and detect knowledge domains is elaborated. Furthermore, the underlying architecture, consisting of the three layers of the storing, representing, and structuring of knowledge, is described. Finally, benefits as well as challenges of deploying it are listed alongside application types that could profit from having such an enhanced knowledge base.

Temporal Case-Based Reasoning System for Automatic Parking Complex

In this paper the problem of the application of temporal reasoning and case-based reasoning in intelligent decision support systems is considered. The method of case-based reasoning with temporal dependences for the solution of problems of real-time diagnostics and forecasting in intelligent decision support systems is described. This paper demonstrates how the temporal case-based reasoning system can be used in intelligent decision support systems of the car access control. This work was supported by RFBR.

Determining a Suitable Maintenance Measure for Gentelligent Components Using Case-Based Reasoning

Components with sensory properties such as gentelligent components developed at the Collaborative Research Centre 653 offer a new angle in terms of the full utilization of the remaining service life as well as preventive maintenance. The developed methodology of component status driven maintenance analyzes the stress data obtained during the component's useful life and on the basis of this knowledge assesses the type of maintenance required in this case. The procedure is derived from the case-based reasoning method and will be explained in detail. The method's functionality is demonstrated with real-life data obtained during test runs of a racing car prototype.

Defuzzification of Periodic Membership Function on Circular Coordinates

This paper presents circular polar coordinates transformation of periodic fuzzy membership function. The purpose is identification of domain of periodic membership functions in consequent part of IF-THEN rules. Proposed methods in this paper remove complicatedness concerning domain of periodic membership function from defuzzification in fuzzy approximate reasoning. Defuzzification on circular polar coordinates is also proposed.

REDUCER – An Architectural Design Pattern for Reducing Large and Noisy Data Sets

To relieve the burden of reasoning on a point to point basis, in many domains there is a need to reduce large and noisy data sets into trends for qualitative reasoning. In this paper we propose and describe a new architectural design pattern called REDUCER for reducing large and noisy data sets that can be tailored for particular situations. REDUCER consists of 2 consecutive processes: Filter which takes the original data and removes outliers, inconsistencies or noise; and Compression which takes the filtered data and derives trends in the data. In this seminal article we also show how REDUCER has successfully been applied to 3 different case studies.

The Possibility Distribution for the Controlled Bloodstream Concentrations of Any Physiologically Active Substance

In many ways, biomedical analysis is analogous to possibilistic reasoning. In spite of that, there are hardly any applications of possibility theory in biology or medicine. The aim of this work is to demonstrate the use of possibility theory in an epidemiological study. In the paper, we build the possibility distribution for the controlled bloodstream concentrations of any physiologically active substance through few approximate considerations. This possibility distribution is tested later against the empirical histograms obtained from the panel study of the eight different physiologically active substances in 417 individuals.

Moral Reasoning and Behaviour in Adulthood

This study aimed at assessing whether and to what extent moral judgment and behaviour were: 1. situation-dependent; 2. selectively dependent on cognitive and affective components; 3. influenced by gender and age; 4. reciprocally congruent. In order to achieve these aims, four different types of moral dilemmas were construed and five types of thinking were presented for each of them – representing five possible ways to evaluate the situation. The judgment criteria included selfishness, altruism, sense of justice, and the conflict between selfishness and the two moral issues. The participants were 250 unpaid volunteers (50% male; 50% female) belonging to two age-groups: young people and adults. The study entailed a 2 (gender) x 2 (age-group) x 5 (type of thinking) x 4 (situation) mixed design: the first two variables were betweensubjects, the others were within-subjects. Results have shown that: 1. moral judgment and behaviour are at least partially affected by the type of situations and by interpersonal variables such as gender and age; 2. moral reasoning depends in a similar manner on cognitive and affective factors; 3. there is not a gender polarity between the ethic of justice and the ethic of cure/ altruism; 4. moral reasoning and behavior are perceived as reciprocally congruent even though their congruence decreases with a more objective assessment. Such results were discussed in the light of contrasting theories on morality.

Integrated Reasoning Approach for Car Faulty Diagnosis

This paper presents an integrated case based and rule based reasoning method for car faulty diagnosis. The reasoning method is done through extracting the past cases from the Proton Service Center while comparing with the preset rules to deduce a diagnosis/solution to a car service case. New cases will be stored to the knowledge base. The test cases examples illustrate the effectiveness of the proposed integrated reasoning. It has proven accuracy of similar reasoning if carried out by a service advisor from the service center.