Ontology-based Intelligent Network-Forensics Investigation

We propose, in this paper, a new ontology for network forensics analysis. The proposed ontology is the first cyber forensics to integrate both network forensics domain knowledge and problem solving knowledge. As such it can be used as a knowledge-base for developing sophisticated intelligent network forensics systems to support complex chain of reasoning. We use a real life network intrusion scenario to show how our ontology can be integrated and used in intelligent network forensics systems.