Intensional Cyberforensics

Intensional Cyberforensics Serguei A. Mokhov, Ph.D.Concordia University, 2013 This work focuses on the application of intensional logic to cyberforensic analysis and itsbenefits and difficulties are compared with the finite-state-automata approach. This workextends the use of the intensional programming paradigm to the modeling and implemen-tation of a cyberforensics investigation process with backtracing of event reconstruction, inwhich evidence is modeled by multidimensional hierarchical contexts, and proofs or disproofsof claims are undertaken in an eductive manner of evaluation. This approach is a practical,context-aware improvement over the finite state automata (FSA) approach we have seen inprevious work. As a base implementation language model, we use in this approach a new di-alect of the Lucid programming language, called Forensic Lucid, and we focus on defininghierarchical contexts based on intensional logic for the distributed evaluation of cyberforensicexpressions. We also augment the work with credibility factors surrounding digital evidenceand witness accounts, which have not been previously modeled.The Forensic Lucid programming language, used for this intensional cyberforensicanalysis, formally presented through its syntax and operational semantics. In large part, thelanguage is based on its predecessor and codecessor Lucid dialects, such as GIPL, Index-ical Lucid, Lucx, Objective Lucid, MARFL and JOOIP bound by the underlyingintensional programming paradigm.