9 research outputs found
Formally Specifying and Proving Operational Aspects of Forensic Lucid in Isabelle
A Forensic Lucid intensional programming language has been proposed for
intensional cyberforensic analysis. In large part, the language is based on
various predecessor and codecessor Lucid dialects bound by the higher-order
intensional logic (HOIL) that is behind them. This work formally specifies the
operational aspects of the Forensic Lucid language and compiles a theory of its
constructs using Isabelle, a proof assistant system.Comment: 23 pages, 3 listings, 3 figures, 1 table, 1 Appendix with theorems,
pp. 76--98. TPHOLs 2008 Emerging Trends Proceedings, August 18-21, Montreal,
Canada. Editors: Otmane Ait Mohamed and Cesar Munoz and Sofiene Tahar. The
individual paper's PDF is at
http://users.encs.concordia.ca/~tphols08/TPHOLs2008/ET/76-98.pd
Towards a Self-Forensics Property in the ASSL Toolset
This preliminary conceptual work discusses a notion of self-forensics as an autonomic property to augment the Autonomic System Specification Language (ASSL) framework of formal specification tools for autonomic systems. The core of the proposed methodology leverages existing designs, theoretical results, and implementing systems to enable rapid completion of and validation of the experiments and their the results initiated in this work. Specifically, we leverage the ASSL toolkit to add the self-forensics autonomic property (SFAP) to enable generation of the Java-based Object-Oriented Intensional Programming (JOOIP) language code laced with traces of Forensic Lucid to encode contextual forensic evidence and other expressions
Reasoning About a Simulated Printer Case Investigation with Forensic Lucid
In this work we model the ACME (a fictitious company name) "printer case
incident" and make its specification in Forensic Lucid, a Lucid- and
intensional-logic-based programming language for cyberforensic analysis and
event reconstruction specification. The printer case involves a dispute between
two parties that was previously solved using the finite-state automata (FSA)
approach, and is now re-done in a more usable way in Forensic Lucid. Our
simulation is based on the said case modeling by encoding concepts like
evidence and the related witness accounts as an evidential statement context in
a Forensic Lucid program, which is an input to the transition function that
models the possible deductions in the case. We then invoke the transition
function (actually its reverse) with the evidential statement context to see if
the evidence we encoded agrees with one's claims and then attempt to
reconstruct the sequence of events that may explain the claim or disprove it.Comment: 18 pages, 3 figures, 7 listings, TOC, index; this article closely
relates to arXiv:0906.0049 and arXiv:0904.3789 but to remain stand-alone
repeats some of the background and introductory content; abstract presented
at HSC'09 and the full updated paper at ICDF2C'11. This is an updated/edited
version after ICDF2C proceedings with more references and correction
Using the General Intensional Programming System (GIPSY) for Evaluation of Higher-Order Intensional Logic (HOIL) Expressions
The General Intensional Programming System (GIPSY) has been built around the
Lucid family of intensional programming languages that rely on the higher-order
intensional logic (HOIL) to provide context-oriented multidimensional reasoning
of intensional expressions. HOIL combines functional programming with various
intensional logics to allow explicit context expressions to be evaluated as
first-class values that can be passed as parameters to functions and return as
results with an appropriate set of operators defined on contexts. GIPSY's
frameworks are implemented in Java as a collection of replaceable components
for the compilers of various Lucid dialects and the demand-driven eductive
evaluation engine that can run distributively. GIPSY provides support for
hybrid programming models that couple intensional and imperative languages for
a variety of needs. Explicit context expressions limit the scope of evaluation
of math expressions (effectively a Lucid program is a mathematics or physics
expression constrained by the context) in tensor physics, regular math in
multiple dimensions, etc., and for cyberforensic reasoning as one of the
use-cases of interest. Thus, GIPSY is a support testbed for HOIL-based
languages some of which enable such reasoning, as in formal cyberforensic case
analysis with event reconstruction. In this paper we discuss the GIPSY
architecture, its evaluation engine and example use-cases.Comment: 14 pages; 8 figure
Toward Formal Reasoning in Cyberforensic Case Investigation with Forensic Lucid
This work focuses on the application of the intensional logic to cyberforensic analysis and its benefits and difficulties are compared with the finite-state automata approach. This work extends the use of the scientific intensional programming paradigm onto modeling and implementation of a cyberforensics investigation process with the backtrace of event reconstruction, modeling the evidence as multidimensional hierarchical contexts, and proving or disproving the claims with it in the intensional manner of evaluation. This is a practical, context-aware improvement over the finite state automata (FSA) approach we have seen in the related works. As a base implementation language model we use in this approach is a new dialect of the Lucid programming language, that we call Forensic Lucid and we define hierarchical contexts based on the intensional logic for the evaluation of cyberforensic expressions. We also augment the work with the credibility factors surrounding digital evidence and witness accounts, which have not been previously modeled. The Forensic Lucid programming language proposed for this intensional cyberforensic analysis, includes the syntax and operational semantics. In large part, the language is based on its predecessor and codecessor Lucid dialects, such as GIPL, Indexical Lucid, Lucx, Objective Lucid, and JOOIP bound by the intensional (temporal) logic that is behind them. The distributed Java-based eduction (demand-driven) evaluation engine of the General Intensional Programming System (GIPSY) is the run-time system to cope with the scalability issues of the large evidential knowledge base. We then propose a near future work with the dataflow graph visualization and a toolset for compilation and execution of the Forensic Lucid programs. We show some examples by re-writing them in Forensic Lucid. We then postulate other investigations applications beyond the digital forensics domain
Intensional Cyberforensics
This work focuses on the application of intensional logic to cyberforensic
analysis and its benefits and difficulties are compared with the
finite-state-automata approach. This work extends the use of the intensional
programming paradigm to the modeling and implementation of a cyberforensics
investigation process with backtracing of event reconstruction, in which
evidence is modeled by multidimensional hierarchical contexts, and proofs or
disproofs of claims are undertaken in an eductive manner of evaluation. This
approach is a practical, context-aware improvement over the finite state
automata (FSA) approach we have seen in previous work. As a base implementation
language model, we use in this approach a new dialect of the Lucid programming
language, called Forensic Lucid, and we focus on defining hierarchical contexts
based on intensional logic for the distributed evaluation of cyberforensic
expressions. We also augment the work with credibility factors surrounding
digital evidence and witness accounts, which have not been previously modeled.
The Forensic Lucid programming language, used for this intensional
cyberforensic analysis, formally presented through its syntax and operational
semantics. In large part, the language is based on its predecessor and
codecessor Lucid dialects, such as GIPL, Indexical Lucid, Lucx, Objective
Lucid, and JOOIP bound by the underlying intensional programming paradigm.Comment: 412 pages, 94 figures, 18 tables, 19 algorithms and listings; PhD
thesis; v2 corrects some typos and refs; also available on Spectrum at
http://spectrum.library.concordia.ca/977460