The frequency and harmfulness of cyber-attacks are increasing every day, and with them also the amount of data that the cyber-forensics analysts need to collect and analyze. In this paper, we propose a formal analysis process that allows an analyst to filter the enormous amount of evidence collected and either identify crucial information about the attack (e.g., when it occurred, its culprit, its target) or, at the very least, perform a pre-analysis to reduce the complexity of the problem in order to then draw conclusions more swiftly and efficiently.
is the process of integrating new information with existing beliefs or knowledge @cite_7 @cite_0 @cite_14 @cite_9 @cite_5 . It is performed based on the knowledge and beliefs of the user and the beliefs of other agents announced, privately @cite_15 @cite_2 or publicly @cite_16 @cite_12 , and it uses non-monotonic reasoning. In our approach, we use as we expect only the final set, that represents our theory, to be consistent. Our procedure deals with conflicting pieces of evidence, which are analyzed by expanding or contracting the evidence set. In case of unsolved inconsistencies, our theory is empty. The procedure does not incorporate every incoming information in the evidence set, but rather the new evidence is included or not depending on the trust relations. This is different from the classical AGM belief revision @cite_8 , where the applies.
@cite_14 @cite_7 @cite_8 @cite_9 @cite_0 @cite_2 @cite_5 @cite_15 @cite_16 @cite_12
1577599253 35390552 2048333161 2028246200
In this paper, a new syntax-based approach to belief revision is presented. It is developed within a nonmonotonic framework that allows a two-steps handling of inconsistency to be adopted. First, a disciplined use of non-monotonic ingredients is made available to the knowledge engineer to prevent many inconsistencies that would occur if a standard logical interpretation and representation of beliefs were conducted. Remaining inconsistencies are considered unexpected and revised by weakening the formulas occurring in any minimally inconsistent subbase, as if they were representing exceptional cases that do not actually occur. While the computation of revised knowledge bases remains intractable in the worst case, our approach benefits from an efficient local search-based heuristic technique that empirically proves often viable, even in the context of very large prepositional applications. This paper investigates, several methods for coping with inconsistency caused by multiple source information by introducing suitable consequence relations capable of inferring non trivial conclusions from an inconsistent stratified knowledge base. Some of these methods presuppose a revision step, namely a selection of one or several consistent subsets of formulas, and then classical inference is used for inferring from these subsets. Two alternative methods that do not require any revision step are studied: inference based on arguments and a new approach called safely supported inference, where inconsistency is kept local. These two last methods look suitable when the inconsistency is due to the presence of several sources of information. The paper offers a comparative study of the various inference modes under inconsistency. Abstract During the process of knowledge acquisition from different experts it is usual that contradictions occur. Therefore strategies are needed for dealing with divergent statements and conflicts. We provide a formal framework to represent, process and combine distributed knowledge. The representation formalism is many-valued logic, which is a widely accepted method for expressing uncertainty, vagueness, contradictions and lack of information. Combining knowledge as proposed here makes use of the bilattice approach, which turns out to be very flexible and suggestive in the context of combining divergent information. We give some guidelines for choosing truth value spaces, assigning truth values and defining global operators to encode integration strategies. This paper presents a general, consistency-based framework for expressing belief change. The framework has good formal properties while being well-suited for implementation. For belief revision, informally, in revising a knowledge base K by a sentence α, we begin with α and include as much of K as consistently possible. This is done by expressing K and α in disjoint languages, asserting that the languages agree on the truth values of corresponding atoms wherever consistently possible, and then re-expressing the result in the original language of K. There may be more than one way in which the languages of K and α can be so correlated: in choice revision, one such "extension" represents the revised state; alternately (skeptical) revision consists of the intersection of all such extensions. Contraction is similarly defined although, interestingly, it is not interdefinable with revision.The framework is general and flexible. For example, one could go on and express other belief change operations such as update and erasure, and the merging of knowledge bases. Further, the framework allows the incorporation of static and dynamic integrity constraints. The approach is well-suited for implementation: belief change can be equivalently expressed in terms of a finite knowledge base; and the scope of a belief change operation can be restricted to just those propositions common to the knowledge base and sentence for change. We give a high-level algorithm implementing the procedure, and an expression of the approach in Default Logic. Lastly, we briefly discuss two implementations of the approach.