The frequency and harmfulness of cyber-attacks are increasing every day, and with them also the amount of data that the cyber-forensics analysts need to collect and analyze. In this paper, we propose a formal analysis process that allows an analyst to filter the enormous amount of evidence collected and either identify crucial information about the attack (e.g., when it occurred, its culprit, its target) or, at the very least, perform a pre-analysis to reduce the complexity of the problem in order to then draw conclusions more swiftly and efficiently.
In this paper, we present a semantical approach to multi-agent belief revision and belief update. For this, we introduce relational structures called conditional doxastic models (CDM's, for short). We show this setting to be equivalent to an epistemic version of the classical AGM Belief Revision theory. We present a logic of conditional beliefs that is complete w.r.t. CDM's. Moving then to belief updates (sometimes called ''dynamic'' belief revision) induced by epistemic actions, we consider two particular cases: public announcements and private announcements to subgroups of agents. We show how the standard semantics for these types of updates can be appropriately modified in order to apply it to CDM's, thus incorporating belief revision into our notion of update. We provide a complete axiomatization of the corresponding dynamic doxastic logics. As an application, we solve a ''cheating version'' of the Muddy Children Puzzle. We show how belief revision can be treated systematically in the format of dynamicepistemic logic, when operators of conditional belief are added. The core engine consists of definable update rules for changing plausibility relations between worlds, which have been proposed independently in the dynamic-epistemic literature on preference change. Our analysis yields two new types of modal result. First, we obtain complete logics for concrete mechanisms of belief revision, based on compositional reduction axioms. Next, we show how various abstract postulates for belief revision can be analyzed by standard modal frame correspondences for model-changing operations. This paper extends earlier work by its authors on formal aspects of the processes of contracting a theory to eliminate a proposition and revising a theory to introduce a proposition. In the course of the earlier work, Gardenfors developed general postulates of a more or less equational nature for such processes, whilst Alchourron and Makinson studied the particular case of contraction functions that are maximal, in the sense of yielding a maximal subset of the theory (or alternatively, of one of its axiomatic bases), that fails to imply the proposition being eliminated. In the present paper, the authors study a broader class, including contraction functions that may be less than maximal. Specifically, they investigate “partial meet contraction functions”, which are defined to yield the intersection of some nonempty family of maximal subsets of the theory that fail to imply the proposition being eliminated. Basic properties of these functions are established: it is shown in particular that they satisfy the Gardenfors postulates, and moreover that they are sufficiently general to provide a representation theorem for those postulates. Some special classes of partial meet contraction functions, notably those that are “relational” and “transitively relational”, are studied in detail, and their connections with certain “supplementary postulates” of Gardenfors investigated, with a further representation theorem established.  Dynamic Epistemic Logic is the logic of knowledge change. This is not about one logical system, but about a whole family of logics that allows us to specify static and dynamic aspects of multi-agent systems. This book provides various logics to support such formal specifications, including proof systems. Concrete examples and epistemic puzzles enliven the exposition. The book also contains exercises including answers and is eminently suitable for graduate courses in logic. A sweeping chapter-wise outline of the content of this book is the following. The chapter 'Introduction' informs the reader about the history of the subject, and its relation to other disciplines. 'Epistemic Logic' is an overview of multi-agent epistemic logic - the logic of knowledge - including modal operators for groups, such as general and common knowledge. 'Belief Revision' is an overview on how to model belief revision, both in the 'traditional' way and in a dynamic epistemic setting. 'Public Announcements' is a detailed and comprehensive introduction into the logic of knowledge to which dynamic operators for truthful public announcement are added. Many interesting applications are also presented in this chapter: a form of cryptography for ideal agents also known as 'the russian cards problem', the sum-and-product riddle, etc. 'Epistemic Actions' introduces a generalization of public announcement logic to more complex epistemic actions. A different perspective on that matter is independently presented in 'Action Models'. 'Completeness' gives details on the completeness proof for the logics introduced in 'Epistemic Logic', 'Public Announcements', and 'Action Models'. 'Expressivity' discusses various results on the expressive power of the logics presented. We present a modal logic of belief and announcements in a multi-agent setting. This logic allows to express not only that Ψ holds after the announcement of Φ as in standard public announcement logic (PAL), but also that the announcement of Φ occurs. We use the logic to provide a formal analysis of several concepts that are relevant for multi-agent systems (MAS) theory and applications: the notions of communicative action (an agent informs another agent about something) and communicative intention (an agent has the intention to inform another agent about something), and the notion of information source.  Abstract Two currently active strands of research on logics for multi-agent systems are dynamic epistemic logic, focusing on the epistemic consequences of actions, and logics of coalitional ability, focusing on what coalitions of agents can achieve by cooperating strategically. In this paper we bridge these topics by considering the question: “what can a coalition achieve by making public announcements?”. We propose an extension of public announcement logic with constructs of the form 〈 G 〉 ϕ , where G is a group of agents, with the intuitive meaning that G can jointly execute a publicly observable action such that ϕ will be true afterwards. Actions here are taken to be truthful public announcements, but turn out also to include sequences of such joint actions as well as protocols with alternating actions by different agents, in response to the actions of others. We also study in detail the difference between ‘knowing how’ (knowing de re) and ‘knowing that’ (knowing de dicto) in our framework: both can elegantly be expressed in the single-agent case. We present several meta-logical properties of this Group Announcement Logic, including a sound and complete axiomatization, expressivity and the complexity of model checking. Multi-modal versions of propositional logics S5 or S4—commonly accepted as logics of knowledge—are capable of describing static states of knowledge but they do not reflect how the knowledge changes after communications among agents. In the present paper (part of broader research on logics of knowledge and communications) we define extensions of the logic S5 which can deal with public communications. The logics have natural semantics. We prove some completeness, decidability and interpretability results and formulate a general method that solves certain kind of problems involving public communications—among them well known puzzles of Muddy Children and Mr. Sum & Mr. Product. As the paper gives a formal logical treatment of the operation of restriction of the universe of a Kripke model, it contributes also to investigations of semantics for modal logics. Public announcement logic is an extension of multi-agent epistemic logic with dynamic operators to model the informational consequences of announcements to the entire group of agents. We propose a labelled tableau-calculus for this logic. We also present an extension of the calculus for a logic of arbitrary announcements.