Skip to content

Conversation

@ajnelson-nist
Copy link
Member

This patch is written for the benefit of this scenario sketch. The additional linkage manages to reduce the lateral "sprawl" of the illustration.

Before (develop at 351afb9):

spear_phishing-prov-351afb9

After (this branch):

spear_phishing-prov-use_temporal_sorting_hints

An assumption of an alignment of PROV-O with W3C TIME is assumed, and cited in an inlined comment.

@ajnelson-nist ajnelson-nist added the enhancement New feature or request label Nov 11, 2022
@ajnelson-nist ajnelson-nist marked this pull request as ready for review November 11, 2022 01:02
@ajnelson-nist ajnelson-nist requested a review from a team as a code owner November 11, 2022 01:02
@ajnelson-nist ajnelson-nist marked this pull request as draft November 14, 2022 16:27
@ajnelson-nist ajnelson-nist added this to the 0.7.0 milestone Dec 15, 2022
@ajnelson-nist ajnelson-nist modified the milestones: 0.7.0, 0.8.0 Apr 3, 2023
@ajnelson-nist
Copy link
Member Author

ajnelson-nist commented Apr 3, 2023

I'm postponing this for after case-prov 0.7.0. That typo hid that the implementation wasn't really complete.

Some example two-node graphs should be written to show how each of the Allen algebra1 properties render with the graph flow direction already used by the PROV-O properties.

Footnotes

  1. https://www.w3.org/TR/owl-time/ , Figure 2.

No effects were observed on Make-managed files.

Signed-off-by: Alex Nelson <[email protected]>
@ajnelson-nist ajnelson-nist force-pushed the use_temporal_sorting_hints branch from a00a4d3 to cc74f04 Compare May 12, 2023 20:55
ajnelson-nist added a commit that referenced this pull request May 18, 2023
…nodes

This patch uses the inherence UUID functions from `case-utils` PR 112 to
replace the blank nodes generared with SPARQL Construct queries.  As
side effects of this migration, some bugs were fixed with generating
some associations, and inherence modeling assumptions are now specified
in code comments.

This patch also adds `prov:Start` and `prov:End` nodes to reify
`prov:Activity` (and `case-investigation:InvestigativeAction`) time
boundaries.  This will be a significant assistance in OWL-Time-based
visualization under development for `case-prov` PR 54.  Creating the
`prov:Start` and `prov:End` nodes as IRI-identified is also necessary
because of a bug observed in `rdf-toolkit`; see their Issue 52.

Since `case_prov_rdf` will now be able to generate non-blank nodes, it
has picked up two behaviors used in other projects importing
`case-utils`:

* The `--use-deterministic-uuids` flag has been added.
* The `CASE_DEMO_NONRANDOM_UUID_BASE` environment variable can now be
  used to make non-inherent deterministic UUIDs.

A follow-on patch will regenerate Make-managed files.

References:
* #54
* casework/CASE-Utilities-Python#112
* edmcouncil/rdf-toolkit#52

Signed-off-by: Alex Nelson <[email protected]>
ajnelson-nist added a commit that referenced this pull request May 18, 2023
…nodes

This patch uses the inherence UUID functions from `case-utils` PR 112 to
replace the blank nodes generated with SPARQL Construct queries.  As
side effects of this migration, some bugs were fixed with generating
some associations, and inherence modeling assumptions are now specified
in code comments.

This patch also adds `prov:Start` and `prov:End` nodes to reify
`prov:Activity` (and `case-investigation:InvestigativeAction`) time
boundaries.  This will be a significant assistance in OWL-Time-based
visualization under development for `case-prov` PR 54.  Creating the
`prov:Start` and `prov:End` nodes as IRI-identified is also necessary
because of a bug observed in `rdf-toolkit`; see their Issue 52.

Since `case_prov_rdf` will now be able to generate non-blank nodes, it
has picked up two behaviors used in other projects importing
`case-utils`:

* The `--use-deterministic-uuids` flag has been added.
* The `CASE_DEMO_NONRANDOM_UUID_BASE` environment variable can now be
  used to make non-inherent deterministic UUIDs.

A follow-on patch will regenerate Make-managed files.

References:
* #54
* casework/CASE-Utilities-Python#112
* edmcouncil/rdf-toolkit#52

Signed-off-by: Alex Nelson <[email protected]>
This merge re-applied changes done for `case_prov_dot.py`, with some
fixes applied for issues reported by `mypy`.

No effects were observed on Make-managed files.
No effects were observed on Make-managed files.

Signed-off-by: Alex Nelson <[email protected]>
This figure shows only two of the Allen interval-relations are handled
by the ordering logic now.  However, the figure does show time flowing
"downward" by seeing the before & after `*-i` intervals are above the
`*-j` intervals.

A follow-on patch will regenerate Make-managed files.

Signed-off-by: Alex Nelson <[email protected]>
This patch enables `pytest`'s doctest mode and adds a first doctest to
ensure `pytest` doesn't fail due to finding no tests to run.

Follow-on patches will add new functions with more demanding doctests.

No effects were observed on Make-managed files.

References:
* https://docs.pytest.org/en/7.1.x/how-to/doctest.html
* casework/CASE-Utilities-Python#111

Signed-off-by: Alex Nelson <[email protected]>
This function is added independently, without usage yet, to isolate test
effects.

No effects were observed on Make-managed files.

Signed-off-by: Alex Nelson <[email protected]>
This function is added independently, without usage yet, to isolate test
effects.

No effects were observed on Make-managed files.

Signed-off-by: Alex Nelson <[email protected]>
This patch adds inferential analysis to define temporal interval
boundaries and apply timeline sorting, both topologically and
lexicographically.

CASE Investigative Actions are already inferred by current
`case_prov_rdf` and `case_prov_dot` practice to be PROV Activities.
This patch takes inference further to interpret PROV Activities as
OWL-Time Proper Intervals.  Further, PROV Instantaneous Events are
inferred to be OWL-Time Instants, and their relationships to Entities
and Activities are used to establish topological order according to PROV
(English) definitions.

All OWL-Time Instants, and nodes inferred to be OWL-Time Instants, are
assigned `xsd:dateTimeStamp` values in GMT (where possible) to enable a
timeline based on lexicographic sorting.

Figures' and tests' Makefiles are updated to add new graphs to display.

A follow-on patch will regenerate Make-managed files, and track new
figures.

The last planned follow-on patch will add OWL-Time documentation to the
top README.

Signed-off-by: Alex Nelson <[email protected]>
A follow-on patch will regenerate Make-managed files.

The patch afterwards will add OWL-Time documentation to the top README.

Signed-off-by: Alex Nelson <[email protected]>
Signed-off-by: Alex Nelson <[email protected]>
@ajnelson-nist
Copy link
Member Author

The PR now contains an implementation of OWL-Time ordering. The README and recent patch notes document rationales and demonstrate new illustrations.

The SIEM scenario sketch from this PR's initial comment now looks like this:

spear_phishing-prov

The Urgent Evidence Activities graph is, to me, the most interestingly effected of the examples in this repository. Investigative Actions were loosely piled topologically due to most not having information about how they influenced one another. With timestamps now influencing vertical sort order, the provenantial links remain the same but the display is now ordered in a decent semblance of a timeline. Here is the visual diff.

@ajnelson-nist ajnelson-nist marked this pull request as ready for review June 7, 2023 04:54
The RDFLib issue referenced in the comment summarizes the type-safety
matter.

No effects were observed on Make-managed files.

Signed-off-by: Alex Nelson <[email protected]>
@kchason kchason merged commit 1fef3c9 into develop Jun 12, 2023
@ajnelson-nist ajnelson-nist deleted the use_temporal_sorting_hints branch June 12, 2023 16:02
ajnelson-nist added a commit to usnistgov/CASE-Implementation-PROV-O that referenced this pull request Jun 12, 2025
This patch revises `case_prov_dot` to make use of updates in code review
practice and upstream typing support since the script was originally
written.

The original version of `case_prov_dot` relied on many conversions of
RDFLib types to strings.  This induced some reinvention of logical
organization of concepts into IRI strings vs. quickly-instantiated and
-discarded `rdflib.URIRef` objects.  Some usage of `URIRef`s as strings
was covered by `URIRef`s being implemented in RDFLib as subclasses of
string.

As work progressed on adding TIME concept support (see PR 54), it became
unnecessarily burdensome to handle some work with managing untyped
strings under specialized consideration, versus constructing sets of
`rdflib.URIRef`s to designate nodes.  Managing potential blank nodes
also became a challenge with casts to strings.

This patch revises the base work in `case_prov_dot` to be oriented on
analyzing sets of `rdflib.term.IdentifiedNode`s (encompassing `URIRef`s
and `BNode`s).  A roadmap/codemap is also added in inline documentation
to describe sections of code behavior.

Revision of the code flow also settled some design issues that were
previously unnecessarily isolating the various chains from one another,
especially where some chains needed to be handled as a mutual union, and
another needed to be handled as an intersection, when various subsets of
the provenance graph are requested.  So this patch also adds the various
pairs of chains as demonstrations under the Urgent Evidence example.

A follow-on patch will regenerate Make-managed files.

References:
* casework#54

Signed-off-by: Alex Nelson <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants