This example was developed for the 2017 Digital Investigation paper to show how CASE can represent multiple related criminal investigations. This example refers to a trilogy of Greek tragedies written by Aeschylus in and collectively called The Oresteia. For illustrative purposes, the characters of these ancient stories are given access to modern technology.
These are the multiple investigations illustrated in this example (with SPARQL source src/query-investgations.sparql):
| ?nInvestigation | ?lName | ?lDescription | |
|---|---|---|---|
| 0 | http://example.org/kb/investigation-4586742a-710a-454f-bcb8-b60e230ec1b2 | Crime A | In Mycenae, Atreus killed two sons of Thyestes, cooked them (except for their hands and heads), fed them to Thyestes, and then taunted Thyestes with his murdered sons' hands and heads. |
| 1 | http://example.org/kb/investigation-b05226da-eaef-4bc5-a139-ca12c94dbdfd | Crime B | In Mycenae, Thyestes raped his daughter Pelopia to have a son (Aegisthus) |
| 2 | http://example.org/kb/investigation-ac9fd560-261e-4cd6-af64-8b83d100b9a8 | Crime C | In Mycenae, Aegisthus killed Atreus (Agamemnon's father) |
| 3 | http://example.org/kb/investigation-2545442b-321c-454d-bcb8-c40d321ce2c2 | Crime D | In Aulis, Agamemnon killed his daughter Iphigenia as a sacrifice to the gods |
| 4 | http://example.org/kb/investigation-952d677d-6b62-4e53-9bac-1b113d268ac5 | Crime E | In the Palace of Argos, Agamemnon and Cassandra were killed by Clytemnestra (accomplice Aegisthus) |
| 5 | http://example.org/kb/investigation-5aa33dc6-7a39-4731-a754-62a9c41e5220 | Crime F | In the Palace of Argos, Clytemnestra and Aegisthus were killed by Orestes (accomplice Electra) |
SPARQL source - `query-investigations.sparql`
PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
PREFIX case-investigation: <https://ontology.caseontology.org/case/investigation/>
PREFIX uco-core: <https://ontology.unifiedcyberontology.org/uco/core/>
SELECT ?nInvestigation ?lName ?lDescription
WHERE {
?nInvestigation
a/rdfs:subClassOf* case-investigation:Investigation ;
.
OPTIONAL {
?nInvestigation
uco-core:name ?lName ;
.
}
OPTIONAL {
?nInvestigation
uco-core:description ?lDescription ;
.
}
}
ORDER BY ?lNameThese are the people mentioned throughout the graph:
SPARQL source - `query-people.sparql`
PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
PREFIX uco-core: <https://ontology.unifiedcyberontology.org/uco/core/>
PREFIX uco-identity: <https://ontology.unifiedcyberontology.org/uco/identity/>
SELECT ?nPerson ?lName ?lGivenName ?lFamilyName
WHERE {
?nPerson
a/rdfs:subClassOf* uco-identity:Person ;
.
OPTIONAL {
?nPerson
uco-core:name ?lName ;
.
}
OPTIONAL {
?nPerson
uco-core:hasFacet / uco-identity:familyName ?lFamilyName ;
.
}
OPTIONAL {
?nPerson
uco-core:hasFacet / uco-identity:givenName ?lGivenName ;
.
}
}
ORDER BY ?nPersonThese are the investigations in which the people are generically linked:
| ?lPersonName | ?lInA | ?lInB | ?lInC | ?lInD | ?lInE | ?lInF | |
|---|---|---|---|---|---|---|---|
| 0 | ✓ | ||||||
| 1 | ✓ | ||||||
| 2 | Aegisthus | ✓ | ✓ | ✓ | ✓ | ||
| 3 | Aeschylus | ✓ | |||||
| 4 | Agamemnon | ✓ | ✓ | ||||
| 5 | Atreus | ✓ | ✓ | ||||
| 6 | Cassandra | ✓ | |||||
| 7 | Clytemnestra | ✓ | ✓ | ||||
| 8 | Electra | ✓ | ✓ | ||||
| 9 | Euripides | ✓ | |||||
| 10 | Iphigenia | ✓ | |||||
| 11 | Joachim Metz | ||||||
| 12 | Orestes | ✓ | |||||
| 13 | Pelopia | ✓ | |||||
| 14 | Thyestes | ✓ | ✓ | ✓ |
SPARQL source - `query-people-investigations`
PREFIX kb: <http://example.org/kb/>
PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
PREFIX case-investigation: <https://ontology.caseontology.org/case/investigation/>
PREFIX uco-core: <https://ontology.unifiedcyberontology.org/uco/core/>
PREFIX uco-identity: <https://ontology.unifiedcyberontology.org/uco/identity/>
SELECT ?lPersonName ?lInA ?lInB ?lInC ?lInD ?lInE ?lInF
WHERE {
?nPerson
a/rdfs:subClassOf* uco-identity:Person ;
.
OPTIONAL {
?nPerson
uco-core:name ?lName ;
.
}
OPTIONAL {
?nPerson
uco-core:hasFacet / uco-identity:givenName ?lGivenName ;
.
}
BIND(COALESCE(?lGivenName, ?lName) AS ?lPersonName)
OPTIONAL {
kb:investigation-4586742a-710a-454f-bcb8-b60e230ec1b2 uco-core:object ?nPerson .
BIND("✓" AS ?lInA)
}
OPTIONAL {
kb:investigation-b05226da-eaef-4bc5-a139-ca12c94dbdfd uco-core:object ?nPerson .
BIND("✓" AS ?lInB)
}
OPTIONAL {
kb:investigation-ac9fd560-261e-4cd6-af64-8b83d100b9a8 uco-core:object ?nPerson .
BIND("✓" AS ?lInC)
}
OPTIONAL {
kb:investigation-2545442b-321c-454d-bcb8-c40d321ce2c2 uco-core:object ?nPerson .
BIND("✓" AS ?lInD)
}
OPTIONAL {
kb:investigation-952d677d-6b62-4e53-9bac-1b113d268ac5 uco-core:object ?nPerson .
BIND("✓" AS ?lInE)
}
OPTIONAL {
kb:investigation-5aa33dc6-7a39-4731-a754-62a9c41e5220 uco-core:object ?nPerson .
BIND("✓" AS ?lInF)
}
}
ORDER BY ?lPersonNameUsing a proof-of-concept illustration system, a render of this scenario's uco-core:Relationship objects is available:
Following visual-design practices of PROV-O, the following renders of this scenario's provenance are available:
| Figure's contents | Time hidden | Time displayed |
|---|---|---|
| All |  |
 |
| Chains of communication (activities) |  |
 |
| Chains of delegation (agents) |  |
 |
| Chains of derivation (entities) |  |
 |
| Chains of communication and delegation |  |
 |
| Chains of communication and derivation |  |
 |
| Chains of delegation and derivation |  |
 |