GFEAR (Graph-Codify Forensic Extraction and Representation) Language

Using Collections

Once a collection has been created, it can be used in 2 ways, appending entities, or as a property on an entity.

Adding Entities to a Collection

To add an item to a collection, the append entity statement.

The GFEAR language supports iterations over complex data sets where the data (such as a JSON file) may have a list of items. This can be used in conjunction with the append entity statement.

create collection loadedDllList as rdf:Bag of uco-observable:File;

foreach Dll in LoadedDlls
{  
    create entity dllEntry as uco-observable:File with {
        create property uco-observable:filePath with Dll;  
    } identified by required uco-observable:filePath;

    append entity dllEntry to loadedDllList;
}

In the above code a collection is created as a rdf:Bag expecting all items to be a specific type of uco-observable:File. The foreach Dll in LoadedDlls statement iterates over each entry in the field LoadedDlls and makes it accessible to the code block using a variable name Dll. Within the foreach code block, an entity is created, that entity has a property called uco-observable:filePath that is assigned to the current value stored in the Dll variable (that is being iterated). With the entity that is created, it is added to the loadedDllList collection that has been created. As this list has been typed, if the entity being added is not a uco-observable:File the language will fail to execute the script.

Attaching a Collection to a Property of an entity

Once a collection is created and populated, it can be added to an entity using the create property statement. When adding a collection to an entity, the Uri of the relationship must be provided, along with the name of the collection that was specified when it was created. Based on the loadedDllList collection created above, the collection can be added to an entity as follows:

create property prov:wasDerivedFrom with collection loadedDllList;

The Uri of the property is prov:wasDerivedFrom, and the collection to attach to the property is the loadedDllList collection. The resulting RDF will be that the blank node representing the root of the collection is the object of the triple.