Bringing domain-specific languages to digital forensics

Theory and Practice of Model Transformations

2015

Self Cite

Abstract. In textual modeling, models are created through an intermediate parsing step which maps textual representations to abstract model structures. Therefore, the identify of elements is not stable across different versions of the same model. Existing model differencing algorithms, therefore, cannot be applied directly because they need to identify model elements across versions. In this paper we present Textual Model Diff (TMDIFF), a technique to support model differencing for textual languages. TMDIFF requires origin tracking during text-to-model mapping to trace model elements back to the symbolic names that define them in the textual representation. Based on textual alignment of those names, TMDIFF can then determine which elements are the same across revisions, and which are added or removed. As a result, TMDIFF brings the benefits of model differencing to textual languages.

Section: Resultsmentioning

confidence: 99%

“…These file format specifications are written in Derric, a DSL for digital forensics analysis [16]. Derric is a grammar-like DSL: it contains a top-level regular expression, specifying the binary layout of file formats.…”

Section: Differencing Derric File Format Descriptionsmentioning

confidence: 99%

Origin Tracking $$+$$ Text Differencing $$=$$ Textual Model Differencing

Rozen

Theory and Practice of Model Transformations

2015

Self Cite

“…It provides the implementation platform for a real-life DSL in the domain of digital forensics [53]. The tool is accompanied with interactive online documentation and is regularly released as a self-contained Eclipse plugin.…”

Section: Mps (Since 2003 Http://wwwjetbrainscom/mps/)mentioning

confidence: 99%

The State of the Art in Language Workbenches

Erdweg

Lecture Notes in Computer Science

Völter³

et al. 2013

Self Cite

132

104

Abstract. Language workbenches are tools that provide high-level mechanisms for the implementation of (domain-specific) languages. Language workbenches are an active area of research that also receives many contributions from industry. To compare and discuss existing language workbenches, the annual Language Workbench Challenge was launched in 2011. Each year, participants are challenged to realize a given domain-specific language with their workbenches as a basis for discussion and comparison. In this paper, we describe the state of the art of language workbenches as observed in the previous editions of the Language Workbench Challenge. In particular, we capture the design space of language workbenches in a feature model and show where in this design space the participants of the 2013 Language Workbench Challenge reside. We compare these workbenches based on a DSL for questionnaires that was realized in all workbenches.

“…To find the first mandatory field that defines a constant, we use a simple algorithm, similar to the computation of first-sets of context-free grammars [1]. Figure 4 shows the effect of a single transformation step to remove the size dependency of the chunktype field of PNG's IDAT structure 5 . In this example the content-analysis and value dependencies have already been removed.…”

Section: Remove Data Dependenciesmentioning

confidence: 99%

“…In previous work we have developed a model-driven approach to digital forensics tool construction [5]. In this work the file formats of interest, e.g., JPEG, GIF etc., are declaratively modeled using a domain-specific language (DSL) called Derric.…”

Section: Introductionmentioning

confidence: 99%

Domain-Specific Optimization in Digital Forensics

Bos

Theory and Practice of Model Transformations

2012

Self Cite

Abstract. File carvers are forensic software tools used to recover data from storage devices in order to find evidence. Every legal case requires different trade-offs between precision and runtime performance. The resulting required changes to the software tools are performed manually and under the strictest deadlines. In this paper we present a model-driven approach to file carver development that enables these trade-offs to be automated. By transforming high-level file format specifications into approximations that are more permissive, forensic investigators can trade precision for performance, without having to change source. Our study shows that performance gains up to a factor of three can be achieved, at the expense of up to 8% in precision and 5% in recall.