Optimizing cybersecurity knowledge graph question answering: a framework for performance and generalization

UTC's ForensiQ system demonstrates that Knowledge Graph Question Answering (KGQA) systems can handle the scale and complexity of Internet of Things (IoT) forensics. However, using KGQA systems requires a high level of technical expertise, and there are concerns about ForensiQ's inference speed and generalization ability. This thesis aims to enhance KGQA system usability in IoT forensics by extending ForensiQ’s framework to aid investigators, improving ForensiQ's entity detection speed, and testing performance on rephrased questions. Towards this goal, a Django web application was developed to visualize KGQA reasoning, aid KG exploration, and facilitate the creation of custom KGQA datasets. We also replaced ForensiQ's language-model-based entity detector with a name-dictionary-based one, significantly improving the entity detection speed while maintaining accuracy. Tested with rephrased questions, the extended ForensiQ versions outperform the baseline. The experimental results demonstrate the significant improvement of the extended ForensiQ framework on performance and generalization for IoT forensics investigation.

Grantor dc:publisher

University of Tennessee at Chattanooga

Year dc:date.available

2025

Author dc:creator

• Gumaa, Ayman

Contributors dc:contributor

• Xie, Mengjun
• Qin, Hong; Liang, Yu
• College of Engineering and Computer Science

• Digital forensic science
• Internet of things

Licence

• http://rightsstatements.org/vocab/InC/1.0/

Language dc:language

English, eng

Repository record dc:identifier

https://scholar.utc.edu/theses/960

OAI identifier oai:identifier

oai:scholar.utc.edu:theses-2140