https://cacontology.projectvic.org/platforms#MassUserBehaviorAnalysis
Analysis of user behavior patterns across massive user bases for investigation prioritization and automated threat assessment. Modeled as gUFO Event.
Instances of cacontology-platforms:MassUserBehaviorAnalysis can have the following properties:
| PROPERTY | TYPE | DESCRIPTION | RANGE |
|---|
By the associated SHACL property shapes, instances of cacontology-platforms:MassUserBehaviorAnalysis can have the following properties:
| PROPERTY | PROPERTY TYPE | DESCRIPTION | MIN | MAX | VALUE TYPE | OTHER CONSTRAINTS | GLOBAL RANGE |
|---|---|---|---|---|---|---|---|
| cacontology-platforms:MassUserBehaviorAnalysis | |||||||
cacontology-platforms:automatedProcessingPercentage |
-- | sh:message Automated processing percentage must be between 0.0 and 100.0. |
0 | 1 | xsd:decimal |
sh:minInclusive
0.0
sh:maxInclusive
100.0
|
-- |
uco-core:startTime |
-- | sh:message Mass user behavior analysis must specify start time. |
1 | 1 | xsd:dateTime | -- | |
| cac-core:InvestigativeAction | |||||||
gufo:hasBeginPointInXSDDateTimeStamp |
-- | begin time |
0 | 1 | xsd:dateTimeStamp | -- | |
gufo:hasEndPointInXSDDateTimeStamp |
-- | end time |
0 | 1 | xsd:dateTimeStamp | -- | |
rdfs:label |
-- | label |
1 | * | xsd:string | -- | |
| cac-core:Event | |||||||
(cacontology-forensics:examinedBy | cacontology-forensics:performedBy | cacontology-forensics:witnessedBy | cacontology-forensics:authorizedBy) |
-- | sh:message Every forensic event must have at least one participant (gUFO participation) |
1 | * | -- | ||
(cacontology-grooming:targetsVictim | cacontology-grooming:performedBy | cacontology-grooming:witnessedBy | cacontology-grooming:facilitatedBy) |
-- | sh:message Every grooming event must have at least one participant (gUFO participation) |
1 | * | -- | ||
(cacontology-usa-federal:prosecutedBy | cacontology-usa-federal:investigatedBy | cacontology-usa-federal:defendedBy | cacontology-usa-federal:victimizedBy) |
-- | sh:message Every federal criminal event must have at least one participant |
1 | * | -- | ||
(gufo:hasBeginPointInXSDDateTimeStamp | cacontology-enterprises:hasCoercionEventBeginDate | cacontology-enterprises:hasInvestigationBeginDate) |
-- | sh:message gUFO Events must have at least one temporal beginning point. |
1 | * | -- | ||
gufo:hasBeginPointInXSDDateTimeStamp |
-- | begin time Optional temporal begin point for the event. sh:message Event can have at most one begin point; Forensic action must have at most one begin timestamp (gUFO temporal constraint); Grooming behavior must have at most one begin timestamp (gUFO temporal); Production event must have exactly one begin point. |
1 | 1 | xsd:dateTimeStamp | -- | |
gufo:hasEndPointInXSDDateTimeStamp |
-- | end time Optional temporal end point for the event. sh:message Event can have at most one end point; Forensic action must have at most one end timestamp (gUFO temporal constraint); Grooming behavior must have at most one end timestamp (gUFO temporal); Production event may have an end point. |
0 | 1 | xsd:dateTimeStamp | -- | |
rdfs:label |
-- | label Every event should have at least one human-readable label. |
1 | * | xsd:string | -- | |
| case-investigation:InvestigativeAction | |||||||
uco-action:endTime |
-- | sh:message When present, action endTime should be at most one xsd:dateTime literal. |
0 | 1 | xsd:dateTime |
sh:severity
sh:Warning
|
-- |
uco-action:object |
-- | sh:message Action must reference at least one object IRI. |
1 | * | sh:IRI |
sh:severity
sh:Violation
|
-- |
uco-action:performer |
-- | sh:message Action must have exactly one performer IRI. |
1 | 1 | sh:IRI |
sh:severity
sh:Violation
|
-- |
uco-action:result |
-- | sh:message When present, action result values should be IRI nodes. |
0 | * | sh:IRI |
sh:severity
sh:Warning
|
-- |
uco-action:startTime |
-- | sh:message Action must have exactly one startTime (xsd:dateTime). |
1 | 1 | xsd:dateTime |
sh:severity
sh:Warning
|
-- |
| uco-action:Action | |||||||
uco-action:endTime |
-- | sh:message When present, action endTime should be at most one xsd:dateTime literal. |
0 | 1 | xsd:dateTime |
sh:severity
sh:Warning
|
-- |
uco-action:object |
-- | sh:message Action must reference at least one object IRI. |
1 | * | sh:IRI |
sh:severity
sh:Violation
|
-- |
uco-action:performer |
-- | sh:message Action must have exactly one performer IRI. |
1 | 1 | sh:IRI |
sh:severity
sh:Violation
|
-- |
uco-action:result |
-- | sh:message When present, action result values should be IRI nodes. |
0 | * | sh:IRI |
sh:severity
sh:Warning
|
-- |
uco-action:startTime |
-- | sh:message Action must have exactly one startTime (xsd:dateTime). |
1 | 1 | xsd:dateTime |
sh:severity
sh:Warning
|
-- |
@prefix cac-core: <https://cacontology.projectvic.org/core#> .
@prefix cacontology-platforms: <https://cacontology.projectvic.org/platforms#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
cacontology-platforms:MassUserBehaviorAnalysis a owl:Class ;
rdfs:label "Mass User Behavior Analysis"@en ;
rdfs:comment "Analysis of user behavior patterns across massive user bases for investigation prioritization and automated threat assessment. Modeled as gUFO Event."@en ;
rdfs:subClassOf cac-core:InvestigativeAction .