EDXML 3 Released

Today I can finally announce the availability of EDXML 3. It is the result of more than a decade of hands-on experience in law enforcement, forensics and cybersecurity. Initially sparked from personal frustration in data analytics, it has slowly evolved to become what it is today.

EDXML is about teaching machines to tell stories. It is about teaching machines to understand what story data is telling. To see data like a human analyst sees it. Then, assisting the analyst in reasoning about that data. Connect the dots, complete the puzzle, reveal the big picture.

EDXML enables transforming data into stories that both man and machine can understand. This is done by integrating expert knowledge into the data itself. Technically it is a form of knowledge representation with a focus on simplicity. Its roots in actual real world challenges have made that it fully embraces the ambiguities and uncertainties that exist in real data sets. Its roots in forensics make that its reasoning results are easily verified and traced back to the original data.

The project was initiated during my time at the High Tech Crime unit of the Dutch National Police Agency. My main source of inspiration was observing the way investigators, myself included, cooperate in teams to connect the dots while working cases.

While my team cooperated to work cases, my computers were generally not as cooperative. Their role was limited to that of passive tools, unable to share and combine their joint knowledge on their own. Computers could possess key information and not tell anyone about it. In my view, this severely limited the team. It sparked ideas to enable machines to become team players, get actively involved and contribute their vast processing capacity.

The release consists of the following components:

• Specification Document
• Python SDK
• Test Corpus
• Ontology Brick Collection

A special thanks goes to Northwave Nederland BV. The data analysis operations at their Security Operations Center as well as their Incident Response Team and other divisions acted as challenging testing grounds and provided tons of inspiration and new ideas that contributed to EDXML 3.

You can learn more about EDXML on edxml.org.