https://ontology.unifiedcyberontology.org/uco/observable/WindowsFilemapping
A Windows file mapping is the association of a file's contents with a portion of the virtual address space of a process within a Windows operating system. The system creates a file mapping object (also known as a section object) to maintain this association. A file view is the portion of virtual address space that a process uses to access the file's contents. File mapping allows the process to use both random input and output (I/O) and sequential I/O. It also allows the process to work efficiently with a large data file, such as a database, without having to map the whole file into memory. Multiple processes can also use memory-mapped files to share data. Processes read from and write to the file view using pointers, just as they would with dynamically allocated memory. The use of file mapping improves efficiency because the file resides on disk, but the file view resides in memory.[based on https://docs.microsoft.com/en-us/windows/win32/memory/file-mapping]
Instances of observable:WindowsFilemapping can have the following properties:
PROPERTY | TYPE | DESCRIPTION | RANGE |
---|---|---|---|
From class core:UcoObject | |||
investigation:wasDerivedFrom | owl:ObjectProperty | A re-implementation of the wasDerivedFrom property in W3C PROV-O. The definition of this property is 'A derivation is a transformation of an entity into another, an update of an entity resulting in a new one, or the construction of a new entity based on a pre-existing entity.' [Ref: https://www.w3.org/TR/prov-o/#wasDerivedFrom] | core:UcoObject |
From class owl:Thing | |||
types:threadNextItem | owl:ObjectProperty | The link to a next item in a thread. | owl:Thing |
types:threadPreviousItem | owl:ObjectProperty | A direct link to a previous item in a thread. | owl:Thing |
By the associated SHACL property shapes, instances of observable:WindowsFilemapping can have the following properties:
PROPERTY |
PROPERTY TYPE |
DESCRIPTION |
MIN COUNT |
MAX COUNT |
LOCAL RANGE |
GLOBAL RANGE |
|
---|---|---|---|---|---|---|---|
observable:ObservableObject | |||||||
observable:hasChanged | owl:DatatypeProperty |
|
1 |
xsd:boolean
|
xsd:boolean
|
||
observable:state | owl:DatatypeProperty |
|
1 |
xsd:string
|
xsd:string
|
||
core:UcoObject | |||||||
core:createdBy | owl:ObjectProperty |
The identity that created a characterization of a concept.
|
1 |
core:IdentityAbstraction
|
core:IdentityAbstraction
|
||
core:description | owl:DatatypeProperty |
A description of a particular concept characterization.
|
xsd:string
|
xsd:string
|
|||
core:externalReference | owl:ObjectProperty |
Specifies a reference to a resource outside of the UCO.
|
0 |
core:ExternalReference
|
core:ExternalReference
|
||
core:hasFacet | owl:InverseFunctionalProperty |
Further sets of properties characterizing a concept based on the particular context of the class and of the particular instance of the concept being characterized.
|
core:Facet
|
core:Facet
|
|||
core:modifiedTime | owl:DatatypeProperty |
Specifies the time that this particular version of the object was modified. The object creator can use the time it deems most appropriate as the time this version of the object was modified. The value of the modified property for a given object version MUST be later than or equal to the value of the created property. Object creators MUST update the modified property when creating a new version of an object. The modified timestamp MUST be precise to the nearest millisecond (exactly three digits after the decimal place in seconds).
|
xsd:dateTime
|
xsd:dateTime
|
|||
core:name | owl:DatatypeProperty |
The name of a particular concept characterization.
|
1 |
xsd:string
|
xsd:string
|
||
core:objectCreatedTime | owl:DatatypeProperty |
The time at which a characterization of a concept is created. This time pertains to the time of creating the record object, and is not an intrinsic characteristic of the concept.
|
1 |
xsd:dateTime
|
xsd:dateTime
|
||
core:objectMarking | owl:ObjectProperty |
Marking definitions to be applied to a particular concept characterization in its entirety.
|
core:MarkingDefinitionAbstraction
|
core:MarkingDefinitionAbstraction
|
|||
core:specVersion | owl:DatatypeProperty |
The version of UCO ontology or subontology specification used to characterize a concept.
|
1 |
xsd:string
|
xsd:string
|
||
core:tag | owl:DatatypeProperty |
A generic tag/label.
|
xsd:string
|
xsd:string
|
@prefix observable: <https://ontology.unifiedcyberontology.org/uco/observable/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
observable:WindowsFilemapping a owl:Class,
sh:NodeShape ;
rdfs:label "WindowsFilemapping"@en ;
rdfs:comment "A Windows file mapping is the association of a file's contents with a portion of the virtual address space of a process within a Windows operating system. The system creates a file mapping object (also known as a section object) to maintain this association. A file view is the portion of virtual address space that a process uses to access the file's contents. File mapping allows the process to use both random input and output (I/O) and sequential I/O. It also allows the process to work efficiently with a large data file, such as a database, without having to map the whole file into memory. Multiple processes can also use memory-mapped files to share data. Processes read from and write to the file view using pointers, just as they would with dynamically allocated memory. The use of file mapping improves efficiency because the file resides on disk, but the file view resides in memory.[based on https://docs.microsoft.com/en-us/windows/win32/memory/file-mapping]"@en ;
rdfs:subClassOf observable:ObservableObject ;
sh:targetClass observable:WindowsFilemapping .