Vision Paper: Incorporating Domain Knowledge in Information Retrieval Systems to Streamline Incident Investigation

Observing events that require attention triggers the generation of a case and the start of an investigation process. An important part of such a process implies studying similar cases, aiming to improve situation awareness. However, identifying relevant cases, which are typically stored in a database, is work-intensive unless the investigator is supported by a smart Information Retrieval (IR) tool. We propose the development of IR tools that are able to leverage application domain knowledge to increase the relevance of the results. We suggest that formal models that explicitly represent the real-world phenomenon under investigation can be used to compute such relevance while also providing an explanation to the investigator. Our research is primarily motivated by the objective of supporting law enforcement officers in criminal investigation, but we show how our vision is applicable across multiple domains by providing simple application examples for both criminal investigation and cybersecurity incident investigation.