IoT forensics
| Part of a series on |
| Forensic science |
|---|
.png) |
IoT forensics is a branch of digital forensics that has the goal of identifying and extracting digital information from devices belonging to the Internet of things field, using a forensically sound and legally acceptable process.[1]
Overview
Unlike traditional digital forensics approaches, IoT forensics is characterized by a wider range of potential source of evidence: with respect to the traditional analysis of servers, computers and smartphones, IoT forensics is extracting the information directly from smart environment data including monitoring systems, traffic lights, medical implants, smart home devices and more IoT scenarios.[1]
Moreover, IoT forensics potential source of evidence can be very different in nature with respect to digital forensics common use cases: network traffic, cloud data, devices logs and more information can be extracted and used as source of evidence if extracted successfully and processed in the correct way. [2]
IoT forensics can be identified as a combination of three separate digital forensics schemes:[3]
- IoT device level forensics: Process of extracting evidence from the IoT devices (i.e. in the device memory).[3] A lot of devices can be included in this process: examples are sensors, health implants, smart meters, smart home appliances, smart cameras, networked vehicles, RFIDs, and drones. Being the devices differ in hardware and functionalities, device level evidence identification and acquisition is often challenging and not always feasible.[4]
- Network forensics: Process of identifying and extracting evidence from network log, devices traffic traces and communication patterns. With respect to the traditional network investigations, IoT network forensics branch includes additional network models such as body area network or personal area network (i.e. Bluetooth or ZigBee devices).[3] For each type of network, there needs to be appropriate forensic methods for the investigations, involving different tools and appropriate network protocol analysis.[5]
- Cloud forensics: Process of extrapolating information in the cloud used by the devices. Since IoT devices are usually limited in memory, most of the information is stored in proprietary cloud applications that may contain a massive amount of potential evidences (i.e. devices activities).[3] Given the amount of information that can be recovered from the different entities involved in the cloud, cloud forensics plays an important role in the IoT forensics domain: system logs, access logs, chat logs, sessions, cookies, user authentication and application data are examples of the information that can be retrieved from cloud services related to each IoT device.[4]
IoT forensics process
An IoT forensics investigation process should be conducted using the standard guidelines so that the collected evidence can be admissible on the court.[4] The process is analogous to digital forensics process, but faces challenges caused by the peculiarities of the IoT devices. The full process can be split temporally into six different phases: Evidence identification, evidence collection, evidence preservation, evidence analysis, attack and deficit attribution, and evidence presentation.[6] Each of the different phases of the forensic process may introduce several challenges when applied to the limitations of the IoT devices.[1]
Evidence identification and collection
Evidence identification and its subsequent collection are the first phases for investigators during forensic processes. Search and seizure is an important step in any forensic examination: in the particular case of the IoT forensics, detecting presence of IoT systems is not always immediate considering that these devices are usually of small dimensions and are designed to work passively and autonomously.[6]
Most of the information on IoT devices is usually sent to cloud servers, considering the very limited physical memory of the device itself. This brings new challenges for the forensic investigators that sometimes can not even know where the data is located, as it is distributed among many servers in multiple data centers.[3] Moreover, after the identification step, cloud evidence collection is not always feasible given the different jurisdictions under which the data could be located. Data center locations of cloud service providers are usually distributed in order to reduce costs and increase service efficiency. For this reason a forensic investigator often faces multi-jurisdiction issues during the data collection when the information is stored in the cloud.[5]
In the case of network forensics some of the evidence can be collected from network devices like routers or firewalls, but most of the network potential sources of evidence exists only in flight. For example, network traffic can be captured only at the time it passes through a device processing it. There are devices and procedures for storing network traffic as raw data but it is impractical to capture and save all network data due to its volume. The question of privacy and legal issues of data acquisition in network forensics is even larger than in the cloud forensics case, as the network data might include a lot of information that is not related to the legal case in question.[7] Current research in IoT network forensics is working on the development of tools based on the most popular network traffic softwares (e.g. tcpdump, Wireshark) to extract information from network devices (i.e. Wi-Fi access points), in order to avoid the storage of the full traffic still maintaining potential evidence for forensic investigation.[8]
At the device level, once the IoT device in question has been identified, the evidence should be extracted in its physical memory. Digital forensics traditional process guidelines suggest to turn off the evidentiary devices in order to prevent the alteration of data.[1] Given the cloud services almost substituting the storage (ROM) of the IoT devices, most of the physical information is nevertheless located in volatile memory like RAM. The creation of an evidence copy of such memory must be done without powering down the device, which goes against traditional best-practices and is not always feasible since most of the devices have limited energy capabilities.[7] Moreover, unplugged IoT devices may become unaccessible and need proper reconfiguration before the use, hence modifying system logs information causing loss of potential evidences.[9] For these reasons the approach to follow when dealing with IoT device level forensics is performing live forensics data acquisition.[citation needed]
Recent research in IoT forensics presents several frameworks and useful tools that can be used by forensics investigator for the identification and collection of evidences. The majority of the existing tools however require a proactive process (i.e. installing the software) and is thus not always usable for forensic investigations, unless they have been set up before the crime occurs.[3][10][11][12][13]
Evidencepreservation
After the evidence identification and its subsequent collection, the forensic investigator should preserve the gathered data and guarantee its integrity during the full process from right after the collection to the final presentation.[1]
While the preservation of data using proper techniques (i.e. hashing) is feasible in traditional digital forensics, it represents a hard challenge and needs particular attention in IoT environments. Autonomous interactions between the different devices introduce challenges to identify scope of a compromise and the boundaries of a crime scene.[6]
IoT forensics evidence preservation requires modern and distributed techniques to preserve and avoid the corruption of the collected evidence. For this reason the current research focuses on applying proper blockchain solutions to the evidence preservation phase, so to store the evidence in distributed nodes in the network avoiding possible attacks to its integrity.[12][14][15][16][17]
Evidence analysis and attack attribution
This phase involves all the analysis steps required by the investigators that should process and connect all the collected evidences in order to reach an outcome for the investigation. In the case of IoT evidence, the big volume of data that are usually collected in the acquisition phase make it almost impossible to provide an end-to-end analysis of the evidences.[6] Moreover, the majority of IoT devices in the network do not store any metadata including temporal information such as creation or modification times. This makes even harder to verify the provenance and to ensure the integrity of the collected data.
In the particular case of IoT device physical memory analysis, several tools can be used by electronically connecting to the devices.[citation needed]
The trends in the current research in the network forensics field in the particular case of IoT forensics involves the application of artificial intelligence and machine learning techniques to deal with the massive amount of data that can be extracted from devices network traffic traces.[18]
In the attack and deficit attribution phase, the evidence collected and analysed are summarized to lead to the final outcome of the investigation. In traditional digital forensics the involved source of evidence are usually extracted from personal devices and hence lead to a restricted number of suspects. The same does not hold for IoT forensics evidence that, if moreover extracted from the cloud, can be located in physical servers accessed by multiple users at the same time.[1]
Evidence presentation
The last phase of any forensic investigation process is the final presentation of the collected and analysed evidences in front of the jury court. IoT forensics evidence presentation is not as simple as traditional forensic cases, in particular for finding a proper human readable representation of the evidence itself that is usually under abstract forms. Depending on legal systems it could be needed to present the collected evidence in front of the jurors in the courtroom, most probably having a very restricted knowledge of network/cloud forensics, based often on their personal experience with IoT devices. This introduces challenges for the investigator organizing the evidences in order to produce an evidence report to be easily understandable for non-experts.[1] The investigator should moreover pay particular attention in the processing phase, especially when using analytic functions, because the procedure could modify the structure of the data and alter its meaning, hence invalidating the full process.[citation needed]
IoT forensics vs. security
IoT forensics should not be confused with IoT security. IoT forensics takes care of finding evidences for forensics purposes: the evidences are not always related to IoT devices attacks or to their security, but can be used for proving/disproving a traditional forensic crime (i.e. a person detected in a room from IoT devices evidence). In the other side, IoT security takes care of the risks related to the presence of IoT devices and of attacks that may target them: it protects the devices from external attacks and prevents the devices to perform attacks to other entities.
See also
References
- ^ a b c d e f g M. Stoyanova; Y. Nikoloudakis; S. Panagiotakis; E. Pallis; E. Markakis (2020). "A Survey on the Internet of Things (IoT) Forensics: Challenges, Approaches, and Open Issues". IEEE Communications Surveys & Tutorials. 22 (2): 1191–1221. doi:10.1109/COMST.2019.2962586. S2CID 213028057.
- ^ S. Alabdulsalam; K. Schaefer; T. Kechadi; NA. Le-Khac (2018). "Internet of Things Forensics – Challenges and a Case Study". IFIP Advances in Information and Communication Technology. Advances in Digital Forensics XIV. DigitalForensics 2018. arXiv:1801.10391. doi:10.1007/978-3-319-99277-8_3.
- ^ a b c d e f Zawoad, Shams; Hasan, Ragib (2015). FAIoT: Towards Building a Forensics Aware Eco System for the Internet of Things. 2015 IEEE International Conference on Services Computing. New York City, NY, USA: IEEE. pp. 279–284. doi:10.1109/SCC.2015.46. ISBN 978-1-4673-7281-7.
- ^ a b c Hou, Jianwei; Li, Yuewei; Yu, Jingyang; Shi, Wenchang (2020). "A Survey on Digital Forensics in Internet of Things". IEEE Internet of Things Journal. 7 (1): 1–15. doi:10.1109/JIOT.2019.2940713. ISSN 2327-4662. S2CID 203171771.
- ^ a b Karabiyik, Umit; Akkaya, Kemal (2019), Ammari, Habib M. (ed.), "Digital Forensics for IoT and WSNs", Mission-Oriented Sensor Networks and Systems: Art and Science, vol. 164, Cham: Springer International Publishing, pp. 171–207, arXiv:1811.09239, doi:10.1007/978-3-319-92384-0_6, ISBN 978-3-319-92383-3, S2CID 53718032, retrieved 2022-06-29
- ^ a b c d Conti, Mauro; Dehghantanha, Ali; Franke, Katrin; Watson, Steve (2018). "Internet of Things security and forensics: Challenges and opportunities". Future Generation Computer Systems. 78: 544–546. arXiv:1807.10438. doi:10.1016/j.future.2017.07.060. S2CID 38283507.
- ^ a b Mrdovic, Sasa (2021), Avoine, Gildas; Hernandez-Castro, Julio (eds.), "IoT Forensics", Security of Ubiquitous Computing Systems, Cham: Springer International Publishing, pp. 215–229, doi:10.1007/978-3-030-10591-4_13, ISBN 978-3-030-10590-7
- ^ Liu, Zhongli; Chen, Yinjie; Yu, Wei; Fu, Xinwen (2010). "Generic network forensic data acquisition from household and small business wireless routers". 2010 IEEE International Symposium on "A World of Wireless, Mobile and Multimedia Networks" (WoWMoM). pp. 1–6. doi:10.1109/WOWMOM.2010.5534945. ISBN 978-1-4244-7264-2. S2CID 17581168.
- ^ Yaqoob, Ibrar; Hashem, Ibrahim Abaker Targio; Ahmed, Arif; Kazmi, S. M. Ahsan; Hong, Choong Seon (2019). "Internet of things forensics: Recent advances, taxonomy, requirements, and open challenges". Future Generation Computer Systems. 92: 265–275. doi:10.1016/j.future.2018.09.058. ISSN 0167-739X. S2CID 57379928.
- ^ Hossain, Mahmud; Hasan, Ragib; Zawoad, Shams (2017). "Trust-IoV: A Trustworthy Forensic Investigation Framework for the Internet of Vehicles (IoV)". 2017 IEEE International Congress on Internet of Things (ICIOT). Honolulu, HI, USA: IEEE. pp. 25–32. doi:10.1109/IEEE.ICIOT.2017.13. ISBN 978-1-5386-2011-3. S2CID 20024432.
- ^ Chi, Hongmei; Aderibigbe, Temilola; Granville, Bobby C. (2018). "A Framework for IoT Data Acquisition and Forensics Analysis". 2018 IEEE International Conference on Big Data (Big Data). Seattle, WA, USA: IEEE. pp. 5142–5146. doi:10.1109/BigData.2018.8622019. ISBN 978-1-5386-5035-6. S2CID 59231175.
- ^ a b Le, Duc-Phong; Meng, Huasong; Su, Le; Yeo, Sze Ling; Thing, Vrizlynn (2018). "BIFF: A Blockchain-based IoT Forensics Framework with Identity Privacy". TENCON 2018 - 2018 IEEE Region 10 Conference. Jeju, Korea (South): IEEE. pp. 2372–2377. doi:10.1109/TENCON.2018.8650434. ISBN 978-1-5386-5457-6. S2CID 67874705.
- ^ Hossain, Mahmud; Karim, Yasser; Hasan, Ragib (2018). "FIF-IoT: A Forensic Investigation Framework for IoT Using a Public Digital Ledger". 2018 IEEE International Congress on Internet of Things (ICIOT). San Francisco, CA: IEEE. pp. 33–40. doi:10.1109/ICIOT.2018.00012. ISBN 978-1-5386-7244-0. S2CID 52902669.
- ^ Brotsis, Sotirios; Kolokotronis, Nicholas; Limniotis, Konstantinos; Shiaeles, Stavros; Kavallieros, Dimitris; Bellini, Emanuele; Pavue, Clement (2019). "Blockchain Solutions for Forensic Evidence Preservation in IoT Environments". 2019 IEEE Conference on Network Softwarization (NetSoft). Paris, France: IEEE. pp. 110–114. arXiv:1903.10770. doi:10.1109/NETSOFT.2019.8806675. ISBN 978-1-5386-9376-6. S2CID 85518244.
- ^ Meng, Weizhi; Tischhauser, Elmar Wolfgang; Wang, Qingju; Wang, Yu; Han, Jinguang (2018). "When Intrusion Detection Meets Blockchain Technology: A Review". IEEE Access. 6: 10179–10188. doi:10.1109/ACCESS.2018.2799854. hdl:10536/DRO/DU:30109697. ISSN 2169-3536. S2CID 3932531.
- ^ Hossain, Mahmud; Hasan, Ragib; Zawoad, Shams (2018). "Probe-IoT: A public digital ledger based forensic investigation framework for IoT". IEEE INFOCOM 2018 - IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). Honolulu, HI: IEEE. pp. 1–2. doi:10.1109/INFCOMW.2018.8406875. ISBN 978-1-5386-5979-3. S2CID 49653541.
- ^ Lone, Auqib Hamid; Mir, Roohie Naaz (2019). "Forensic-chain: Blockchain based digital forensics chain of custody with PoC in Hyperledger Composer". Digital Investigation. 28: 44–55. doi:10.1016/j.diin.2019.01.002. S2CID 68214327.
- ^ Sikos, Leslie F. (2020). "Packet analysis for network forensics: A comprehensive survey". Forensic Science International: Digital Investigation. 32: 200892. doi:10.1016/j.fsidi.2019.200892. S2CID 212863330.