A forensic tool for the identification, acquisition and analysis of sources of evidence in IoT investigations
The emergence of the Internet of Things (IoT) has posed a new challenge for forensic investigators, who find themselves carrying out examinations in a very heterogeneous and novel scenario. Aspects such as the high number of devices, the unlikelihood of having physical access to them, the short life...
| Autores: | , , |
|---|---|
| Tipo de recurso: | artículo |
| Fecha de publicación: | 2024 |
| País: | España |
| Institución: | Universidad de Castilla-La Mancha |
| Repositorio: | RUIdeRA. Repositorio Institucional de la UCLM |
| OAI Identifier: | oai:ruidera.uclm.es:10578/43285 |
| Acceso en línea: | https://doi.org/10.1016/j.iot.2024.101308 https://hdl.handle.net/10578/43285 |
| Access Level: | acceso abierto |
| Palabra clave: | Digital forensics IoT forensics Evidence identification Traffic auditing Evidence collection |
| Sumario: | The emergence of the Internet of Things (IoT) has posed a new challenge for forensic investigators, who find themselves carrying out examinations in a very heterogeneous and novel scenario. Aspects such as the high number of devices, the unlikelihood of having physical access to them, the short lifetime of the data, or the difficulty of acquiring it, demand changes in some of the key processes of forensic investigations. In this regard, the identification, acquisition, and analysis phases call for an IoT-centred approach that can fulfil the requirements of the environment. Due to the interoperability of the IoT, and the way in which the data is handled and exchanged, the network traffic becomes a very useful source of evidence. In view of this, this paper presents an automatic procedure for identifying, analysing, and acquiring IoT network traffic and using it as a basis for forensic examinations by employing an edge node capable of performing real-time traffic monitoring and analysis on the most popular IoT protocols. Furthermore, by pairing it with an Intrusion Detection System (IDS) based on Machine Learning (ML) algorithms, the proposal is capable of following a proactive approach, detecting threats and taking the corresponding measures to assure the correct initiation of a forensic process. |
|---|