A forensic tool for the identification, acquisition and analysis of sources of evidence in IoT investigations

Abstract

The emergence of the Internet of Things (IoT) has posed a new challenge for forensic investigators, who find themselves carrying out examinations in a very heterogeneous and novel scenario. Aspects such as the high number of devices, the unlikelihood of having physical access to them, the short lifetime of the data, or the difficulty of acquiring it, demand changes in some of the key processes of forensic investigations. In this regard, the identification, acquisition, and analysis phases call for an IoT-centred approach that can fulfil the requirements of the environment. Due to the interoperability of the IoT, and the way in which the data is handled and exchanged, the network traffic becomes a very useful source of evidence. In view of this, this paper presents an automatic procedure for identifying, analysing, and acquiring IoT network traffic and using it as a basis for forensic examinations by employing an edge node capable of performing real-time traffic monitoring and analysis on the most popular IoT protocols. Furthermore, by pairing it with an Intrusion Detection System (IDS) based on Machine Learning (ML) algorithms, the proposal is capable of following a proactive approach, detecting threats and taking the corresponding measures to assure the correct initiation of a forensic process.