Sergio Ruiz-Villafranca , Juan Manuel Castelo Gómez , José Roldán-Gómez
{"title":"在物联网调查中识别、获取和分析证据来源的法医工具","authors":"Sergio Ruiz-Villafranca , Juan Manuel Castelo Gómez , José Roldán-Gómez","doi":"10.1016/j.iot.2024.101308","DOIUrl":null,"url":null,"abstract":"<div><p>The emergence of the Internet of Things (IoT) has posed a new challenge for forensic investigators, who find themselves carrying out examinations in a very heterogeneous and novel scenario. Aspects such as the high number of devices, the unlikelihood of having physical access to them, the short lifetime of the data, or the difficulty of acquiring it, demand changes in some of the key processes of forensic investigations. In this regard, the identification, acquisition, and analysis phases call for an IoT-centred approach that can fulfil the requirements of the environment. Due to the interoperability of the IoT, and the way in which the data is handled and exchanged, the network traffic becomes a very useful source of evidence. In view of this, this paper presents an automatic procedure for identifying, analysing, and acquiring IoT network traffic and using it as a basis for forensic examinations by employing an edge node capable of performing real-time traffic monitoring and analysis on the most popular IoT protocols. Furthermore, by pairing it with an Intrusion Detection System (IDS) based on Machine Learning (ML) algorithms, the proposal is capable of following a proactive approach, detecting threats and taking the corresponding measures to assure the correct initiation of a forensic process.</p></div>","PeriodicalId":29968,"journal":{"name":"Internet of Things","volume":null,"pages":null},"PeriodicalIF":6.0000,"publicationDate":"2024-08-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://www.sciencedirect.com/science/article/pii/S254266052400249X/pdfft?md5=9cf512ece43bae0d0c5c055464a44cdf&pid=1-s2.0-S254266052400249X-main.pdf","citationCount":"0","resultStr":"{\"title\":\"A forensic tool for the identification, acquisition and analysis of sources of evidence in IoT investigations\",\"authors\":\"Sergio Ruiz-Villafranca , Juan Manuel Castelo Gómez , José Roldán-Gómez\",\"doi\":\"10.1016/j.iot.2024.101308\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"<div><p>The emergence of the Internet of Things (IoT) has posed a new challenge for forensic investigators, who find themselves carrying out examinations in a very heterogeneous and novel scenario. Aspects such as the high number of devices, the unlikelihood of having physical access to them, the short lifetime of the data, or the difficulty of acquiring it, demand changes in some of the key processes of forensic investigations. In this regard, the identification, acquisition, and analysis phases call for an IoT-centred approach that can fulfil the requirements of the environment. Due to the interoperability of the IoT, and the way in which the data is handled and exchanged, the network traffic becomes a very useful source of evidence. In view of this, this paper presents an automatic procedure for identifying, analysing, and acquiring IoT network traffic and using it as a basis for forensic examinations by employing an edge node capable of performing real-time traffic monitoring and analysis on the most popular IoT protocols. Furthermore, by pairing it with an Intrusion Detection System (IDS) based on Machine Learning (ML) algorithms, the proposal is capable of following a proactive approach, detecting threats and taking the corresponding measures to assure the correct initiation of a forensic process.</p></div>\",\"PeriodicalId\":29968,\"journal\":{\"name\":\"Internet of Things\",\"volume\":null,\"pages\":null},\"PeriodicalIF\":6.0000,\"publicationDate\":\"2024-08-06\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"https://www.sciencedirect.com/science/article/pii/S254266052400249X/pdfft?md5=9cf512ece43bae0d0c5c055464a44cdf&pid=1-s2.0-S254266052400249X-main.pdf\",\"citationCount\":\"0\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"Internet of Things\",\"FirstCategoryId\":\"94\",\"ListUrlMain\":\"https://www.sciencedirect.com/science/article/pii/S254266052400249X\",\"RegionNum\":3,\"RegionCategory\":\"计算机科学\",\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"Q1\",\"JCRName\":\"COMPUTER SCIENCE, INFORMATION SYSTEMS\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"Internet of Things","FirstCategoryId":"94","ListUrlMain":"https://www.sciencedirect.com/science/article/pii/S254266052400249X","RegionNum":3,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q1","JCRName":"COMPUTER SCIENCE, INFORMATION SYSTEMS","Score":null,"Total":0}
A forensic tool for the identification, acquisition and analysis of sources of evidence in IoT investigations
The emergence of the Internet of Things (IoT) has posed a new challenge for forensic investigators, who find themselves carrying out examinations in a very heterogeneous and novel scenario. Aspects such as the high number of devices, the unlikelihood of having physical access to them, the short lifetime of the data, or the difficulty of acquiring it, demand changes in some of the key processes of forensic investigations. In this regard, the identification, acquisition, and analysis phases call for an IoT-centred approach that can fulfil the requirements of the environment. Due to the interoperability of the IoT, and the way in which the data is handled and exchanged, the network traffic becomes a very useful source of evidence. In view of this, this paper presents an automatic procedure for identifying, analysing, and acquiring IoT network traffic and using it as a basis for forensic examinations by employing an edge node capable of performing real-time traffic monitoring and analysis on the most popular IoT protocols. Furthermore, by pairing it with an Intrusion Detection System (IDS) based on Machine Learning (ML) algorithms, the proposal is capable of following a proactive approach, detecting threats and taking the corresponding measures to assure the correct initiation of a forensic process.
期刊介绍:
Internet of Things; Engineering Cyber Physical Human Systems is a comprehensive journal encouraging cross collaboration between researchers, engineers and practitioners in the field of IoT & Cyber Physical Human Systems. The journal offers a unique platform to exchange scientific information on the entire breadth of technology, science, and societal applications of the IoT.
The journal will place a high priority on timely publication, and provide a home for high quality.
Furthermore, IOT is interested in publishing topical Special Issues on any aspect of IOT.