Enhancing A Universal Acquisition and Analysis Tool: A Scalable and Interoperable Forensic Tool for Internet of Things (IoT)
Keywords:
IoT digital forensics, Protocol interoperability, Chain of custody, Apache Kafka, Random ForestAbstract
Digital forensics artifacts created by the Internet of Things (IoT) environment are highly fragmented, originating from diverse devices, gateways, message brokers and cloud platforms using various protocols and logging formats thus creating non-comparable logs. Modern forensic software solutions presently available do not provide adequate support for these diverse ways that IoT devices communicate with one another. The proposed Universal Acquisition and Analysis Tool (UAAT) creates a single comprehensive forensic environment in which IoT evidence can be collected, analyzed regarding the specific protocols with which the evidence was created, tracked through a cryptographic chain-of-custody, threat analyzed through machine learning techniques, and have reports generated automatically within a single deployable Java-based application (i.e., can run on any machine irrespective of OS and Hardware). The UAAT was developed using a Design Science Research (DSR) methodology and tested using the IoT-23 and CICIDS2017 benchmarks within a laboratory setting. Native and/or parallel support for the widely used IoT communications protocols of MQTT, CoAP, HTTP and TCP was added via the use of the Kafka streaming platform, as well as a protocol-based parser engine; results indicate that the UAAT was able to achieve 95% protocol compatibility, maintain an ingest throughput of 6.8 logs/second, and produced an F1 score of 96.38% for the random forest during the classification of simulated threats test case. The SHA-256 chain-of-custody engine for the UAAT identified all simulated evidence tampering instances across 1,423 records.
References
[1] Ab Rahman, N. H., Glisson, W. B., Yang, Y., & Choo, K. K. R. (2016). Forensic-by-design framework for cyber-physical cloud systems. IEEE Cloud Computing, 3(1), 50–59. https://doi.org/10.1109/MCC.2016.5
[2] Agbedanu, P., & Jurcut, A. D. (2021). BLOFF: A blockchain-based forensic model in IoT. In Revolutionary applications of blockchain-enabled privacy and access control (pp. 59–73). IGI Global.
[3] Ahmed, A. A., Farhan, K., Jabbar, W. A., Al-Othmani, A., & Abdulrahman, A. G. (2024). IoT forensics: Current perspectives and future directions. Sensors, 24(16), 5210. https://doi.org/10.3390/s24165210
[4] Akinbi, A. (2023). Digital forensics challenges and readiness for 6G IoT networks. WIREs Forensic Science, 5(5), e1496. https://doi.org/10.1002/wfs2.1496
[5] Alenezi, A., Atlam, H., Alsagri, R., Alassafi, M., & Wills, G. (2019). IoT forensics: A state-of-the-art review, challenges and future directions. In Proceedings of the International Conference on Complexity, Future Information Systems and Risk (COMPLEXIS) (pp. 106–115).
[6] Ariffin, K. A. Z., & Ahmad, F. H. (2021). Indicators for maturity and readiness for digital forensic investigation in era of Industrial Revolution 4.0. Computers & Security, 105, 102237. https://doi.org/10.1016/j.cose.2021.102237
[7] Atlam, H. F., Hemdan, E. E. D., Alenezi, A., Alassafi, M. O., & Wills, G. B. (2020). Internet of Things forensics: A review. Internet of Things, 11, 100220. https://doi.org/10.1016/j.iot.2020.100220
[8] Castelo Gómez, J. M., Roldán-Gómez, J., Ruiz-Villafranca, S., & del Amo Mínguez, Á. (2024). Forensic analysis of the IoT operating system Ubuntu Core. Computing and Informatics, 43(3), 529–560.
[9] Chernyshev, M., Baig, Z., Bello, O., & Zeadally, S. (2018). Internet of Things forensics: The need, process models, and open issues. IT Professional, 20(3), 40–49. https://doi.org/10.1109/MITP.2018.032501747
[10] Conti, M., Dehghantanha, A., Franke, K., & Watson, S. (2018). Internet of Things security and forensics. Future Generation Computer Systems, 78, 544–546.
[11] Dizdarević, J., Carpio, F., Jukan, A., & Masip-Bruin, X. (2019). A survey of communication protocols for Internet of Things. ACM Computing Surveys, 51(6), 116. https://doi.org/10.1145/3292674
[12] Friedl, S., & Pernul, G. (2024). IoT forensics readiness—Influencing factors. Forensic Science International: Digital Investigation, 49, 301768.
[13] Grispos, G., Tursi, F., Choo, K. K. R., Mahoney, W., & Glisson, W. B. (2021). A digital forensics investigation of a smart scale IoT ecosystem. arXiv. https://arxiv.org/abs/2109.05518
[14] Hevner, A. R., March, S. T., Park, J., & Ram, S. (2004). Design science in information systems research. MIS Quarterly, 28(1), 75–105.
[15] Hossain, M., Karim, Y., & Hasan, R. (2018). FIF-IoT: A forensic investigation framework for IoT using a public digital ledger. In Proceedings of the IEEE International Congress on Internet of Things (ICIOT) (pp. 33–40).
[16] International Organization for Standardization. (2012). Guidelines for identification, collection, acquisition, and preservation of digital evidence (ISO/IEC 27037:2012).
[17] Janarthanan, T., Bagheri, M., & Zargari, S. (2021). IoT forensics: An overview of the current issues and challenges. In Digital forensic investigation of IoT devices (pp. 223–254). Springer.
[18] Kebande, V. R., & Ray, I. (2016). A generic digital forensic investigation framework for IoT. In Proceedings of the IEEE International Conference on Future Internet of Things and Cloud (FiCloud) (pp. 356–362).
[19] Kumar, G., Saha, R., Lal, C., & Conti, M. (2021). Internet-of-Forensic (IoF): A blockchain-based digital forensics framework for IoT applications. Future Generation Computer Systems, 120, 13–25.
[20] Li, S., Choo, K. K. R., Sun, Q., Buchanan, W. J., & Cao, J. (2019). IoT forensics: Amazon Echo as a use case. IEEE Internet of Things Journal, 6(4), 6487–6497.
[21] Lutta, P., Sedky, M., Hassan, M., Jayawickrama, U., & Bastaki, B. (2021). The complexity of Internet of Things forensics: A state-of-the-art review. Forensic Science International: Digital Investigation, 38, 301210.
[22] Mahmood, Z., Khan, M. Z. A., Alshamrani, S. S., Almusallam, N., & Ud-Din Khan, Z. (2024). Comparative study of IoT forensic frameworks. Forensic Science International: Digital Investigation, 49, 301748.
[23] Mazhar, M. S., et al. (2022). Forensic analysis on IoT device using M2M framework. Electronics, 11(7), 1126.
[24] Mekala, S. H., Baig, Z., Anwar, A., & Syed, N. (2024). Standardizing industrial IoT forensic processes. Security and Privacy, 7(3), e485.
[25] National Institute of Standards and Technology. (2006). Guide to integrating forensic techniques into incident response (NIST Special Publication 800-86).
[26] Peffers, K., Tuunanen, T., Rothenberger, M. A., & Chatterjee, S. (2007). A design science research methodology for information systems research. Journal of Management Information Systems, 24(3), 45–77.
[27] Perumal, S., Norwawi, N. M., & Raman, V. (2015). IoT digital forensic investigation model: Top-down forensic approach methodology. In Proceedings of the IEEE International Conference on Digital Information Processing and Communications (ICDIPC) (pp. 19–23).
[28] Saleh, M. A., Othman, S. H., Al-Dhaqm, A., & Al-Khasawneh, M. A. (2021). Common investigation process model for IoT forensics. In Proceedings of the IEEE International Conference on Smart Computing and Electronic Enterprise (ICSCEE) (pp. 84–89).
[29] Statista. (2023). Number of IoT devices worldwide 2023–2030.
[30] Stoyanova, M., Nikoloudakis, Y., Panagiotakis, S., Pallis, E., & Markakis, E. K. (2020). A survey on the IoT forensics. IEEE Communications Surveys & Tutorials, 22(2), 1191–1221.
[31] Zawoad, S., & Hasan, R. (2015). FAIoT: Towards building a forensic architecture for IoT. In Proceedings of the IEEE International Conference on Services Computing (SCC) (pp. 279–284).
[32] Admass, W. S., Munaye, Y. Y., & Diro, A. A. (2024). Cyber security: State of the art, challenges and future directions. Cyber Security and Applications, 2, 100031.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 International Journal of Research and Applied Technology (INJURATECH)
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
