# ForCyRange: An Educational IoT Cyber Range for Live Digital Forensics

Sabrina Friedl, Magdalena Glas, Ludwig Englbrecht, Fabian Böhm, Günther Pernul

<figure><img src="image_1.png" /></figure>

## To cite this version:

Sabrina Friedl, Magdalena Glas, Ludwig Englbrecht, Fabian Böhm, Günther Pernul. ForCyRange: An Educational IoT Cyber Range for Live Digital Forensics. 15th IFIP World Conference on Information Security Education (WISE), Jun 2022, Copenhagen, Denmark. pp.77-91, 10.1007/978-3-031-08172-9_6. hal-05311509

HAL Id: hal-05311509

https://inria.hal.science/hal-05311509v1

Submitted on 13 Oct 2025

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_2.png" /></figure>
<figure><img src="image_3.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# ForCyRange: An Educational IoT Cyber Range for Live Digital Forensics

Sabrina Friedl✉, Magdalena Glas✉, Ludwig Englbrecht✉, Fabian Böhm✉, and Günther Pernul✉

University of Regensburg, Universitätsstraße 31, 93053 Regensburg, Germany
{Sabrina.Friedl, Magdalena.Glas, Ludwig.Englbrecht, Fabian.Boehm, Guenther.Pernul}@ur.de
https://go.ur.de/ifs

**Abstract.** The Internet of Things (IoT) is finding increasing application in different areas, whether for private users or in industrial plants. The IoT increases the attack surface for Advanced Persistent Threats (APT)s due to insufficiently secured IoT devices and networks. The heterogeneous structure of the IoT poses several new challenges for the application of IoT forensics (IoTF). Due to limited resources and storage capacity on the devices, the application of traditional forensics is not possible. Therefore, the nature of these IoT devices urges forensic experts to extract and analyze possibly relevant data in a real-time manner from running devices by applying Live Digital Forensics (LDF). Although LDF investigations are not commonly applied in the IoT context yet, IoTF could benefit largely from a combined arms approach with LDF. Thus, security experts with sufficient skills and knowledge will be required to perform such procedures. Addressing the challenge to equip future forensic experts with these skills and knowledge, we propose a concept for an educational IoT Cyber Range for LDF for postgraduate cybersecurity learners. For a realistic learning experience, we outline the simulation of a simplistic, underlying IoT system. In order to create an environment that is as realistic as possible, we describe an illustrative scenario that serves as a motivational story. Following the scenario, learners carry out several tasks of an IoTF investigation for solving the scenario.

**Keywords:** IoT forensics · Live Digital Forensics (LDF) · Cybersecurity · Cyber range · Digital forensics · Internet of Things (IoT)

## 1 Introduction

The IoT connects billions of devices, enabling them to collect or transfer data and communicate with each other [19]. As of 2019, the total number of IoT devices is estimated at around 10 billion and is projected to jump to an amount of 30.9 billion connected IoT devices worldwide by 2025 [10]. This development,
in combination with the nature of the applied IoT environments, poses several challenges to performing digital forensic investigation within an IoT network [21]. Examples of these challenges are vastly heterogeneous devices and highly fuzzy network delineations. However, the need to carry out forensic investigations is demonstrated by the ever-increasing amount of cyberattacks and especially of targeted and professional APTs. As these are often combined with some types of fileless malware, the investigations of an incident within an IoT environment have to be performed in real-time. Especially due to the specific features of IoT devices, such as limited resources and the fact that running devices cannot be switched off, the application of LDF is particularly useful. Thus, methods and techniques from the context of LDF are applied to understand what is happening on a running system and extract valuable data that would have been lost otherwise [22]. Generally, conventional devices are more secure than IoT devices due to traditional security practices. In addition, IoT devices need to be smaller and more compact for their intended uses, leaving less space for security defenses. These are reasons for the drastic increase in the IoT attack surface [15].

The involvement of IoT devices in crimes confirms the necessity for IoTF. To carry out investigation in the IoT, experts need a specific set of skills and knowledge. As stated in the ISACA report from 2021 [11], organizations worldwide face problems recruiting qualified cybersecurity experts. DF experts represent a portion of the available cybersecurity experts and are thus available in even smaller numbers.

There are various ways to introduce new content to cybersecurity learners in a comprehensible way, e.g., a lecture, a workshop [9], or a cyber range [23]. While traditional lectures rely on theoretical knowledge transfer, workshops and cyber ranges present new ways of experiential learning, directly integrating the learners. Cyber ranges are particularly useful for understanding and learning how to deal with cybersecurity incidents by visualizing the learning environment and guiding the learner through a use case scenario [16].

As outlined above, the specific characteristics of IoT devices make it difficult to apply conventional forensic analysis. Thus, an IoT environment is a particularly illustrative use case to show learners, who are new to digital forensics, what LDF is and how to apply it. In this paper, we strive to investigate the potential of cyber range training for this matter, addressing the following research question:

**RQ. How can learning and training for Live Digital Forensic investigations be supported by an educational IoT cyber range?**

We propose a concept for a cyber range for IoTF training which is based on a simulation of a simple IoT system. For the LDF investigation, we include a visual decision-support tool into the cyber range to allow a visual perception of the system's behavior under attack as well as a set of forensic tools to perform the actual investigation.

The remainder of this work is structured as follows. Section 2 provides a selection of definitions that are relevant for understanding the present publication. Further, an overview of related work regarding similar concepts is offered.
In Sect. 3, the developed concept is laid out and explained in detail. Following, Sect. 4 provides an illustrative scenario with three incidents that reflect the three fundamental objectives of information security (confidentiality, availability, integrity). Finally, Sect. 5 concludes the concept and gives an outlook on future work.

## 2 Background and Related Work

In this section, we explain terms that serve as a basis for understanding the paper and within applied approaches. In addition, a brief overview of related work in the area of learning environments for forensic investigations in conjunction with cyber ranges is provided.

### 2.1 Internet of Things (IoT)

The term IoT was coined in 1999 by K. Ashton [12]. Since then, it has been applied to various connected devices in different settings, like consumer, domestic, business, and industry [20]. Dorsemaine et al. [7] define the IoT as a “group of infrastructures, interconnecting connected objects and allowing their management, data mining and the access to data they generate” including objects/things that are “sensor(s) and/or actuator(s) carrying out a specific function that are able to communicate with other equipment” [7]. IoT technologies can be utilized in various application areas, for example, smart homes, smart cities, or smart manufacturing and agriculture [4]. In general, an IoT environment is divided into three zones, (1) *Cloud* (e.g., public, hybrid, private), (2) *Network* (e.g., cellular, industrial, mesh), and (3) *Devices* (e.g., sensors, wearables). At the basis of the IoT architecture, the devices produce or collect data, send it over a network into the cloud, where the data is aggregated, sorted, and processed. The processed data is then made available for users (e.g., private persons) and provides insights into communication between IoT devices [26].

### 2.2 Digital Forensics, IoT Forensics and Live Digital Forensics

Digital Forensics (DF) is a sub-area of classic forensics [8]. In DF, processes and events on IT systems are investigated in relation to criminal offenses in order to obtain digital evidence that is legally permissible [14]. IoTF is based on DF and is first defined by Oriwoh et al. in 2013 [18] with three zones (internal network, middle, outside/external network). This concept is then further specified by Zawoad et al. (2015) [26], who define IoTF according to the structure of an IoT environment as a composite of three forensic types, (1) *Cloud Forensics*, (2) *Network Forensics*, (3) *Device Level Forensics*. Stoyanova et al. (2020) [21] then provide a fourth forensic type, valuable in IoTF, (4) *Live Digital Forensics (LDF)*. LDF, also known as dynamic analysis, describes a Real-Time System (RTS) and is subordinate to IoTF and DF. In LDF, data is collected while the system is still running. This practice provides additional contextual information that is otherwise lost when collecting data after a system shut-down [1].
## 2.3 Cyber Ranges

In the field of cybersecurity training, the concept of experiential learning in cyber ranges has gained attention in recent years [25]. The term cyber range refers to an environment that replicates parts of an organization's digital infrastructure (e.g., networks, tools, or applications) to perform realistic cybersecurity training and testing [16]. The concept emerged from the military sector, where it was derived from the term shooting range [6], providing the possibility to conduct target practice in a safe and isolated space. Thus, a cyber range enables learners to experience cyber attacks and practice cybersecurity defense strategies in a realistic way without harming the operating system they are trained for. This replication of virtual environments is not limited to Information Technology (IT) but can also include Operational Technology (OT) devices, either simulated or even in the form of actual hardware [25].

Yamin et al. [25] present a taxonomy for cyber ranges that allows to comprehensively classify cyber range concepts. The six domains of the taxonomy are briefly described hereafter. While the term cyber range refers to the virtual environment itself, a cyber range exercise is a specific training or testing activity conducted on the cyber range. The **scenario** describes the context and storyline for such an exercise. A cyber range may hold multiple scenarios that can be repeatedly performed on the cyber range in the course of exercises. **Learning** comprises tutoring and scoring elements of the cyber range, commonly included in a Learning Management System (LMS), presenting the tasks learners need to solve within the training and complementary learning material. The **environment** of a cyber range is the technical topology in which a scenario is executed. The **teaming** aspect of a cyber range refers to assigning different roles to the people involved in a cyber range exercise. As commonly used in cybersecurity exercises, a Red Team is assigned the task to exploit vulnerabilities of a system while a Blue Team is responsible for its defense. Further roles, yet less commonly used, are a White Team managing the overall exercise and a Green Team maintaining the cyber range infrastructure. **Management** of a cyber range exercise incorporates the organization of both the cyber range infrastructure and the learner interacting with it. **Monitoring** describes which mechanisms are applied to monitor the state of the technical infrastructure and the learners' actions during the exercise.

## 2.4 Related Work

Related work focuses on the one hand on the application of cyber ranges in or for digital forensics. On the other hand, a workshop concept with a serious-game approach to learn forensic procedures is closely related to this topic.

Vykopal et al. [24] propose the KYPO cyber range, which provides complex cyber systems and networks in a virtualized, fully controlled, and monitored environment. Due to the use of cloud resources, the deployment is time- and cost-efficient. KYPO is accessed via a web browser at every stage of the virtualized network lifecycle. Starting from the preparation and configuration of artifacts
to the deployment, instantiation and operation. It allows users to focus on the desired task and provides a hands-on platform for cybersecurity courses and training. A few of the important features are the training scenarios for malware forensics, network security, and penetration testing.

Leitner et al. [13] present the AIT Cyber Range that is designed on the principles of scalability, flexibility, and utilization of open source technologies. Therefore, they implemented an architecture comprised of a computing platform, infrastructure- and software-provisioning and a scenario engine. They describe various sectors in which the training content is presented. In this way, the authors aim to contribute to the general understanding and exchange of information on the design and use of cyber ranges.

Blauw and Leung [2] describe an adventure workshop called ForenCity, which takes the form of a web-based scavenger hunt based on the serious-game approach. In this game, users have to apply their knowledge in digital forensics and process digital evidence in both the virtual and physical worlds. Thereby, the authors created an environment with augmented physical items and spaces at their institution's campus. Virtual characters guide the users through a police investigation that develops further while they engage with physical and virtual properties around them.

The previously discussed work addresses a lack of skilled cybersecurity analysts and cyber ranges as well as the challenges of doing LDF investigations in an IoT scenario. Vykopal et al. [24] and Leitner et al. [13] describe cyber ranges with a possible forensic application but without a detailed implementation based on a use case. Contrary, Blauw and Leung [2] describe the use case in-depth but they do not use a cyber range as an underlying basis. To the best of our knowledge, the aforementioned work does not focus on the application of LDF investigation in an IoT environment and the training of forensic analysts and learners with a cyber range. To address this research gap, we propose *ForCyRange*, a conceptual approach of a cyber range encompassing a virtual learning environment guiding through an IoTF scenario.

# 3 ForCyRange Concept

To ensure the adequacy of an educational cyber range, it is crucial to precisely define the target group it addresses, as well as the skills and knowledge it aims to impart [17]. For this reason, the target group and learning objectives of For-CyRange will be outlined in the following before proposing the design of the cyber range.

## 3.1 Target Group and Learning Objectives

*ForCyRange* aims to provide a practical introduction to LDF. In doing so, it targets individuals who are not yet working as forensic analysts but aspire to do so in the future. Since LDF is a complex process, learners are required to have some prior knowledge in cybersecurity and related concepts. Thus, the
target group of the concept are postgraduate learners with a background in cybersecurity. Training for this target group can be part of both organizational training for employees or a curriculum for cybersecurity at a higher education institution.

With this target group in mind, we define the following learning objectives. These can be seen as overarching goals to be achieved by the concept and shall serve as a guideline for the design of training scenarios.

- **LO1:** Understand the purpose and goal of LDF investigations.

- **LO2:** Learn typical components and procedures of LDF investigations.

- **LO3:** Develop and enhance soft skills required by an analyst during an LDF investigation.

- **LO4:** Identify anomalies and secure the associated digital traces.

LO1 and LO2 describe the transfer of *knowledge* about LDF. LO3 targets LDF-relevant *soft skills* that can be trained in the cyber range. This ranges from decision-making under time pressure to effective collaboration in a team of forensic analysts. These objectives shall be pursued by any scenario executed on the cyber range. LO4, on the other hand, refers to the *hard skills* one should acquire in the course of the training. As these skills highly rely on the tools and technical environment used within a scenario, LO3 can be further specified for each scenario. Depending on the design of a scenario, these learning objectives can be supplemented by others. For example, it is conceivable to design a scenario in a way that it also imparts knowledge about the IoT system in scope.

## 3.2 Proposed Design

*ForCyRange* is characterized by a flexible design that allows creating diverse scenarios within the cyber range. The cyber range concept contains different roles and components. We define the two roles *Trainer* and *Trainee*. The former oversees and manages the training. The latter participates in the training in the role of a forensic analyst. The four technical components are (1) an *IoT System Simulation*, (2) a *Middleware* for data processing, storage, and transmission, (3) a *Forensic Workstation*, and (4) a *Learning Management System*. The concept is illustrated in Fig. 1 and is detailed in the following.

**Forensic Analyst (Trainee):** The Trainee interacts with the cyber range over a web-based user interface containing the Forensic Workstation and the Learning Management System. Each Trainee is provided with their distinct cyber range instance consisting of the four technical components described above. The role of the Trainee does not necessarily have to be taken on by an individual but by a small group of participants jointly solving the tasks.

**Trainer:** One or more Trainers are responsible for the design and implementation of the scenario. Thereby, scenarios can be automated so that the Trainer does not need to interfere with the environment during the training but only monitors the Trainees and the technical environment to intervene if problems
<figure><img src="image_4.png" /><figcaption>Fig. 1. Design of ForCyRange.</figcaption></figure>

occur, e.g., if the Trainee faces technical issues or has trouble understanding a
particular task.

**IoT System Simulation:** The network to be forensically examined in the training is a system of connected IoT devices. For the needs of the cyber range, an IoT system is simulated realistically and complemented with one or more cyber attacks whose traces are to be detected by the Trainee. This simulation is referred to as *IoT system* hereafter. The IoT system is equipped with a set of tools for data acquisition and monitoring of, e.g., network traffic, active processes, and file editing. Use cases represented with the IoT system can be manifold, ranging from a smart home or office setup like described in the illustrative scenario in Sect. 4 to the simulation of IoT system as part of a smart factory. The attacked IoT system produces real-time data during the training. This provides a realistic environment for the Trainee to explore and perform various forensic investigations.

**Middleware/Database:** A *Middleware* retrieves the raw data from the IoT devices. This allows to retrieve relevant data from the IoT system during an investigation without having to install and run the client of a data analysis tool on the IoT system. Several pre-processing steps required to analyze the data in the Forensic Workstation are performed on the middleware. The processed data is then stored in a database.

**Forensic Workstation:** The LDF investigation is performed on a *Forensic Workstation* consisting of a visual decision-support tool, hereafter referred to as *Visual Decision-Support Tool*, and a set of common forensic tools (*Forensic Tool Set*). LDF, performed on a running system, is characterized by the strong time pressure under which analysts need to make decisions. Böhm et al. [3] propose the usage of a tool for visualizing security-relevant data during a LDF investigation. This intends to support decision-making during the investigation and to assist the analyst, for example, in selecting the right forensic tool at the right time.
We follow this approach by integrating a Visual Decision-Support Tool into the investigation process performed by the Trainee in the cyber range training. As a central component of the Forensic Workstation, the Visual Decision-Support Tool visualizes the data produced by the IoT system during the attack. It supports the Trainee in identifying which aspects of the IoT system need to be analyzed further and which forensic tool is required for the particular issue.

**Learning Management System (LMS):** Throughout the investigation, the Trainees interact with a LMS, guiding them through the scenario. The LMS contains textual explanations, images, and videos to transfer the theoretical knowledge required for the investigation. On the one hand, this includes knowledge about goals (LO1) and established processes (LO2) in LDF, and on the other hand, information about the training scenario. The latter mainly includes a description of the IoT system and the impact the attack has on the devices. The skill learning aspect of the cyber range (LO4) considers the well-known theory of "flow" by Csíkszentmihályi et al. [5], which examines how to create a balance between the person's skills and the difficulty of an activity. This balance aims to provide a state of "flow" in which a person fully engages with an activity without being overwhelmed or frustrated. The authors propose that this state requires not only the appropriate skill set for a given task but also clear goals and immediate feedback for one's actions. For this reason, the LDF investigation is broken down into a sequence of tasks that the Trainee needs to solve using the Visual Decision-Support Tool and the Forensic Tool Set. Therefore, the individual tasks are explained in detail to the Trainee within the LMS. The trainees are closely guided which tool out of the given toolset is suitable for which of the analysis steps. As the training is aimed at trainees who are new to the field of digital forensics, we believe that this simplification compared to an actual forensic investigation is necessary in order not to overwhelm the trainees. The Trainee submits a solution in the form of a flag to the LMS, e.g., the number of a port over which an attack is executed. This way, the Trainee is set a sequence of clear and manageable goals receiving immediate feedback for every flag they submit. Setting a time limit for each task challenges the Trainees to make decisions under time pressure (LO3).

## 3.3 Classification of the Concept

The proposed ForCyRange concept is finally classified in Table 1 using the previously outlined taxonomy by Yamin et al. [25] to provide comparability to other cyber range concepts.

In summary, ForCyRange is a flexible concept for training LDF in a realistic IoT environment, enabling a Trainee to get a first practical insight into LDF. Thereby the Trainees learn to understand the challenges of LDF and how to tackle them. The IoT use case and the composition of the Forensic Workstation can be customized to the purpose of a specific training respectively target group. This allows designing scenarios that include specific systems, networks, and tools. Especially when the concept is used for organizational cybersecurity training,
<table><caption>**Table 1.** Concept description based on the taxonomy by Yamin et al. [25]</caption><thead><tr><td>Domain</td><td>Description</td></tr></thead><tbody><tr><td>Scenario</td><td>LDF investigation of an attacked IoT system using a Visual Decision-Support Tool and a Forensic Tool Set.</td></tr><tr><td>Environment</td><td>Simulated IoT system and a Forensic Workstation, connected by a Middleware</td></tr><tr><td>Learning</td><td>Trainee interacts with a LMS consisting of textual explanations, images, videos, and tasks, possibly enriched with gamification elements (e.g., scoring mechanism for flag submission)</td></tr><tr><td>Teaming</td><td>Blue Team: Trainee; Red Team: Automated; White Team/Green Team: Trainer</td></tr><tr><td>Management</td><td>Trainer implements the scenario, creates learning material for the LMS, and manages the technical infrastructure.</td></tr><tr><td>Monitoring</td><td>Trainer monitors infrastructure and the Trainee during the training, possibly partly automated</td></tr></tbody></table>

this offers the possibility of creating a training environment that is close to the type of systems and tools the Trainee will face in an actual forensic analysis in the future.

# 4 Illustrative Scenario: OutSmart-The-Burglar

A realistic scenario will demonstrate the application and capabilities of the For-CyRange concept. The scenario is an LDF investigation of a combined cyber-physical attack on a medical practice, inspired by a recent burglary in Austria<fnref n="1" />. The attack consists of three incidents, each incident covering one central aspect of cybersecurity, namely confidentiality, availability, and integrity (rf. Fig. 2). We first describe the general scenario and its technical environment before outlining the Trainee's learning process.

## 4.1 Storyline of the Scenario

A series of burglaries in a medical practice were reported, during which medical equipment worth € 3 million was stolen. The burglaries happened during the day, through a window facing the practice's backyard. When the theft was detected, police was immediately informed. The attackers were able to enter the building undetected (Incident 1). Thereby, no physical traces of burglary, e.g., broken windows, could be determined. The CCTV camera monitoring one of the videos was not working during the burglary, so it does not provide any evidence (Incident 2). It stands to reason that the Burglars gained access via the smart

<footnote n="1">¹ https://newsbeezer.com/aus triaeng/endoscopy-equipment-stolen-from-vienna-hospital/.</footnote>
control of the windows and doors (*Incident 3*), which are part of a smart home solution the practice uses to control doors, windows, ventilation, and lighting. Before resetting the devices, the cybersecurity experts involved consult a forensic expert (the Trainee) to preserve traces of the burglary. As the investigation happens while medical interventions are performed in the practice, the IoT network cannot simply be switched off as it also controls ventilation and lighting in the surgery- and treatment rooms. For this reason, an LDF investigation of the running system is necessary. The storyline of the LDF investigation is closely linked to the learning process of the scenario. Thus, it is described in Subsect. 4.3 along with the actions respectively tasks the Trainees need to perform in the course of the investigation.

<figure><img src="image_5.png" /><figcaption>**Fig. 2.** *OutSmart-The-Burglar*: sequence of incidents.</figcaption></figure>

## 4.2 Environment

The environment of the scenario is illustrated in Fig. 3. The IoT System Simulation consists of a Smart Door, a Smart Window, and a CCTV camera. The smart devices send status updates to a central IoT-Hub running the software OpenHAB<fnref n="2" /> for monitoring the status of the devices. A simulated malware is running on the IoT-Hub, enabling the virtual attackers to perform the three aforementioned incidents. For each of the three incidents, the Visual Decision-Support Tool assists the Trainee in the initial identification of the incident. For the Visual Decision-Support Tool running on the Forensic Workstation that the Trainee is using for their investigations, we propose to use the LDF visualization tool<fnref n="3" /> presented by Böhm et al. [3]. They state the need for conducting LDF investigations due to newly proliferating fileless malware and the challenging timely manner in which decisions during investigations have to be made. Therefore they developed a prototype that visually supports the decision-making process during LDF. The tool comes with several visualizations that enable the user to identify abnormal network traffic and file system activities. The Forensic Tool Set the Trainee is provided with consists of the tools Tcpdump<fnref n="4" /> and Wireshark<fnref n="5" /> for network traffic analysis and LogDNA<fnref n="6" /> for log analysis.

<footnote n="2">² https://www.openhab.org/.</footnote>

<footnote n="3">³ https://github.com/bof64665/LDF_ReactFrontend.</footnote>

<footnote n="4">⁴ https://www.tcpdump.org/.</footnote>

<footnote n="5">⁵ https://www.wireshark.org/.</footnote>

<footnote n="6">⁶ https://www.logdna.com/.</footnote>
<figure><img src="image_6.png" /><figcaption>Fig. 3. OutSmart-The-Burglar: scenario design.</figcaption></figure>

## 4.3 Learning

This subsection covers the sequence of tasks to be completed by the Trainee. As described in Sect. 3, the tasks are complemented by several learning units which impart theoretical knowledge. The tasks are not designed as a simple set of instructions to be followed by the Trainee. On the contrary, the training requires the Trainees to apply the theoretical knowledge they gain throughout the training to the actual use case and analytically determine possible courses of action - either individually or in discussions with other Trainees. If a Trainee is stuck on a particular task, they can request hints for the respective tasks within the LMS, which guide them closer to the solution. This is to avoid frustrating the Trainees and thus jeopardizing the aforementioned "flow" of the learning process.

**Incident 1 - Data Breach of Smart Door (Confidentiality):** The back door of the practice is equipped with a smart lock. It produces log data whenever the lock is opened or locked with a key card by one of the employees. The log file synchronizes with the IoT-Hub for central monitoring. Through a phishing attack, the attackers managed to install malware on the hub and thus control the IoT system. The malware produces a ZIP file of the door's log data every 20 min. The ZIP file is uploaded to the attackers' server via a web-based API. The analysis of this log data enables the attackers to obtain information about when no employees are present at the practice during the day. This allowed the attackers to plan at what time the burglaries could be performed without being detected.

At first, the Trainee needs to identify the process (► **Flag 1**) which creates the ZIP file and which external port (► **Flag 2**) it is uploaded to. This is achieved by detecting the process as an anomalous data flow in the visualization of the
Visual Decision-Support Tool. To investigate the incident in-depth, the Trainee uses Tcpdump to analyze the respective network traffic, which tells them the IP address of the attackers' server (► **Flag 3**). To retrieve more information about the attackers, the Trainee uses an IP location finder to determine the geographic location (► **Flag 4**) of the IP address. The trainees are informed that IP location finders sometimes provide incorrect information and that this information must therefore be carefully checked.

**Incident 2 - DoS Attack on CCTV Camera (Availability):** The attackers want to enter the medical practice unnoticed and attack the CCTV cameras installed on-site to do so. The burglars started a Denial of Service (DoS) attack on the cameras which are connected to the IoT-Hub. Thereby, the availability of the video material is threatened. On a normal day, the camera sends the video material ten times a day via a specific IP address to the linked cloud storage. However, if the attackers send numerous requests to the camera, the requests will no longer be processed, and the camera eventually freezes or stops working.

The Trainee now needs to investigate the cause of the CCTV cameras malfunction. Therefore, they use the Visual Decision-Support Tool to determine in which time period the connection load between the camera and external IP addresses rises in comparison to the traffic load before (► **Flag 5**). This way, the Visual Decision-Support Tool assists the decision to look further into the traffic load spike. The Trainee is provided with a LogDNA output to analyze log files in real-time. The logs are already filtered for the specific time period of a traffic spike. In the log dataset, the Trainee searches for keywords like "ERROR"/ "503" to find out or verify the root cause of the DoS attack (► **Flag 6**).

**Incident 3 - Manipulation of IoT-Hub Monitoring (Integrity):** In the next step of the burglary, the attackers follow the same goal, to enter the medical practice unnoticed. Through the monitoring feature of the IoT-Hub, the status of the smart windows (open/closed) is displayed. This enables observation and control from a distance on the IoT-Hub. To enter the practice unnoticed, the burglars use the malware on the IoT-Hub to bypass the alarm system on open windows. This means, the data displayed on the IoT-Hub does not represent the actual physical status of the window, whereby the break-in via the window is not evident from the data. Thereby, the integrity of the IoT-Hub is violated.

Finally, the Trainee needs to detect the file manipulation caused by the malware with the help of the Visual Decision-Support Tool and extract the manipulated file (► **Flag 7**). The analyzed output of the Visual Decision-Support Tool supports the decision to have a closer look at the likely manipulated file.

This way, the Trainee receives a pcap-file, which then should be analyzed with the tool Wireshark. Now, the Trainee should examine the given pcap-file and search for a possibly malicious file to extract and analyze it more deeply to understand the file change or manipulation (► **Flag 8**).
# 5 Conclusion and Future Work

To address the research question of this work, we propose ForCyRange, a conceptual design for an educational IoT cyber range focusing on LDF investigations. The concept enables the training of postgraduate cybersecurity learners in both academic and organizational contexts. We define two roles within the concept, the forensic analyst or Trainee and the Trainer. The Trainee performs an LDS investigation of an IoT system under attack by interacting with the cyber range over a web-based user interface. The Trainer is responsible for the design and implementation of the scenario and the complementing learning material. The underlying design we propose for ForCyRange consists of the four components (1) IoT System Simulation, (2) Middleware/Database, (3) Forensic Workstation, and (4) LMS, which build the technical foundation of the cyber range. These components can be flexibly configured, which allows the creation of diverse scenarios within the cyber range. To demonstrate the application of the concept and illustrate its capability, we present the scenario OutSmart-The-Burglar. In this scenario, Trainees perform an LDF investigation on a Smart Home IoT system using a set of open-source tools for LDF.

The concept's suitability regarding the transfer of LDF skills and knowledge is yet to be empirically verified. Thus, for future work, we pursue a prototypical implementation of ForCyRange with the illustrative scenario mentioned above. This prototype will be evaluated within a user study among postgraduate students and professionals. The evaluation should help determine the Trainees' learning progress and is envisioned as a knowledge survey of the topic before and after working on the scenario in ForCyRange. Furthermore, we want to extend the concept to include a more complex teaming structure., e.g., forensic analyst teams with different tasks and tool sets who need to collaborate to perform an LDF investigation successfully. This approach could make scenarios more diverse and reinforce soft skill development within the training.

**Acknowledgement.** This work is partly performed under the INSIST project, which is supported under contract by the Bavarian Ministry of Economic Affairs, Regional Development and Energy (DIK0338/01).

# References

1. Adelstein, F.: Live forensics: diagnosing your system without killing it first. Commun. ACM 49(2), 63–66 (2006)

2. Blauw, F.F., Leung, W.S.: ForenCity: a playground for self-motivated learning in computer forensics. In: Drevin, L., Theocharidou, M. (eds.) WISE 2018. IAICT, vol. 531, pp. 15–27. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-99734-6_2

3. Böhm, F., Englbrecht, L., Friedl, S., Pernul, G.: Visual decision-support for live digital forensics. In: IEEE Symposium on Visualization for Cyber Security, VizSec 2021, New Orleans, LA, USA, 27 October 2021, pp. 58–67. IEEE (2021)

4. Boyes, H., Hallaq, B., Cunningham, J., Watson, T.: The industrial internet of things (IIoT): an analysis framework. Comput. Ind. 101, 1–12 (2018)
5. Csikszentmihalyi, M., Csikszentmihaly, M.: Flow: The Psychology of Optimal Experience, vol. 1990. Harper & Row, New York (1990)

6. Davis, J., Magrath, S.: A survey of cyber ranges and testbeds. Technical report, Defence Science and Technology Organisation Edinburg (Australia) Cyber and Electronic Warfare DIV (2013)

7. Dorsemaine, B., Gaulier, J., Wary, J., Kheir, N., Urien, P.: Internet of things: a definition & taxonomy. In: Al-Begain, K., AlBeiruti, N. (eds.) 9th International Conference on Next Generation Mobile Applications, Services and Technologies, NGMAST 2015, Cambridge, United Kingdom, 9–11 September 2015, pp. 72–77. IEEE (2015)

8. Eckert, W.G.: Introduction to Forensic Sciences. CRC Press (1996)

9. Englbrecht, L., Pernul, G.: A serious game-based peer-instruction digital forensics workshop. In: Drevin, L., Von Solms, S., Theocharidou, M. (eds.) WISE 2020. IAICT, vol. 579, pp. 127–141. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-59291-2_9

10. IoT Analytics: Cellular IoT & LPWA Connectivity Market Tracker (2020). https://iot-analytics.com/state-of-the-iot-2020-12-billion-iot-connections-surpassing-non-iot-for-the-first-time/. Accessed 4 Apr 2022

11. ISACA: ISACA Report - State of Cybersecurity 2021, Part 1 (2021)

12. Kramp, T., Van Kranenburg, R., Lange, S.: Introduction to the Internet of Things. In: Enabling Things to Talk, pp. 1–10. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-40403-0_1

13. Leitner, M., et al.: AIT cyber range: flexible cyber security environment for exercises, training and research. In: Proceedings of the European Interdisciplinary Cybersecurity Conference. EICC 2020. Association for Computing Machinery, New York (2020). https://doi.org/10.1145/3424954.3424959

14. McKemmish, R.: What is forensic computing? Australian Institute of Criminology Canberra (1999)

15. Mishra, N., Pandya, S.: Internet of things applications, security challenges, attacks, intrusion detection, and future visions: a systematic review. IEEE Access 9, 59353–59377 (2021)

16. National Initiative for Cybersecurity Education (NICE): The cyber range: A guide. Technical report (2020)

17. Newhouse, W., Keith, S., Scribner, B., Witte, G.: National initiative for cybersecurity education (NICE) cybersecurity workforce framework. NIST Spec. Publ. 800(2017), 181 (2017)

18. Oriwoh, E., Jazani, D., Epiphaniou, G., Sant, P.: Internet of things forensics: challenges and approaches. In: Bertino, E., Georgakopoulos, D., Srivatsa, M., Nepal, S., Vinciarelli, A. (eds.) 9th IEEE International Conference on Collaborative Computing: Networking, Applications and Worksharing, Austin, TX, USA, 20–23 October 2013, pp. 608–615. ICST/IEEE (2013)

19. Rahman, M.S., Kabir, M.H.: A survey analysis and model development for Internet of Things (IoT) system for city buildings: Dhaka city, Bangladesh perspective. In: TENCON 2018–2018 IEEE Region 10 Conference, pp. 1229–1234. IEEE (2018)

20. Rose, K., Eldridge, S., Chapin, L.: The internet of things: an overview. The Internet Soc. (ISOC) 80, 1–50 (2015)

21. Stoyanova, M., Nikoloudakis, Y., Panagiotakis, S., Pallis, E., Markakis, E.K.: A survey on the Internet of Things (IoT) forensics: challenges, approaches, and open issues. IEEE Commun. Surv. Tutorials 22(2), 1191–1221 (2020)

22. Sudhakar, K.S.: An emerging threat Fileless malware: a survey and research challenges. Cybersecurity 3(1), 1 (2020)
23. Vielberth, M., Glas, M., Dietz, M., Karagiannis, S., Magkos, E., Pernul, G.: A digital twin-based cyber range for SOC analysts. In: Barker, K., Ghazinour, K. (eds.) DBSec 2021. LNCS, vol. 12840, pp. 293–311. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-81242-3_17

24. Vykopal, J., Oslejsek, R., Celeda, P., Vizváry, M., Tovarnák, D.: KYPO cyber range: design and use cases. In: Cardoso, J., Maciaszek, L.A., van Sinderen, M., Cabello, E. (eds.) Proceedings of the 12th International Conference on Software Technologies, ICSOFT 2017, Madrid, Spain, 24–26 July 2017, pp. 310–321. SciTePress (2017)

25. Yamin, M.M., Katt, B., Gkioulos, V.: Cyber ranges and security testbeds: scenarios, functions, tools and architecture. Comput. Secur. 88 (2020)

26. Zawoad, S., Hasan, R.: FAIoT: towards building a forensics aware eco system for the internet of things. In: 2015 IEEE International Conference on Services Computing, SCC 2015, New York City, NY, USA, 27 June – 2 July 2015, pp. 279–284. IEEE Computer Society (2015)