Towards Forensics Investigation of Blockchain-based Healthcare Applications

AbstractBlockchain, an emerging technology benefits the new technological world from its features such as immutability, transparency, and decentralization. The diversity of its domain is from e-commerce, health care, real estate, and enterprise to NFT markets, voting, and digital currency trading. The underlying blockchain features make auditing blockchain applications a challenging task. In this paper, we thoroughly analyze the general challenges faced in blockchain forensics, application-specific challenges, and challenges with respect to public and private blockchains. The aim of this paper is to highlight the challenges faced during the forensics of blockchain-based applications. For this, we took a healthcare system, introduced a contract vulnerability in it, and defined two scenarios for attack depending on that vulnerability. One that allows an attacker to make a malicious transaction directly and the other in which the attacker first gives itself access and then adds malicious transactions. The attacks are generated just to analyze the difficulty level of forensics in blockchain applications. To achieve our goal, we performed log analysis for both scenarios and specified the challenges faced during the analysis. Our experiment shows that due to some blockchain-specific features such as anonymity, identification of malicious entities in the system sometimes becomes a hectic challenge. This research benefits the auditors by highlighting the forensics challenges and auditing issues so they can work on these areas to identify the attackers and illegal data modifications accurately in blockchain applications. Experimental results confirmed that our proposed technique enabled efficient forensics investigation of events inside blockchain-based healthcare applications.Keywords: Auditingblockchaindigital forensics Disclosure statementNo potential conflict of interest was reported by the author(s).Additional informationFundingThe research work is supported by the Department of Software Engineering, NED University of Engineering and Technology.Notes on contributorsFarzeen ZehraFarzeen Zehra is an undergraduate final year student of software engineering at NED University of Engineering and Technology. She is among the top five students on the merit list. She is a web developer and has expertise in backend development. She also possesses a keen interest in research. She conducted research on different topics related to blockchain, and software testing. Her aim is to become a professional in her field. Email: farzeenzehra.fz@gmail.comMaha JavedMaha Javed is an undergraduate student of NED University of Engineering and Technology currently enrolled in her final year of software engineering. She received her matriculation certificate from Federal Board and completed her intermediate from Karachi Board with A + grade. She has excellent writing skills. She is a full-stack developer. She has expertise in front-end development. She is always looking for better skills-enhancing opportunities. Email: mahajaved986@gmail.comMuhammad Faraz HyderMuhammad Faraz Hyder received a PhD degree in Computer Engineering with specialization in Cybersecurity from NED University of Engineering in 2020. He has 18 years of experience in the industry, academics, and research centers. His areas of research include cybersecurity, moving target defense, cloud security, software defined networking, network function virtualization, network and information security, privacy, and digital forensics. He is also currently serving as Co-PI National Center for Cybersecurity, NEDUET. Corresponding author. Email: farazh@neduet.edu.pk DarakhshanDarakhshan is an undergraduate student of software engineering at NED University of Engineering and Technology currently studying in final year. She completed her Intermediate from Karachi board with 8th position. Her side of interest is full-stack development. She is a proficient backend developer and also possesses an interest in learning graphic design. She aims to polish her professional skills. Email: darakhshan704@gmail.comSheikh Muhammad Ahsan TariqSheikh Muhammad Ahsan Tariq is a final year student of software engineering at NED University of Engineering and Technology. He completed his intermediate from Adamjee Government Science College with A1 grade. He is a full stack developer who got 10 months of training from Saylani Mass IT Training (SMIT) in the domain of Web and Mobile hybrid App Development and obtained 3rd position in the final hackathon among 500 students. His area of interest in this field includes artificial intelligence, web development, and blockchain. Email: ahsantariq792@gmail.com