# Smart Digital Forensic Readiness Model for Shadow IoT Devices
## 3 Conceptual Model for Digital Forensic Readiness in Shadow IoT Devices
### Stage C: Shadow IoT Device Monitoring  
The monitoring of the detected devices is of key importance to the enterprise network as it is unclear whether the connected shadow devices are rogue or not. The flow diagram for the shadow IoT device monitoring is presented in Figure 4. Every shadow IoT device is treated as a potential threat to the organization as it may violate the organization's security policy or potentially perform an untraceable criminal act. The activities of shadow IoT devices are short-lived and will become untraceable if not monitored and logged immediately. Once the shadow IoT devices have been identified and some potential evidence was gathered as discussed in the previous section, it is essential that these devices be monitored. The researcher divided the process of device monitoring into three parts which include feature analysis (step 9), traffic analysis (step 10) and behaviour monitoring (step 11). To monitor these devices, the features of the shadow IoT devices are obtained via a number of processes depicted in the feature analysis function (step 9). These processes are presented in more detail in Section 3.3.1. At the end of the feature analysis stage, a test is carried out to confirm if the features introduced by the shadow IoT device are acceptable to the enterprise network (step 9i). The details of steps 9a-i are discussed in Section 3.3.2. If the features (packet length, packet statistics, protocol used and packet count among others) are not acceptable, they are captured as potential digital evidence (step 9j). Once all the PDE has been captured, it is sent to stage D (step 12) which follows through to stage F (step 14). The same process as discussed in Section 3.1 is followed for purposes of evidence logging and for future reference. If the features are acceptable, the shadow IoT device is passed to the traffic analysis stage (step 10), which involves a number of processes presented in this paper as steps 10a-f. Next, the traffic pattern is inspected (step 10d) to check if all activities are in line with the enterprise network policy. If not, such activity is flagged as shadow activity (step 10e) and all the PDE that it presents (i.e., the packet size, packet content and protocol used) is captured (step 10f). All this PDE is sent to stage D (step 12), which follows through to stage F (step 14). The same process as discussed in Section 3.1 is again followed for the purpose of evidence logging, secure storage and future reference. Moving forward, all rogue devices are automatically disconnected from the enterprise network. However, if the traffic pattern successfully passes the enterprise policy test (step 10d), it is allowed to move on to the behaviour monitoring component (step 11). Just like the feature analysis and traffic analysis components, the behaviour monitoring component involves a number of steps (11a-g) that are further presented in Section 3.3.3 of this paper. The model also determines whether there is communication of any kind among shadow devices on the network (step 11c). Every communication by a shadow device with another device on the network is suspected to be an activity that might be criminal in nature, hence all such activities are logged for further analysis. For every communication, PDE is captured as indicated in step 11g. Thirteen (13) PDE artefacts are gathered at this stage which are packet length statistics, used protocol, total packet count, packet size, packet content, shadow device name, IP address, MAC address, source and destination frequency, periodicity, data exchange type, and data volume. Thereafter, all captured PDE is sent to stage D (step 12) which follows through to stage F (step 14). Again, the same process is followed (as discussed in Section 3.1) for the purpose of evidence logging and future reference. Otherwise, the SIoTDFR model process follows a cyclic pattern that returns to the feature analysis step (step 9) until the shadow IoT device logs off the enterprise network.