# Research on Digital Forensics Analyzing Heterogeneous Internet of Things Incident Investigations
## 2 Related Work
### Internet of Things Services and Threat  
The integration of IoT into modern technological paradigms entails a symbiosis of varied components, including services, platforms, networks, and devices, collectively enhancing the functionality of daily life systems [9]. These services, encompassing applications from personal smart-home systems to industrial manufacturing processes, are underpinned by platforms that harness advanced technological capabilities like artificial intelligence (AI) and big data [10; 11]. Such platforms are instrumental in processing and managing the extensive data flow emanating from IoT devices, thereby ensuring their optimized operation. Networks, incorporating both wireless and wired communication modalities, constitute the fundamental infrastructure for uninterrupted device connectivity. At the heart of these IoT applications lie the devices themselves, outfitted with sensors and actuators, and ranging broadly from personal wearable health monitors to industrial automated machinery [12; 13; 14].  
The realm of IoT services can be divided into private, public, and industrial segments, each addressing distinct needs and presenting unique challenges. Private sector services primarily augment personal convenience and lifestyle quality, whereas public sector services, often government-led, address broader societal concerns such as public safety and environmental surveillance. Conversely, industrial sector services are business-oriented, focusing on augmenting efficiency and a competitive edge [15]. These diverse applications, as outlined in Table 1, highlight the expansive nature of IoT and emphasize the need for customized strategies in both technological advancement and cybersecurity.  
In the domain of IoT, threats can be categorized into three primary types: software-based, network-based, and hardware-based threats. Each category represents a unique facet of IoT vulnerabilities, and these often interlink, leading to amplified risks and more complex attack scenarios [16].  
Software-based threats in IoT predominantly target the application layer of these systems. These attacks bear resemblance to traditional attacks in standard IT environments and typically involve well-established types of cyber attacks, often executed through automated tools. The consequences of such attacks can be severe, including unauthorized access to critical data and control over IoT devices and services.  
Network-based threats aim at exploiting weaknesses within the IoT system's network infrastructure. IoT devices use a mix of wired and wireless communication technologies. Attacks in this category can disrupt or intercept communication channels, potentially leading to unauthorized data access or alteration of data during transmission.  
Hardware-based threats leverage security lapses present in the physical components of IoT systems. These attacks necessitate physical access and a sophisticated understanding of the hardware's design and components. They can expose sensitive information not accessible via software-based methods and can alter the operation of connected devices. This includes the theft of encryption keys and taking control over system operations.