# Challenges of Network Forensic Investigation in Fog and Edge Computing
## 3 Related Work  
Fog and edge networks are used for different applications, thus resulting in various installations and techniques [18] like vehicular computing [19], mobility [20] or federated learning [21]. Edge and fog computing demand modern network infrastructures to interconnect the different devices and provide an ongoing connection between the network edge on the one side, the fog part as a middle-ware and the cloud on the other side. A discussion of techniques related to fog networks is presented in [5], discussing various network applications, ref. [22] with a special view on IoT, or [23], describing possible implementations in next-generation networks. Edge networks are discussed in [24] or [25], related to mobile edge networks. These networks differ from traditional and mostly static networks, e.g., [26] discusses application placement in such networks via machine learning. Whereas network forensic investigation in traditional networks is well-known [27; 28], dynamic and virtual environments like cloud environments differ from these static environments and raise new challenges. In [2], the authors discuss various challenges like multitenancy, internal dynamic of the environment and jurisdiction issues. In [29], the new challenges of fog computing are described with a special view on information security and digital investigation in these environments. Ref. [30] describes the use of software-defined networks (SDN) and fog computing to manage the network traffic in IoT environments. In [31], SDN is used to improve the handling of streams of big data in Industrial IoT environments. A discussion of forensic investigation in fog environments is performed in [32], describing the problem of finding the relevant evidences in fog environments, or [33], discussing the trusted recording of evidence in a distributed ecosystem with multiple trust domains. The new environments provide new techniques for forensic investigation. Ref. [34] presents FoBI, a fog-based IoT forensic framework, which helps to collect relevant data from IoT devices.  
In [35], forensics for fog computing are contrasted against cloud computing, but edge computing is not integrated. In contrast, ref. [36] considers forensics in edge networks with a focus on media transmission over 5G; similarly, ref. [37] considers them for smart homes. Both, however, do not consider the interference with fog and cloud computing. Edge forensics process over 5G is refined in [38] with the use of deep learning approaches, yet again seen without the other network parts. Ref. [39] concentrates on forensic evidence from devices in edge computing, while ref. [40] focuses on privacy-preserving forensics for offshore, i.e., low-bandwidth edge computing. Forensic challenges when connecting edge and cloud computing are discussed in [41], yet without looking at fog computing. None of these works consider all network parts together.  
Intrusion detection systems for fog and cloud computing are surveyed in [42]. While the focus is not on forensics and packet capture, and edge is only treated in the form of edge devices, some of the problems coming from the distributed nature of edge, fog and cloud networks are similar for intrusion detection and forensic capture.