# Forensic Analysis on Internet of Things (IoT) Device Using Machine-to-Machine (M2M) Framework
## 1 Introduction
Forensic analysis refers to the deep investigation of the crime after it happened to explore the reasons behind the crime such as an offender, reasons, and ramifications of a security incident [20]. It is closely related to Security Incident Management (SIM) [21] in which the identification of the security events is performed on the computer network and then reasonable steps are performed to meet the limitations of the security principles that are compromised. Forensics analysis also differs from network auditing [22] because auditing is the pre-analysis of the vulnerabilities in a network and forensic analysis is the post-analysis of the security breaches that document how and when something occurred. In this framework, data acquisition limitation is resolved by a third-party logging server. IoT devices traffic is redirected to a logging server, where logs and alerts of malicious attack traffic are generated and stored to be used in forensic analysis. These stored logs are regenerated and analyzed in a forensic server to gather information about attacks and attackers. This attack detection is automated through a machine learning approach using a dataset generated from these logs. Generic forensic analysis process has four steps: data acquisition, examination, analysis, documenting and reporting [23]. In data acquisition [24], data related to a specific attack are collected. Because of the limitation of low processing power of IoT devices, data acquisition was the major problem. No evidence was found in the case of attacks. This problem is resolved by our proposed system by introducing the logging server which used snort for the detection of attacks and stores the logs of malicious traffic and also generate alerts. In the examination, collected data are processed to extract relevant pieces of information. An IP table is used for redirection of the traffic in IoT device configuration. Snort logging server uses logs written for the specific attacks and incorporates them into the detection engine. When traffic is redirected to a server, only the relevant information is extracted, and the rest of the packets are discarded. The extracted data are subjected to analysis in order to obtain more helpful information. Forensic server security onion provides the details of inspection when logs captured by the logging server are regenerated. Security onion provides attackers details, attack type, source port, destination port, and a good deal of other information. Snort also provides the alerts of these attacks. This inspection provides all necessary information to find out the attacker and damage occurred by these attacks. In documenting and reporting, results of the analysis are generated. Future forensic operations should take into account the lessons learned during the forensic procedure [25]. The proposed framework is incorporating both the machine learning model and forensic tools, which will be helpful in IoT forensic investigation. Security onion, which is a forensic server, also generates a new alert for any malicious traffic resides in the network by sniffing mode and helps to write rules for the attack detection. These attack rules can then also be incorporated in our proposed system. Machine learning provides the automated attack detection. After these, multiple reports are generated which describe the details about the type of attack and the number of times an attack was launched and the recommended action that could be taken. This forensic detail will help to draw the complete attack scenario and make the tracing of attackers possible. The scope of this research is to detect cyberattacks on IoT devices using a forensic analysis of the logs of these devices. For the detection of an attack, we used different forensics tools and machine learning techniques. The major contributions of this research are listed below:  
1. Extending existing methods for extracting and examining traces from IoT devices. 2.