# Forensic Analysis on Internet of Things (IoT) Device Using Machine-to-Machine (M2M) Framework
## 1 Introduction  
IoT is a system of interconnected devices that share resources and data securely when a connection with the Internet is established. In terms of less direct interaction with humans, a wider perspective, and expandable characteristics, the IoT supersedes all other traditional networks [1]. The pervasive utilization of IoT has facilitated the development of numerous inventions, including home automation, wearable technology, smart firefighting, smart metering, advanced manufacturing, and intelligent buildings [2]. IoT has made life easier for humans [3]. Despite the fact that IoT device applications are constantly evolving, IoT device security remains a limitation [4]. The manufacturers of IoT devices are more concerned withbringing new attractive features/functionalities and simplifying the design to make the devices smarter and more cost-effective than with making them secure [5]. In fact, numerous cyberattacks on IoT devices have occurred in recent years as a result of inadequate security measures [6]. The count of cyberattacks and IoT devices are both gradually increasing [7]. One of the most prevalent attacks on the IoT network is denial of service (DoS). According to Cisco's annual Internet study, DDoS cyberattacks are predicted to rise from 2018 to 2023. Figure 1 compares the number of possible DDoS attacks for each year [8]. It is also observed that DoS attacks on IoT are continuously increasing every year. It is reported by the Palo Alto Networks Unit 42 research team, the traffic of 98% of IoT devices is not encrypted which exposes the confidential data on network traffic and causes multi-level attacks [9] on the network and systems. When these vulnerable IoT devices are connected with the network, it increases the threat space for attackers. According to Kaspersky's research, 1.5 billion attacks on IoT devices have been reported in the first 6 months of 2021 [10]. Similarly, smart home IoT devices such as smart TVs, smart cameras, and other IoT devices share 25% of the compromised devices in a botnet attack [11]. By exploiting default credentials, the Mirai attack acquired control of thousands of IoT devices and launched a distributed DoS (DDoS) attack on major systems [12]. HP also reported that 70% of IoT devices are vulnerable [13]. As a result, IoT device vulnerabilities must be protected. IoT devices are not designed to be fully protected against counter vulnerability attacks [14]. A vulnerability is a loophole in a system that provides a fertile ground for cyberattacks. Improper product testing, a haste to market, and a lack of effective legislation are the main causes of IoT vulnerabilities [15]. Because IoT devices have limited memory and processing power [16], it is very hard to identify the shreds of evidence related to attacks. A framework is needed which can detect the attacks on IoT devices and stores evidence of these attacks. By applying the forensic analysis, these vulnerabilities of IoT devices can be mitigated. In addition, trace of attack and attacker can be easily found. IoT devices have limited memory and processing power, and they can only process a limited number of predetermined instructions sets [17]. As a result, they are unable to capture, monitor, and analyze communication between IoT devices. This nature of IoT devices has made it difficult for security analysts to keep record of various attacks performed on them using forensic analysis. Due to these limitations, evidence acquisition is a major problem for forensic analysis [18]. Special tools and approaches are required to make the IoT environment network more robust and secure. For the study and investigation of IoT devices, more effective forensic techniques must be created and deployed [19]. The above-discussed issues can be easily averted with the help of the forensic analysis technique. We proposed a forensic analysis framework for IoT devices which performs  
Figure 1: Yearly comparison of DDoS attacks in 2018–2023 [8]. automated detection of attacks and generates the logs and alerts for these attacks.