Abstract-IoT devices and sensors have been utilized in a cooperative manner to enable the concept of a smart environment. In these smart settings, abundant data is generated as a result of the interactions between devices and users' day-to-day activities. Such data contain valuable forensic information about events and actions occurring inside the smart environment and, if analyzed, may help hold those violating security policies accountable. Nonetheless, current smart app programming platforms do not provide any digital forensics capability to identify, trace, store, and analyze the IoT data. To overcome this limitation, we introduce IoTDots, a novel digital forensic framework for a smart environment such as smart homes and smart offices. IoTDots has two main components: IoTDotsModifier and IoTDots-Analyzer. At compile time, IoTDotsModifier performs the source code analysis of smart apps, detects forensically-relevant information, and automatically insert tracing logs. Then, at runtime, the logs are stored into a IoTDots database. Later, in the event of a forensic investigation, the IoTDots-Analyzer applies data processing and machine learning techniques to extract valuable and usable forensic information from the devices' activity. In order to test the performance of IoTDots, we tested IoTDots in a realistic smart office environment with a total of 22 devices and sensors. Also, we considered 10 different cases of forensic activities and behaviors from users, apps, and devices. The evaluation results show that IoTDots can achieve, on average, over 98% of accuracy on detecting user activities and over 96% accuracy on detecting the behavior of users, devices, and apps in a smart environment. Finally, IoTDots performance yields no overhead to the smart devices and very minimal overhead to the cloud server. To the best of our knowledge, IoTDots is the first lightweight forensic solution for IoT devices that combines the collection of the forensically-relevant data from a smart environment and the analysis of such data using data processing and machine learning techniques for forensic purposes. Finally, we have made the IoTDots-Modifier available online for the community.
(3) Additionally, no source code modification REF is needed for Aegis to collect data from smart home devices and detect malicious activities in a SHS.
IoTDots: A Digital Forensics Framework for Smart Environments
ArXiv
ArXiv
Computer Science