Towards Digital Forensics 4.0: A Multilevel Digital Forensics Framework for Internet of Things (IoT) Devices رسالة ماجستير

Abstract

The advent of the industrial revolution (IR) 4.0 has brought many benefits to business and our daily lives. IR 4.0 includes the development of the Internet of Things (IoT) devices. Although IoT brings benefits to human life, the exponential growth of IoT devices and the weak security structure of IoT devices create new opportunities for intruders to commit digital crimes, break privacy, and conduct or planing unlawful activities. The massive generated data from IoT devices may contain valuable artifacts for the crime scene. Hence, the sophisticated IoT environment, the variety of standards and vendors of IoT devices, and the lack of IoT forensics tools pose challenges to digital forensic investigators and create obstacles to finding criminals. Therefore, the digital forensic community needs to be prepared to handle IoT-related incidents in the era of IR 4.0. This thesis aims to propose and evaluate a novel IoT digital forensics framework that fits the needs of the era of IR 4.0. A systematic literature review (SLR) was conducted to achieve this goal. The results from SLR indicated that the IoT architecture mainly has three levels (device level, network level, and application level), and many challenges surround each level. The “Multilevel Artifact of Interest Digital Forensics Framework for IoT” (MAoIDFF-IoT) was designed and proposed to overcome the IoT challenges and to face the heterogeneous architecture of IoT environments. It provides investigators with guidelines for conducting IoT forensics at the multilevel. Furthermore, real scenario experiments evaluated and tested the proposed framework. The evaluation of the experimental results reveals the advantages and superiority of the MAoIDFF-IoT framework over existing frameworks in terms of usability, inclusivity, focusing on the artifact of interest, and speeding up the investigation process.