A Digital Forensics Framework for Smart Environments

IoTDots: A Digital Forensics Framework for Smart Environments Leonardo Babun, Amit K. Sikder, Abbas Acar, and A. Selcuk Uluagac Cyber-Physical Systems Security Lab Department of Electrical & Computer Engineering, Florida International University 10555 West Flagler St. Miami, FL 33174 Email: flbabu002, asikd003, aacar001, suluagacg@fiu.edu Abstract—IoT devices and sensors have been utilized in a co- cameras, smart smoke detectors, presence sensors, and smart operative manner to enable the concept of a smart environment. thermostats, all controlled by a central hub. In such a setup, In these smart settings, abundant data is generated as a result the presence sensor can detect users and trigger the cameras of the interactions between devices and users’ day-to-day ac- to start recording while turning on the lights. At the same tivities. Such data contain valuable forensic information about time, the smart thermostat can become active and start events and actions occurring inside the smart environment and, lowering the room temperature. In this example, the smart if analyzed, may help hold those violating security policies accountable. Nonetheless, current smart app programming environment has control and gets feedback from the users’ platforms do not provide any digital forensics capability to activities to change the general state of the surroundings identify, trace, store, and analyze the IoT data. To overcome based on (1) what the users do, (2) the smart environment this limitation, we introduce IoTDots, a novel digital forensic setup policies, and (3) the state of the devices. framework for a smart environment such as smart homes and smart offices. IoTDots has two main components: IoTDots- Indeed, the interactions between devices and users in a Modifier and IoTDots-Analyzer. At compile time, IoTDots- smart environment generate data with tremendous forensic Modifier performs the source code analysis of smart apps, value. For instance, in the smart office setup previously detects forensically-relevant information, and automatically described, the changes in the presence sensor’s state may insert tracing logs. Then, at runtime, the logs are stored into a indicate the existence of individuals inside the smart office IoTDots database. Later, in the event of a forensic investigation, during unauthorized hours. Further, the smart environment the IoTDots-Analyzer applies data processing and machine data can give insights about the exact location of abrupt learning techniques to extract valuable and usable forensic spikes in temperature values or the presence of smoke information from the devices’ activity. In order to test the happening right before a fire incident. performance of IoTDots, we tested IoTDots in a realistic smart office environment with a total of 22 devices and sensors. Nonetheless, current IoT solutions do not provide any Also, we considered 10 different cases of forensic activities means for forensic analysis. In general, the limitation of and behaviors from users, apps, and devices. The evaluation available computing resources in the majority of the smart results show that IoTDots can achieve, on average, over 98% devices and the unique cloud-based architecture of IoT of accuracy on detecting user activities and over 96% accuracy makes it very challenging to store data inside the devices for on detecting the behavior of users, devices, and apps in a smart environment. Finally, IoTDots performance yields no forensic purposes. Indeed, the most popular IoT program- overhead to the smart devices and very minimal overhead ming platforms (e.g., Samsung SmartThings, openHab, etc.) to the cloud server. To the best of our knowledge, IoTDots do not provide any means to have access and indefinitely is the first lightweight forensic solution for IoT devices that store data in the cloud. Previous works have used the idea combines the collection of the forensically-relevant data from of logging to save data from smart apps and devices for a smart environment and the analysis of such data using further analysis of data provenance. For instance, in [1], the arXiv:1809.00745v1 [cs.CR] 3 Sep 2018 data processing and machine learning techniques for forensic authors propose an instrumental platform-centric approach purposes. Finally, we have made the IoTDots-Modifier available that logs activities from smart apps for data provenance. In online for the community. that work, however, the analysis considered the relationship Keywords—Digital forensics, Internet of Things, source code between devices, users, and smart apps while assuming analysis, logging. device integrity. This approach, while valid and useful, overlook the problem of tampered devices [2] that can cause the abnormal behavior of the smart environment. I. INTRODUCTION Without this analysis, the IoT forensic investigation would The Internet of Things (IoT) has quickly evolved as ignore additional threats coming from the compromised the network of Internet-enabled physical devices. The IoT devices [3], [4]. These threats can modify the state of the devices communicate with each other and interact with the smart environment by poisoning the forensic data or by users’ day-to-day activities through sensors. These capabil- leaking sensitive information that attackers can use to bypass ities have also enabled the concept of a smart environment. the security policies of the smart environment and gain Such an environment improves the quality of the life of the access, for instance, to restricted areas. In this paper, we people while handling a new set of data previously untapped. introduce IoTDots, a novel digital forensic framework for For instance, smart offices can be equipped with a set of smart environments. IoTDots has two main components: state-of-the-art gadgets like smart lights, smart surveillance IoTDots-Modifier (ITM) and IoTDots-Analyzer (ITA). The ITM analyzes smart applications looking for forensically- devices including smart lights, smart thermostats, relevant information inside the apps. Then, the smart apps motion sensors, etc. and 22 devices in total. are modified by inserting specific logs that will send the • Our results demonstrate that IoTDots achieves very forensic data to the IoTDots Logs Database (ITLD) at high accuracy on revealing forensic-relevant activi- runtime. Later, in a case of a forensic investigation, the ITA ties and behavior inside the smart environment. applies data processing and machine learning techniques on the ITLD data to comprehensively learn the state of the smart • Finally, since IoTDots focuses on forensic-relevant environment and the users’ behavior at the time of interest data only, its performance does not represent ad- of the forensic analysis. IoTDots considers the events and ditional overhead in terms of computing resources actions inferred from the ITLD data and the security policies to the smart devices and minimal overhead to the defined for the smart environment to detect potential security cloud-based servers. violations from users, devices, or smart apps. Organization: The rest of this paper is organized as follows. Specifically, IoTDots will look for users performing In Section II, we present the background information. Then, activities that potentially violate the security policies inside a use case and the threat model are described in Section III. a smart environment. Also, IoTDots will use the relationship Section IV details the architecture of IoTDots and Section between devices’ states to detect users trying to remove, dis- V describes the data processing and machine learning tech- able, or tamper IoT devices and/or malicious apps modifying niques utilized by the proposed forensic framework. Then, the data extracted from the smart environment. the evaluation results are analyzed in Section VI, followed by the benefits, challenges, limitations of IoTDots and future We evaluate IoTDots in a smart environment con- work in Section VII. Finally, the related work in Section VIII taining different types of devices including smart lights, and the conclusions in Section IX complete the paper. smart thermostats, motion sensors, etc. Experimental results demonstrate that IoTDots performs very well on detecting, II. BACKGROUND storing, and processing forensically-relevant data from the smart environment. Specifically, for activity detection, our Digital Forensics: The term digital forensics refers to the framework achieves up to 98% accuracy for both time- investigation and the uncovering of any kind of evidence dependent1 and time-independent2 activities. On the other from electronic devices containing digital data. The most hand, for the case of behavior detection, our framework basic application of digital forensics investigations is to achieves 96% accuracy. Additionally, a detailed performance either support or oppose the hypothesis proposed in a case analysis shows that no overhead is imposed to the smart before a court. Frequently, digital forensics requires the devices and minimal overhead is imposed to the use of analysis of physical evidence directly related to people’s physical memory and latency on the cloud-based servers as presence in the event scene such as an audio or video a result of utilizing IoTDots. file. In other cases, a more deep investigation of more technical evidence such as network data or mobile device Summary of Contributions: The contribution of this work forensics may be required. Complex cases may require the are as follows: combination of both types of analysis. • We propose IoTDots, a novel digital forensic

Load more