An Analysis of Digital Forensics in Cyber Security

Joseph, D. Paul; Norman, Jasmine

doi:10.1007/978-981-13-1580-0_67

Cited by 22 publications

(16 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It concerns the uncovering and interpretation of electronic data. DF professionals deal with the identification, collection, recovery, analysis, and preservation of digital evidence, found on various types of electronic devices [59]. Consecutively executed, all abovementioned steps constitute the Forensics Investigation Life Cycle [60], [61].…”

Section: A What Is Digital Forensics?mentioning

confidence: 99%

A Survey on the Internet of Things (IoT) Forensics: Challenges, Approaches, and Open Issues

Stoyanova

Nikoloudakis

Panagiotakis

et al. 2020

IEEE Commun. Surv. Tutorials

586

238

View full text Add to dashboard Cite

Today is the era of the Internet of Things (IoT). The recent advances in hardware and information technology have accelerated the deployment of billions of interconnected, smart and adaptive devices in critical infrastructures like health, transportation, environmental control, and home automation. Transferring data over a network without requiring any kind of human-to-computer or human-to-human interaction, brings reliability and convenience to consumers, but also opens a new world of opportunity for intruders, and introduces a whole set of unique and complicated questions to the field of Digital Forensics. Although IoT data could be a rich source of evidence, forensics professionals cope with diverse problems, starting from the huge variety of IoT devices and non-standard formats, to the multitenant cloud infrastructure and the resulting multi-jurisdictional litigations. A further challenge is the end-to-end encryption which represents a trade-off between users' right to privacy and the success of the forensics investigation. Due to its volatile nature, digital evidence has to be acquired and analyzed using validated tools and techniques that ensure the maintenance of the Chain of Custody. Therefore, the purpose of this paper is to identify and discuss the main issues involved in the complex process of IoT-based investigations, particularly all legal, privacy and cloud security challenges. Furthermore, this work provides an overview of the past and current theoretical models in the digital forensics science. Special attention is paid to frameworks that aim to extract data in a privacy-preserving manner or secure the evidence integrity using decentralized blockchain-based solutions. In addition, the present paper addresses the ongoing Forensics-as-a-Service (FaaS) paradigm, as well as some promising cross-cutting data reduction and forensics intelligence techniques. Finally, several other research trends and open issues are presented, with emphasis on the need for proactive Forensics Readiness strategies and generally agreed-upon standards.

show abstract

Section: A What Is Digital Forensics?mentioning

confidence: 99%

A Survey on the Internet of Things (IoT) Forensics: Challenges, Approaches, and Open Issues

Stoyanova

Nikoloudakis

Panagiotakis

et al. 2020

IEEE Commun. Surv. Tutorials

586

238

View full text Add to dashboard Cite

show abstract

“…Through digital forensics, experts examine a crime scene, gather data that are then processed and analysed in order to identify a hacker's methods and target, a process that can lead to prosecution [25]. Since it was first introduced, digital forensics has been separated into specialized sub-disciplines, each ideal for different areas, such as: cloud forensics, IoT forensics, network forensics and data forensics [26].…”

Section: Digital Forensicsmentioning

confidence: 99%

Enhancing Network Forensics with Particle Swarm and Deep Learning: The Particle Deep Framework

Koroniotis

Moustafa

2020

7th International Conference on Artificial Intelligence and Applications

View full text Add to dashboard Cite

The popularity of IoT smart things is rising, due to the automation they provide and its effects on productivity. However, it has been proven that IoT devices are vulnerable to both well established and new IoT-specific attack vectors. In this paper, we propose the Particle Deep Framework, a new network forensic framework for IoT networks that utilised Particle Swarm Optimisation to tune the hyperparameters of a deep MLP model and improve its performance. The PDF is trained and validated using Bot-IoT dataset, a contemporary network-traffic dataset that combines normal IoT and non-IoT traffic, with well known botnet-related attacks. Through experimentation, we show that the performance of a deep MLP model is vastly improved, achieving an accuracy of 99.9% and false alarm rate of close to 0%.

show abstract

“…Largely composed of identification, collection, preservation, analysis, submission, and verification of evidence [1]- [3], digital forensics is classified into disk forensics, memory forensics, and network forensics depending on the target [4], [5]. Disk forensics analyzes the structure of the disk and recovers deleted files that once existed in the hardware [6], [7].…”

Section: Introductionmentioning

confidence: 99%

Forensics and Anti-Forensics of a NAND Flash Memory: From a Copy-Back Program Perspective

Ahn

Lee

2021

IEEE Access

View full text Add to dashboard Cite

This paper proposes a safe copy-back program operation in a NAND flash memory, which is targeting digital forensics for a variety of reasons. Due to the background management operation of the NAND flash memory, the original data is highly likely to remain without truly being deleted. We have carefully investigated the possibility of data exposure due to a copy-back program operation, among, frequently used management operations as such data exposure increases the possibility of privacy invasion. We propose a safe copy-back program operation that lowers the possibility of privacy invasion. And we additionally introduce various techniques for solving the reliability problem of adjacent cells caused by the proposed copy-back program operation. For example, when deleting the original data in a copy-back program operation, overwriting is performed to minimize program disturbance. Also, after acquiring the victim cell information of the adjacent cell before proceeding with overwriting, program prohibition is determined on each page buffer based on the victim cell information. Our research results are meaningful for forensics and anti-forensics issues to be raised regarding NAND flash memories. We look forward to the development of NAND flash memories that guarantee privacy in subsequent studies.

show abstract

An Analysis of Digital Forensics in Cyber Security

Cited by 22 publications

References 11 publications

A Survey on the Internet of Things (IoT) Forensics: Challenges, Approaches, and Open Issues

A Survey on the Internet of Things (IoT) Forensics: Challenges, Approaches, and Open Issues

Enhancing Network Forensics with Particle Swarm and Deep Learning: The Particle Deep Framework

Forensics and Anti-Forensics of a NAND Flash Memory: From a Copy-Back Program Perspective

Contact Info

Product

Resources

About