IoT Forensic Investigation: Analysis of DDoS Attacks on IoT Devices

This project presents an experimental design for analyzing the traffic of IoT devices using network monitoring tools to identify data traffic sources and detect potential DDoS attacks. The research investigates the challenges of IoT forensics, including data acquisition, cloud storage security, and the limitations of existing forensic tools. The project outlines an experimental setup involving a flooding attack on an IoT device, analyzes network logs with Wireshark, and uses tools like LOIC for simulation. Results include the identification of source and destination IP addresses, port details, and payload information to understand the nature of the attack. The project also discusses the importance of data preservation, integrity, and privacy in the context of IoT forensics. It proposes a framework for forensic investigation with a public digital ledger, offering anonymity and non-repudiation for evidence. The project concludes by emphasizing the need for combined cyber and physical security measures and addresses the challenges of handling the vast amount of data generated by IoT devices, with a focus on future work like forensic advisory and the preservation of digital system traces.

Paper Title
1. Abstract 3. Background
• First level
• Second level
5. Results
• First level
• Second level
9. References
• Harvad APA version 6
•
3. Problem Statement/Aim and Objectives
4. . Experimental Design
• First level
• Second level
6. Discussion
• First level
• Second level
8. Future Work
• First level
• Second level
7. Conclusions
• First level
• Second level
2. Introduction
• First level
• Second level

1. Abstract
The aim of the poster is to create an experimental design for analysing
the traffic of IoT devices with the use of network monitoring tools and
identify the source of data traffic. The suspicious activity is needed to be
identified for the prevention of DDoS attack on the server and prevention
of data traffic to be stolen. As it can increase the chances of having data
breaches or cyber security threats. IoT devices such as smartphones,
smartwatches can collect data using applications which then can be used
for forensic purposes. The problems faced for conducting the experiment
and acquiring data. A flooding attack is performed on an IoT device and
traffic is analysed for identification of the source of the attack and
verification of the integrity of the evidence such that investigation can be
performed.
3. Background
The internet of things is considered as a concept
for covering the interconnected infrastructure
and the utilities that have a constant increase.
Using the IOT, the embedded computing devices
that are connected with the existing
infrastructure. The embedded devices are of
wide range such as remote sensors, used in oil
and gas utility, smart meters, etc. The IOT
devices are independent systems. The main
issue with the devices is the interconnection of
the devices. The information is collected using
either a vast range of applications through
computing or commercials. It has the monitoring
requirements from cloud computing but there
are related challenges that can affect the
characteristics of velocity, variety and volume
(Khan, Nawsher & et.al., 2018). It is creating a
wider surface of attack with the emergence of
new devices (Zulkipli, et al., 2017). Proper
monitoring of the data sent and received in the
IoT network can help in finding the details of the
attacker device secure the network from DDoS
attacks.
5. Results
It can be found from the figure 3 that for the IP address of IPv4 reading 192.168.0.221 the
source and destination of IP gets visible for 192.168.0.127 having 20 bytes length of header
and having total length 43 bytes. For the user datagram protocol the source ports is 61924
and it has destination port 137. In case of returning filter for the IP.src == 168.192.0.221 and
an investigation is made for another frame the source port becomes immutable. The figure 4
shows a log file analysis is performed for obtaining 3 IP address that acts illegally in the
flooding attack for the IoT devices. A simulation testing is done for performing the network
forensics and detect the flooding attacks. For the simulation LOIC tool is used and the flood
attack is detected and IP packet delivery is used on an open port of the targeted device.
Finally the figure 5 summarizes the details gathered from the analysis of the network log
captured file such as the source and the destination IP address, Protocol, Source and
Destination Port and Payload used for the attack.
9. References
Ab Rahman, N. H., Cahyani, N. D. W., & Choo, K. K. R. (2017). Cloud incident handling and forensic by design: cloud storage as a case study. ‐ ‐ Concurrency and Computation:
Practice and Experience, 29(14), e3868.
Atlam, Hany & Alenezi, Ahmed & Al Shadadi, Abdulrahman & Walters, Robert & Wills, Gary. (2017). Integration of Cloud Computing with Internet of Things: Challenges and
Open Issues. 10.1109/iThings-GreenCom-CPSCom-SmartData.2017.105.
Atlam, H., J.Walters, R., B.Wills, G., & Daniel, J. (2019). Fuzzy Logic with Expert Judgment to Implement an Adaptive Risk-Based Access Control Model for IoT. doi:
10.1007/s11036-019-01214-w
Billard, D., & Bartolomei, B. (2019, June). Digital Forensics and Privacy-by-Design: Example in a Blockchain-Based Dynamic Navigation System. In Annual Privacy Forum (pp.
151-160). Springer, Cham.
Castiglione, A., De Saints, A., Masucci, B., & Palmieri, F. (2016). Hierarchical and Shared Access Control. Transactions on Information Forensics and Security, 11(4), 850-865.
Conti, M., Dehghantanha, A., Franke, K., & Watson, S. (2018). Internet of Things security and forensics: Challenges and opportunities.
IoT Forensics: Security in connected world | Packet Hub. (2020). Retrieved 5 March 2020, from https://hub.packtpub.com/iot-forensics-security-connected-world/
Khan, Nawsher & Alsaqer, Mohammed & Shah, Habib & Badsha, Gran & Abbasi, Aftab & Salehian, Solmaz. (2018). The 10 Vs, Issues and Challenges of Big Data. 52-56.
10.1145/3206157.3206166.
Meffert, C., Clark, D., Baggili, I., & Breitinger, F. (2017, August). Forensic State Acquisition from Internet of Things (FSAIoT) A general framework and practical approach for IoT
forensics through IoT device state acquisition. In Proceedings of the 12th International Conference on Availability, Reliability and Security (pp. 1-11).
Servida, F., & Casey, E. (2019). IoT forensic challenges and opportunities for digital traces. Digital Investigation, 28, Supplement, S22-S29. doi:
https://doi.org/10.1016/j.diin.2019.01.012
Takyar, A. How Internet of Things work? Understand with the example. Retrieved 6 March 2020, from https://www.leewayhertz.com/how-internet-of-things-work/
Zulkipli, N. H. N., Alenezi, A., & Wills, G. B. (2017, April). IoT forensic: bridging the challenges in digital forensic and the Internet of Things. In International Conference on
Internet of Things, Big Data and Security (Vol. 2, pp. 315-324). SCITEPRESS. Internet of Things, Big Data and Security (Vol. 2, pp. 315-324). SCITEPRESS.
3. IOT Forensic Challenges
With the growth of IoT and how large it has
become it is already present in all our lives
whether that may be in our hands as - a
smartwatch, pockets - a smartphone, or house
- a smart home, etc. all these make our lives
easier and rely on it. However, it is also true
that it can rise to a number of issues related to
data. At this point in time, there are various
devices like smart locks, smart thermostats,
smart refrigerators, etc. and these devices are
not supported by the existing forensic tools
and methods (Servida, F., & Casey, E. 2019).
This can make extracting data and analysing
difficult for the forensic department without
getting the help of someone who specializes in
similar areas. On top of the extracted data can
also contain privacy risks.
The challenges faced in IoT forensic is
acquisition of data – acquiring data and
knowing the exact location of data. The seizure
and search procedures that are utilized in the
conventional process of computer forensics
are impractical since the evidence is stored in
the cloud data centers. Additionally, the cloud
cybersecurity policies need revisions because
each of the IoT devices generate data that are
stored in the cloud servers (Conti et al., 2018).
The cloud cybersecurity policy is needed to be
integrated with the IoT infrastructure for
getting quick responses against suspicious
activities. A revised plan is needed to be
created based on accessibility, preservation
and data integrity.
4. Experimental Design
A flooding attack is performed on the IoT server framework for implementing forensics on
IoT devices. The above figure shows the case of simulation for the flooding attack. The
network forensic process is implemented in the model for the detection of attack as shown
in figure 1 on the IoT devices (Billard & Bartolomei, 2019). A log file is created for storing the
data logger and it is analysed for finding evidence with the Wireshark and reconstructing the
log file. The IoT devices create a large log file and thus it is difficult to identify the flooding
attack and monitor the networking activity such that the source can be identified for the
infected device. The figure 2 shows the input output graph of the data traffic in the network
at Bluetooth port 137 and is used for analysis of the number of packets per second sent or
received by the IoT device.
.
6. Discussion
IoT forensics is addressed in several recent research and it discusses the components of IoT digital
forensics such as the source of evidence and process of investigation. With the comparison of the
experimental setup the other work does not consider the distributed and decentralized system for
preserving and acquiring the interaction of IoT that are secured against tampering (Ab Rahman, et al.,
2017). The robustness of the proposed framework is demonstrated for different scenarios. There are
no forensic models that can provide a schema for ensuring availability, scalability and tolerance of
fault of storage evidence system. There are no framework or schemes that are used for maintaining
privacy of the evidence that are preserved proposed in the works of IoT digital forensics.
8. Future Work
For handling properly the IoT in the perspective of forensic advisory can be taken from the forensic
advisors and the traces of digital systems need to be preserved and prioritized. The IoT device is not
the replacement of the current ICT technology but it acts as an enhancement of this network and
relies on it in different methods. Cyber security and physical security is needed to be combined for
working with the focus on threats. It is estimated that about 50 billion devices would be connected to
the network in 2020 and thus specific attention is needed to be provided on storage, access,
transportation and processing the data generated from this devices. The data centers would face
increased workloads while processing the data and causing new capacity, analytics and security
challenges. The data is needed to be handled conveniently but it acts as the critical challenge since
the application performance depends on the data management properties.
7. Conclusions
The continued growth of IoT devices increases the necessity to develop new processes for the
investigation of IoT related incidents. The security concerns need to be addressed depending on the
best practices of verifying the physical and digital evidence and new era of digital forensics. The
investigation is needed to be dependent on the physical and mechanical nature of the smart device
since there are no defined principles for performing IoT forensics and identification of source of
evidence is the major challenge. An exploration is made by the cyber security and computer forensic
investigators for handling evidence, extraction and analysis of the data collected. The evidence can be
collected from the fixed sensor devices installed in different locations, communication devices, ISP
logs and wearable smart devices. The poster is prepared for proposing a forensic investigation
framework with the IoT based system with the use of public digital ledger. The FIF - IoT can be used
for providing anonymity, non-repudiation and confidentiality for the evidence that is available
publicly. The device-to device, device to cloud and device to use interaction can be captured and
stored as evidence in the bitcoin as the public digital ledger. It can also provide an interface for the
acquisition of evidence and a scheme for verifying the integrity of evidence for investigating criminal
incidents.
2. Introduction
The Internet of Things (IoT) is becoming the future and has grown by a
lot over the decade and it’s still constantly growing. The IoT is
responsible for connecting and communicating devices with each other
as well as interacting nearly all the devices at the same time over the
internet through connectivity and data transfer (Atlam, et al., (2019). All
the devices that are connected are using various communication
technologies such as wireless, wired or mobile networks (Atlam, et al.,
2017). The IoT is changing the world we live in and our day-to-day lives
because almost every basic thing we do from driving to making
purchases, they all are connected to the internet with the help of
sensors and chips that are installed on them (Takyar, n.d.). It has been
implemented just about everywhere and pretty much everything
around us is connected to the internet whether that may be
smartphones, healthcare and transportation, etc. They all transmit,
receive, send and exchange valuable data and work together by sharing
data in large quantities (Takyar, n.d.). Using data collected from the
sensors or chips can be used to improve our lives. There are wide range
of Iot devices available in the market that is connected to the network
using wiFi or Bluetooth, our experiment is performed for the Bluetooth
enabled device .
Figure 3: Wireshark Traffic Analysis
Figure 4: Log File analysis to get Packet Bytes Details from
different IP addresses
Figure 5: Network Traffic Analysis
Figure 1: Simulation of flooding attack on IoT device
Figure 2: Wireshark IO Graph for Bluetooth Port 137
3. IoT Forensic Challenges
Although IoT provides a lot of benefits and new possibilities, it can also
create various challenges regarding security. can make them prime
targets for others who can then sell theirAs it allows anyone to connect
to the internet which collects data. It data or extract their data which
then can be analysed and used for other cyber crime. Therefore, the
objective of an IoT system is to increase sharing data in large quantities
and also at the same time have the highest security measures that are
required to prevent sensitive information being extracted by
(Castiglione, et al., 2016). According to ("Can we tackle the ever-evolving
threat of cybercrime?", 2017) the number of cyber crimes is constantly
rising on a large scale. Currently, cybercrime is not just limited to
desktops and smartphones and everything connected to the internet is
at risk. Currently, there are a lot of changes that have happened and
gathering information has been easier than ever, collecting millions of
data in seconds using a smart device through applications (Barzilay,
2019). Knowing that the way of collecting data has been increased, it
has become a huge security issue.
The analysis is performed on different parts of the frame for the representation of the frame in
attacking the packet flood for an IP address 192.168.0.221 and length that ranges within 50
bytes. This is because 50 bytes is a standard size of a data packet that is used for transmission
and can help in creating a real life simulation of the DDoS attack.
For the experimental design the following stages are conducted:
• Authorization and Preparation
• Incident Detection
• Incident Response
• Attribution and investigation

Technology has been advancing more than ever over the years and the number of Internet of things (IoT) devices has also increased in their own respective environments. Today, almost everyone owns a smart device whether that may be smartphones, smartwatches, etc. However, this can have legal and technical problems for the forensic department. As it can increase the
chances of having data breaches or cyber security threats. IoT devices such as smartphones, smartwatches can collect data using applications which then can be used for forensic purposes. It can be very useful for investigating a criminal offence and can be used to perform forensic analysis for further improvements or further investigation. However, the smart devices can be
physically broken/destroyed which can destroy the digital evidence and it can also be deleted from the device which can cause a problem for further investigations. The aim of the report is to create an experimental design for analysing the traffic of IoT devices with the use of network monitoring tools and identify the source of data traffic. The suspicious activity is needed to be
identified for the prevention of DDoS attack on the server and prevention of data traffic to be stolen.
Introduction
The Internet of Things (IoT) is becoming the future and has grown by a lot over the decade and it’s still constantly growing. The IoT is responsible for connecting and communicating devices with each other as well as interacting nearly all the devices at the same time over the internet through connectivity and data transfer (Atlam, et al., (2019). All the devices that are connected
are using various communication technologies such as wireless, wired or mobile networks (Atlam, et al., (2017). The IoT is changing the world we live in and our day-to-day lives because almost every basic thing we do from driving to making purchases, they all are connected to the internet with the help of sensors and chips that are installed on them (Takyar, n.d.). It has been
implemented just about everywhere and pretty much everything around us is connected to the internet whether that may be smartphones, healthcare and transportation, etc. They all transmit, receive, send and exchange valuable data and work together by sharing data in large quantities (Takyar, n.d.). Using data collected from the sensors or chips can be used to improve our
lives.
Although IoT provides a lot of benefits and new possibilities, it can also create various challenges regarding security. As it allows anyone to connect to the internet which collects data. It can make them prime targets for others who can then sell their data or extract their data which then can be analysed and used for other cyber crime. Therefore, the objective of an IoT system is
to increase sharing data in large quantities and also at the same time have the highest security measures that are required to prevent sensitive information being extracted by (Castiglione, et al., 2016). According to ("Can we tackle the ever-evolving threat of cybercrime?", 2017) the number of cyber crimes is constantly rising on a large scale. Currently, cybercrime is not just
limited to desktops and smartphones and everything connected to the internet is at risk.
Currently, there are a lot of changes that have happened and gathering information has been easier than ever, collecting millions of data in seconds using a smart device through applications (Barzilay, 2019). Knowing that the way of collecting data has been increased, it has become a huge security issue. The aim of this poster is to retrieve data and how to track back digital
evidence using digital forensic for investigations and not to lose any data even if the device is destroyed/damaged.
IOT Forensic Challenges
With the growth of IoT and how large it has become it is already present in all our lives whether that may be in our hands as - a smartwatch, pockets - a smartphone, or house - a smart home, etc. all these make our lives easier and rely on it. However, it is also true that it can rise to a number of issues related to data. At this point in time, there are various devices like smart locks,
smart thermostats, smart refrigerators, etc. and these devices are not supported by the existing forensic tools and methods Servida, F., & Casey, E. (2019). This can make extracting data and analysing difficult for the forensic department without getting the help of someone who specializes in similar areas. On top of the extracted data can also contain privacy risks.
The challenges faced in IoT forensic is acquisition of data – acquiring data and knowing the exact location of data. The seizure and search procedures that are utilized in the conventional process of computer forensics are impractical since the evidence is stored in the cloud data centers. Additionally, the cloud cybersecurity policies need revisions because each of the Iot devices
generate data that are stored in the cloud servers (Conti et al., 2018). The cloud cybersecurity policy is needed to be integrated with the IoT infrastructure for getting quick responses against suspicious activities. A revised plan is needed to be created based on accessibility, preservation and data integrity.
Background information
The internet of things is considered as a concept for covering the interconnected infrastructure and the utilities that have a constant increase. Using the IOT, the embedded computing devices that are connected with the existing infrastructure. The embedded devices are of wide range such as remote sensors, used in oil and gas utility, smart meters, etc. The IOT devices are
independent systems. The main issue with the devices is the interconnection of the devices. It is creating a wider surface of attack with the emergence of new devices (Zulkipli, Alenezi & et al., 2017). The information is collected using either a vast range of applications through computing or commercials. It has the monitoring requirements from cloud computing but there are
related challenges that can affect the characteristics of velocity, variety and volume (Khan, Nawsher & et.al., 2018).
Experimental design
A flooding attack is performed on the IoT server framework for implementing forensics on IoT devices. The above figure shows the case of simulation for the flooding attack. The network forensic process is implemented in the model for the detection of attack as shown in figure 1 on the IoT devices (Billard & Bartolomei, 2019). A log file is created for storing the data logger and it
is analysed for finding evidence with the Wireshark and reconstructing the log file. The IoT devices create a large log file and thus it is difficult to identify the flooding attack and monitor the networking activity such that the source can be identified for the infected device. The figure 2 shows the input output graph of the data traffic in the network at Bluetooth port 137 and is
used for analysis of the number of packets per second sent or received by the IoT device.
These are the following stages of the forensic experimental design :
Authorization and Preparation
In this phase forensic investigation is applied to the environment where the security network devices for example packet analyzers and traffic stream monitoring software are placed at different areas for detecting the flood.
Incident Detection
Different tools for security analysis is used for generating warning and indicating the security offense and violating policy. Any suspicious events is needed to be reported and analyzed
Incident Response
The illegal act response is needed to be initiated depending on the collected information and evaluating the incident. The attack type identified is needed to be guided by business, legal and organization policy (Meffert et al., 2017). Wireshark is used for capturing traffic and the log file is analyzed for
gathering forensic evidence.
Attribution and Investigation
The obtained evidence and information is traced for confirming the incident and this helps in trace backing the source, reconstructing the attack scenario and attributing sources. Discussion
IoT forensics is addressed in several recent research and it discusses the components of IoT digital forensics such as the source of evidence and process of investigation. With the comparison of the experimental setup the other work does not consider the distributed and decentralized system for preserving and acquiring the interaction of IoT that are secured against tampering
(Ab Rahman, et al., 2017). The robustness of the proposed framework is demonstrated for different scenarios. There are no forensic models that can provide a schema for ensuring availability, scalability and tolerance of fault of storage evidence system. There are no framework or schemes that are used for maintaining privacy of the evidence that are preserved proposed in the
works of Iot digital forensics.
Result
The analysis is performed on different parts of the frame for the representation of the frame in attacking the packet flood for an IP address 192.168.0.221 and length that ranges within 50s bytes. It can be found from the figure 3 that for the IP address of IPv4 reading 192.168.0.221 the source and
destination of IP gets visible for 192.168.0.127 having 20 bytes length of header and having total length 43 bytes. For the user datagram protocol the source ports is 61924 and it has destination port 137. In case of returning filter for the ip.src == 168.192.0.221 and an investigation is made for another
frame the source port becomes immutable. The figure 4 shows a log file analysis is performed for obtaining 3 IP address that acts illegally in the flooding attack for the IoT devices. A simulation testing is done for performing the network forensics and detect the flooding attacks. For the simulation LOIC
tool is used and the flood attack is detected and IP packet delivery is used on an open port of the targeted device. Finally the figure 5 summarizes the details gathered from the analysis of the network log captured file such as the source and the destination IP address, Protocol, Source and Destination Port
and Payload used for the attack.
Conclusion
The continued growth of IoT devices increases the necessity to develop new processes for the investigation of IoT related incidents. The security concerns need to be addressed depending on the best practices of verifying the physical and digital evidence and new era of digital forensics. The investigation is needed to be dependent on the physical and mechanical nature of the
smart device since there are no defined principles for performing IoT forensics and identification of source of evidence is the major challenge. An exploration is made by the cyber security and computer forensic investigators for handling evidence, extraction and analysis of the data collected. The evidence can be collected from the fixed sensor devices installed in different
locations, communication devices, ISP logs and wearable smart devices. The poster is prepared for proposing a forensic investigation framework with the IoT based system with the use of public digital ledger. The FIF - IoT can be used for providing anonymity, non-repudiation and confidentiality for the evidence that is available publicly. The device-to device, device to cloud and
device to use interaction can be captured and stored as evidence in the bitcoin as the public digital ledger. It can also provide an interface for the acquisition of evidence and a scheme for verifying the integrity of evidence for investigating criminal incidents.
Future work
For handling properly the IoT in the perspective of forensic advisory can be taken from the forensic advisors and the traces of digital systems need to be preserved and prioritized. The IoT device is not the replacement of the current ICT technology but it acts as an enhancement of this network and relies on it in different methods. Cyber security and physical security is needed to
be combined for working with the focus on threats. It is estimated that about 50 billion devices would be connected to the network in 2020 and thus specific attention is needed to be provided on storage, access, transportation and processing the data generated from this devices. The data centers would face increased workloads while processing the data and causing new
capacity, analytics and security challenges. The data is needed to be handled conveniently but it acts as the critical challenge since the application performance depends on the data management properties.
Ab Rahman, N. H., Cahyani, N. D. W., & Choo, K. K. R. (2017). Cloud incident handling and forensic‐by‐design: cloud storage as a case study. Concurrency and Computation: Practice and Experience, 29(14), e3868.
Atlam, Hany & Alenezi, Ahmed & Al Shadadi, Abdulrahman & Walters, Robert & Wills, Gary. (2017). Integration of Cloud Computing with Internet of Things: Challenges and Open Issues. 10.1109/iThings-GreenCom-CPSCom-SmartData.2017.105.
Atlam, H., J.Walters, R., B.Wills, G., & Daniel, J. (2019). Fuzzy Logic with Expert Judgment to Implement an Adaptive Risk-Based Access Control Model for IoT. doi: 10.1007/s11036-019-01214-w
Billard, D., & Bartolomei, B. (2019, June). Digital Forensics and Privacy-by-Design: Example in a Blockchain-Based Dynamic Navigation System. In Annual Privacy Forum (pp. 151-160). Springer, Cham.
Castiglione, A., De Saints, A., Masucci, B., & Palmieri, F. (2016). Hierarchical and Shared Access Control. Transactions on Information Forensics and Security, 11(4), 850-865.
Conti, M., Dehghantanha, A., Franke, K., & Watson, S. (2018). Internet of Things security and forensics: Challenges and opportunities.
IoT Forensics: Security in connected world | Packet Hub. (2020). Retrieved 5 March 2020, from https://hub.packtpub.com/iot-forensics-security-connected-world/
Khan, Nawsher & Alsaqer, Mohammed & Shah, Habib & Badsha, Gran & Abbasi, Aftab & Salehian, Solmaz. (2018). The 10 Vs, Issues and Challenges of Big Data. 52-56. 10.1145/3206157.3206166.
Meffert, C., Clark, D., Baggili, I., & Breitinger, F. (2017, August). Forensic State Acquisition from Internet of Things (FSAIoT) A general framework and practical approach for IoT forensics through IoT device state acquisition. In Proceedings of the 12th International Conference on Availability, Reliability and
Security (pp. 1-11).
Servida, F., & Casey, E. (2019). IoT forensic challenges and opportunities for digital traces. Digital Investigation, 28, Supplement, S22-S29. doi: https://doi.org/10.1016/j.diin.2019.01.012
Takyar, A. How Internet of Things work? Understand with the example. Retrieved 6 March 2020, from https://www.leewayhertz.com/how-internet-of-things-work/
Zulkipli, N. H. N., Alenezi, A., & Wills, G. B. (2017, April). IoT forensic: bridging the challenges in digital forensic and the Internet of Things. In International Conference on Internet of Things, Big Data and Security (Vol. 2, pp. 315-324). SCITEPRESS.