<![CDATA[Digital forensics artifacts created by the Internet of Things (IoT) environment are highly fragmented, originating from diverse devices, gateways, message brokers and cloud platforms using various protocols and logging formats thus creating non-comparable logs. Modern forensic software solutions presently available do not provide adequate support for these diverse ways that IoT devices communicate with one another. The proposed Universal Acquisition and Analysis Tool (UAAT) creates a single comprehensive forensic environment in which IoT evidence can be collected, analyzed regarding the specific protocols with which the evidence was created, tracked through a cryptographic chain-of-custody, threat analyzed through machine learning techniques, and have reports generated automatically within a single deployable Java-based application (i.e., can run on any machine irrespective of OS and Hardware). The UAAT was developed using a Design Science Research (DSR) methodology and tested using the IoT-23 and CICIDS2017 benchmarks within a laboratory setting. Native and/or parallel support for the widely used IoT communications protocols of MQTT, CoAP, HTTP and TCP was added via the use of the Kafka streaming platform, as well as a protocol-based parser engine; results indicate that the UAAT was able to achieve 95% protocol compatibility, maintain an ingest throughput of 6.8 logs/second, and produced an F1 score of 96.38% for the random forest during the classification of simulated threats test case. The SHA-256 chain-of-custody engine for the UAAT identified all simulated evidence tampering instances across 1,423 records.]]>
Copyrights © 2026
