{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,2]],"date-time":"2025-11-02T01:44:56Z","timestamp":1762047896026,"version":"build-2065373602"},"reference-count":26,"publisher":"Oxford University Press (OUP)","issue":"6","license":[{"start":{"date-parts":[[2022,2,17]],"date-time":"2022-02-17T00:00:00Z","timestamp":1645056000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/academic.oup.com\/journals\/pages\/open_access\/funder_policies\/chorus\/standard_publication_model"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,11,23]]},"abstract":"<jats:title>Abstract<\/jats:title>\n               <jats:p>In an Internet of Things (IoT) environment, IoT devices are typically connected through different network media types such as mobile, wireless and wired networks. Due to the pervasive nature of such devices, they are a potential evidence source in both civil litigation and criminal investigations. It is, however, challenging to identify and acquire forensic artefacts from a broad range of devices, which have varying storage and communication capabilities. Hence, in this paper, we first propose an IoT network architecture for the forensic purpose that uses machine learning algorithms to autonomously detect IoT devices. Then we posit the importance of focusing on the links between different IoT devices (e.g. whether one device is controlled or can be accessed from another device in the system), and design an approach to do so. Specifically, our approach adopts a graph for modelling IoT communications\u2019 message flows to facilitate the identification of correlated network traffic based on the direction of the network and the associated attributes. To demonstrate how such an approach can be deployed in practice, we provide a proof of concept using two IoT controllers to generate 480 commands for controlling two IoT devices in a smart home environment and achieve an accuracy rate of 98.3% for detecting the links between devices. We also evaluate the proposed autonomous discovering of IoT devices and their activities in a TCP network by using real-world measurements from a public dataset of a popular off-the-shelf smart home deployed in two different locations. We selected 39 out of 81 different IoT devices for this evaluation.<\/jats:p>","DOI":"10.1093\/jigpal\/jzac012","type":"journal-article","created":{"date-parts":[[2022,2,17]],"date-time":"2022-02-17T12:09:00Z","timestamp":1645099740000},"page":"1041-1055","source":"Crossref","is-referenced-by-count":6,"title":["An efficient IoT forensic approach for the evidence acquisition and analysis based on network link"],"prefix":"10.1093","volume":"30","author":[{"given":"Saad","family":"Khalid Alabdulsalam","sequence":"first","affiliation":[{"name":"University College Dublin , Dublin, Ireland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Trung Q","family":"Duong","sequence":"additional","affiliation":[{"name":"Queen Belfast University , Belfast, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kim-Kwang","family":"Raymond Choo","sequence":"additional","affiliation":[{"name":"University of Texas at San Antonio , San Antonio, TX, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Nhien-An","family":"Le-Khac","sequence":"additional","affiliation":[{"name":"University College Dublin , Dublin, Ireland"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"286","published-online":{"date-parts":[[2022,2,17]]},"reference":[{"key":"2022112012290187100_ref1","doi-asserted-by":"crossref","first-page":"207","DOI":"10.1145\/3395351.3399421","article-title":"Peek-a-boo: I see your smart home activities, even encrypted!","volume-title":"Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks","author":"Acar","year":"2020"},{"key":"2022112012290187100_ref2","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1007\/978-3-319-99277-8_3","article-title":"Internet of things forensics: challenges and case study","volume-title":"Advances in Digital Forensics XIV: 14th IFIP WG 11.9 International Conference, New Delhi, India, January 3\u20135, 2018, Revised Selected Papers","author":"Alabdulsalam","year":"2018"},{"key":"2022112012290187100_ref3","first-page":"163","article-title":"Evidence identification and acquisition based on network link in an internet of things environment","volume-title":"13th International Conference on Computational Intelligence in Security for Information Systems (CISIS 2020)","author":"Alabdulsalam","year":"2020"},{"article-title":"An analysis of home IoT network traffic and behaviour","year":"2018","author":"Amar","key":"2022112012290187100_ref4"},{"key":"2022112012290187100_ref5","doi-asserted-by":"crossref","first-page":"854","DOI":"10.1109\/INFOCOMWKSHPS50562.2020.9162885","article-title":"Iot event classification based on network traffic","volume-title":"IEEE INFOCOM 2020\u2014IEEE Conference (INFOCOM WKSHPS)","author":"Charyyev","year":"2020"},{"key":"2022112012290187100_ref6","first-page":"2070","article-title":"Specification of the ip flow information export (ipfix) protocol for the exchange of flow information","volume-title":"RFC 7011 (Internet Standard)","author":"Claise","year":"2013"},{"key":"2022112012290187100_ref7","doi-asserted-by":"crossref","first-page":"53","DOI":"10.1007\/978-3-030-36938-5_4","article-title":"A graph database-based approach to analyze network log files","volume":"11928","author":"Diederichsen","year":"2019","journal-title":"Network and System Security: 13th International Conference, NSS 2019, Sapporo, Japan, December 15\u201318, 2019, Proceedings"},{"key":"2022112012290187100_ref8","first-page":"1","article-title":"Classification of device behaviour in internet of things infrastructures","volume-title":"Proceedings of the 1st International Conference on Internet of Things and Machine Learning\u2014IML \u201817","author":"Ferrando","year":"2017"},{"key":"2022112012290187100_ref9","doi-asserted-by":"crossref","first-page":"77","DOI":"10.1109\/W-FiCloud.2016.30","article-title":"A survey on network security monitoring systems","volume-title":"2016 IEEE 4th International Conference on Future Internet of Things and Cloud Workshops (FiCloudW)","author":"Ghafir","year":"2016"},{"key":"2022112012290187100_ref10","first-page":"1446","article-title":"A forensic investigation framework for smart home environment","volume-title":"17th IEEE International Conference on Trust, Security and Privacy in Computing and Communications","author":"Goudbeek","year":"2018"},{"key":"2022112012290187100_ref11","doi-asserted-by":"crossref","DOI":"10.3390\/fi8040054","article-title":"Network forensics method based on evidence graph and vulnerability reasoning","volume":"8","author":"He","year":"2016","journal-title":"Future Internet"},{"key":"2022112012290187100_ref12","doi-asserted-by":"crossref","first-page":"2037","DOI":"10.1109\/COMST.2014.2321898","article-title":"Flow monitoring explained: from packet capture to data analysis with netflow and ipfix","volume":"16","author":"Hofstede","year":"2014","journal-title":"IEEE Communications Surveys Tutorials"},{"key":"2022112012290187100_ref13","first-page":"253","article-title":"Characterization of tor traffic using time based features","author":"Lashkari","year":"2017","journal-title":"ICISS"},{"key":"2022112012290187100_ref14","doi-asserted-by":"crossref","first-page":"6487","DOI":"10.1109\/JIOT.2019.2906946","article-title":"Iot forensics: Amazon echo as a use case","volume":"6","author":"Li","year":"2019","journal-title":"IEEE Internet of Things Journal"},{"key":"2022112012290187100_ref15","doi-asserted-by":"crossref","DOI":"10.1109\/TCSS.2019.2927431","article-title":"Blockchain-based digital forensics investigation framework in the internet of things and social systems","author":"Li","year":"2019","journal-title":"IEEE Transactions on Computational Social Systems"},{"key":"2022112012290187100_ref16","first-page":"33","article-title":"Intrusion detection through relationship analysis","author":"Neise","year":"2016","journal-title":"SANS Institute InfoSec Reading Room"},{"key":"2022112012290187100_ref17","article-title":"Dissertations & Theses","volume-title":"Graph-Based Event Correlation for Network Security Defense","author":"Neise","year":"2018"},{"key":"2022112012290187100_ref18","doi-asserted-by":"crossref","first-page":"117","DOI":"10.1016\/bs.host.2016.07.001","article-title":"CyGraph","volume-title":"Cognitive Computing: Theory and Applications","author":"Noel","year":"2016"},{"key":"2022112012290187100_ref19","doi-asserted-by":"crossref","DOI":"10.4108\/icst.collaboratecom.2013.254159","article-title":"Internet of Things forensics: challenges and approaches","volume-title":"9th IEEE International Conference on Collaborative Computing: Networking, Applications and Worksharing","author":"Oriwoh","year":"2013"},{"key":"2022112012290187100_ref20","doi-asserted-by":"crossref","first-page":"58","DOI":"10.1007\/978-3-319-24369-6_5","article-title":"Graph databases: their power and limitations","volume-title":"Computer Information Systems and Industrial Management: 14th IFIP TC 8 International Conference, CISIM 2015, Warsaw, Poland, September 24\u201326, 2015, Proceedings","author":"Pokorn\u00fd","year":"2015"},{"key":"2022112012290187100_ref21","doi-asserted-by":"crossref","DOI":"10.1145\/3355369.3355577","article-title":"Information exposure for consumer IoT devices: a multidimensional, network-informed measurement approach","volume-title":"Proc. of the Internet Measurement Conference (IMC)","author":"Ren","year":"2019"},{"key":"2022112012290187100_ref22","first-page":"304","article-title":"An efficient approach for device identification and traffic classification in IoT ecosystems","volume-title":"Proceedings\u2014IEEE Symposium on Computers and Communications","author":"Santos"},{"key":"2022112012290187100_ref23","first-page":"1","article-title":"Iot device fingerprinting for relieving pressure in the access control","volume-title":"Proceedings of the ACM Turing Celebration Conference\u2013China","author":"Song","year":"2019"},{"key":"2022112012290187100_ref24","first-page":"82","article-title":"A visualization method based on graph database in security logs analysis","volume":"3","author":"Tang","year":"2017","journal-title":"Advances in Computer, Signals and Systems"},{"key":"2022112012290187100_ref25","doi-asserted-by":"crossref","first-page":"265","DOI":"10.1016\/j.future.2018.09.058","article-title":"Internet of things forensics: recent advances, taxonomy, requirements, and open challenges","volume":"92","author":"Yaqoob","year":"2019","journal-title":"Future Generation Computer Systems"},{"key":"2022112012290187100_ref26","doi-asserted-by":"crossref","first-page":"6850","DOI":"10.1109\/JIOT.2019.2912118","article-title":"How do I share my IoT forensic experience with the broader community? An automated knowledge sharing IoT forensic platform","volume":"6","author":"Zhang","year":"2019","journal-title":"IEEE Internet of Things Journal"}],"container-title":["Logic Journal of the IGPL"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/academic.oup.com\/jigpal\/article-pdf\/30\/6\/1041\/47058136\/jzac012.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/academic.oup.com\/jigpal\/article-pdf\/30\/6\/1041\/47058136\/jzac012.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,11,20]],"date-time":"2022-11-20T12:29:25Z","timestamp":1668947365000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/jigpal\/article\/30\/6\/1041\/6529923"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,2,17]]},"references-count":26,"journal-issue":{"issue":"6","published-online":{"date-parts":[[2022,2,17]]},"published-print":{"date-parts":[[2022,11,23]]}},"URL":"https:\/\/doi.org\/10.1093\/jigpal\/jzac012","relation":{},"ISSN":["1367-0751","1368-9894"],"issn-type":[{"type":"print","value":"1367-0751"},{"type":"electronic","value":"1368-9894"}],"subject":[],"published-other":{"date-parts":[[2022,12]]},"published":{"date-parts":[[2022,2,17]]}}}