{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,15]],"date-time":"2026-04-15T21:41:10Z","timestamp":1776289270661,"version":"3.50.1"},"reference-count":113,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2020,8,5]],"date-time":"2020-08-05T00:00:00Z","timestamp":1596585600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["JSAN"],"abstract":"<jats:p>Cyber\u2013Physical Systems (CPS) connect the physical world (systems, environments, and humans) with the cyber world (software, data, etc.) to intelligently enhance the operational environment they serve. CPS are distributed software and hardware components embedded in the physical world and possibly attached to humans. They offer smart features, such as enhancing and optimizing the reliability, quality, safety, health, security, efficiency, operational costs, sustainability, and maintainability of physical systems. CPS are also very vulnerable to security attacks and criminal activities. In addition, they are very complex and have a direct impact on their environment. Therefore, it is hard to detect and investigate security attacks, while such attacks may have a catastrophic impact on the physical world. As a result, CPS must incorporate security measures in addition to suitable and effective forensics capabilities. When the security measures fail and an attack occurs, it becomes imperative to perform thorough forensics analysis. Adding effective forensics tools and capabilities will support the investigations of incidents. This paper defines the field of CPS forensics and its dimensions: Technical, Organizational, and Legal. Then, it reviews examples of current research efforts in the field and the types of tools and methods they propose for CPS forensics. In addition, it discusses the issues and challenges in the field that need to be addressed by researchers and developers of CPS. The paper then uses the review outcomes to discuss future research directions to address challenges and create a more effective, efficient, and safe forensics tools and for CPS. This discussion aims to create a starting point for researchers where they can identify the gaps and challenges and create suitable solutions through their research in CPS forensics.<\/jats:p>","DOI":"10.3390\/jsan9030037","type":"journal-article","created":{"date-parts":[[2020,8,5]],"date-time":"2020-08-05T06:02:21Z","timestamp":1596607341000},"page":"37","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":31,"title":["Cyber\u2013Physical Systems Forensics: Today and Tomorrow"],"prefix":"10.3390","volume":"9","author":[{"given":"Nader","family":"Mohamed","sequence":"first","affiliation":[{"name":"Department of Computer Science, Information Systems, and Engineering, California University of Pennsylvania, California, PA 15419, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1376-0052","authenticated-orcid":false,"given":"Jameela","family":"Al-Jaroodi","sequence":"additional","affiliation":[{"name":"Department of Engineering, Robert Morris University, Moon Township, PA 15108, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4582-409X","authenticated-orcid":false,"given":"Imad","family":"Jawhar","sequence":"additional","affiliation":[{"name":"Faculty of Engineering, Al Maaref University, Beirut 1600, Lebanon"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2020,8,5]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Lee, E.A. (2008, January 5\u20137). Cyber physical systems: Design challenges. Proceedings of the 11th IEEE Symposium on Object Oriented Real-Time Distributed Computing (ISORC), Orlando, FL, USA.","DOI":"10.1109\/ISORC.2008.25"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1016\/j.mfglet.2014.12.001","article-title":"A cyber-physical systems architecture for industry 4.0-based manufacturing systems","volume":"3","author":"Lee","year":"2015","journal-title":"Manuf. Lett."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"18008","DOI":"10.1109\/ACCESS.2019.2897045","article-title":"Leveraging the Capabilities of Industry 4.0 for Improving Energy Efficiency in Smart Factories","volume":"7","author":"Mohamed","year":"2019","journal-title":"IEEE Access"},{"key":"ref_4","first-page":"75","article-title":"Challenges and research directions in medical cyber\u2013physical systems","volume":"100","author":"Lee","year":"2011","journal-title":"Proc. IEEE"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Mohamed, N., and Al-Jaroodi, J. (2019, January 8\u201311). The Impact of Industry 4.0 on Healthcare System Engineering. Proceedings of the 13th Annual IEEE International Systems Conference (SYSCON), Orlando, FL, USA.","DOI":"10.1109\/SYSCON.2019.8836715"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"742","DOI":"10.1016\/j.rser.2018.04.013","article-title":"Smart buildings as Cyber-Physical Systems: Data-driven predictive control strategies for energy efficiency","volume":"99","author":"Schmidt","year":"2018","journal-title":"Renew. Sustain. Energy Rev."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Lazarova-Molnar, S., Shaker, H.R., and Mohamed, N. (2016, January 9\u201311). Reliability of Cyber Physical Systems with Focus on Building Management Systems. Proceedings of the IEEE Int\u2019l Performance Computing and Communications Conference (IPCCC), Las Vegas, NV, USA.","DOI":"10.1109\/PCCC.2016.7820666"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Deka, L., Khan, S.M., Chowdhury, M., and Ayres, N. (2018). Transportation cyber-physical system and its importance for future mobility. Transportation Cyber-Physical Systems, Elsevier.","DOI":"10.1016\/B978-0-12-814295-0.00001-0"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Rajkumar, R., Lee, I., Sha, L., and Stankovic, J. (2010, January 13\u201318). Cyber-physical systems: The next computing revolution. Proceedings of the Design Automation Conference, Anaheim, CA, USA.","DOI":"10.1145\/1837274.1837461"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Karnouskos, S. (2011, January 7\u201310). Stuxnet worm impact on industrial cyber-physical system security. Proceedings of the IECON 2011-37th Annual Conference of the IEEE Industrial Electronics Society, Melbourne, Victoria, Australia.","DOI":"10.1109\/IECON.2011.6120048"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Christen, M., Gordijn, B., and Loi, M. (2020). Cybersecurity of Critical Infrastructure. The Ethics of Cybersecurity, The International Library of Ethics, Law and Technology, Springer.","DOI":"10.1007\/978-3-030-29053-5"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"41432","DOI":"10.1109\/ACCESS.2018.2856509","article-title":"PsCPS: A Distributed Platform for Cloud and Fog Integrated Smart Cyber-Physical Systems","volume":"6","author":"Mohamed","year":"2018","journal-title":"IEEE Access"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Nazarenko, A.A., and Camarinha-Matos, L.M. (2017, January 5). Towards collaborative cyber-physical systems. Proceedings of the International Young Engineers Forum (YEF-ECE), Costa de Caparica (Lisbon), Portugal.","DOI":"10.1109\/YEF-ECE.2017.7935633"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"132","DOI":"10.1016\/j.compind.2018.02.009","article-title":"Security framework for industrial collaborative robotic cyber-physical systems","volume":"97","author":"Khalid","year":"2018","journal-title":"Comput. Ind."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"29","DOI":"10.1145\/3292384.3292389","article-title":"A service-oriented middleware framework for manufacturing industry 4.0","volume":"15","author":"Mohamed","year":"2018","journal-title":"ACM SIGBED Rev."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Simmon, E., Kim, K.S., Subrahmanian, E., Lee, R., De Vaulx, F., Murakami, Y., Zettsu, K., and Sriram, R.D. (2013). A Vision of Cyber-Physical Cloud Computing for Smart Networked Systems.","DOI":"10.6028\/NIST.IR.7951"},{"key":"ref_17","unstructured":"Lyman, M.D. (2001). Criminal Investigation: The Art and the Science, Prentice Hall."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Bell, S. (2008). Crime and Circumstance: Investigating the History of Forensic Science, ABC-CLIO.","DOI":"10.5040\/9798400633614"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"253","DOI":"10.1146\/annurev.en.37.010192.001345","article-title":"Forensic entomology in criminal investigations","volume":"37","author":"Catts","year":"1992","journal-title":"Annu. Rev. Entomol."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"59","DOI":"10.1109\/MSP.2005.95","article-title":"Computer forensics","volume":"3","author":"Allen","year":"2005","journal-title":"IEEE Secur. Priv."},{"key":"ref_21","unstructured":"Casey, E. (2011). Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet, Academic Press."},{"key":"ref_22","unstructured":"Casey, E. (2001). Handbook of Computer Crime Investigation: Forensic Tools and Technology, Elsevier."},{"key":"ref_23","unstructured":"Taylor, R.W., Fritsch, E.J., and Liederbach, J. (2014). Digital Crime and Digital Terrorism, Prentice Hall Press."},{"key":"ref_24","first-page":"1","article-title":"An examination of digital forensic models","volume":"1","author":"Reith","year":"2002","journal-title":"Int. J. Digit. Evid."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Wang, Y., and Lee, H.C. (2013, January 22\u201323). Research on some relevant problems in computer forensics. Proceedings of the 2nd International Conference on Computer Science and Electronics Engineering, Hangzhou, China.","DOI":"10.2991\/iccsee.2013.393"},{"key":"ref_26","unstructured":"Andersson, V. (2018). Standards and Methodologies for Evaluating Digital Forensics Tools: Developing and Testing a New Methodology. [Bachelor\u2019s Thesis, Halmstad University]."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Choi, K.-S., Lee, C.S., and Louderback, E.R. (2020). Historical Evolutions of Cybercrime: From Computer Crime to Cybercrime. The Palgrave Handbook of International Cybercrime and Cyberdeviance, Springer Nature Switzerland AG.","DOI":"10.1007\/978-3-319-78440-3_2"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"1802","DOI":"10.1109\/JIOT.2017.2703172","article-title":"Cyber-physical systems security\u2014A survey","volume":"4","author":"Humayed","year":"2017","journal-title":"IEEE Internet Things J."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"81","DOI":"10.1016\/j.cose.2017.04.005","article-title":"Cyber physical systems security: Analysis, challenges and solutions","volume":"68","author":"Ashibani","year":"2017","journal-title":"Comput. Secur."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Wang, E.Y., Ye, Y., Xu, X., Yiu, S.M., Hui, L.C.K., and Chow, K.P. (2010, January 18\u201320). Security issues and challenges for cyber physical system. Proceedings of the IEEE\/ACM Int\u2019l Conference on Green Computing and Communications & Int\u2019l Conference on Cyber, Physical and Social Computing, Hangzhou, China.","DOI":"10.1109\/GreenCom-CPSCom.2010.36"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"212","DOI":"10.1016\/j.compind.2018.04.017","article-title":"Cyber-physical systems and their security issues","volume":"100","author":"Alguliyev","year":"2018","journal-title":"Comput. Ind."},{"key":"ref_32","unstructured":"Neuman, C. (2009). Challenges in security for cyber-physical systems. DHS Workshop on Future Directions in Cyber-Physical Systems Security, Available online: http:\/\/citeseerx.ist.psu.edu\/viewdoc\/download?doi=10.1.1.152.973&rep=rep1&type=pdf."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"283","DOI":"10.1109\/JPROC.2011.2165689","article-title":"Ensuring safety, security, and sustainability of mission-critical cyber\u2013physical systems","volume":"100","author":"Banerjee","year":"2011","journal-title":"Proc. IEEE"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"38","DOI":"10.1109\/JPROC.2017.2780172","article-title":"Wireless communication and security issues for cyber-physical systems and the Internet-of-Things","volume":"106","author":"Burg","year":"2017","journal-title":"Proc. IEEE"},{"key":"ref_35","unstructured":"Cardenas, A., Amin, S., Sinopoli, B., Giani, A., Perrig, A., and Sastry, S. (2009). Challenges for securing cyber physical systems. Workshop on Future Directions in Cyber-Physical Systems Security, Available online: http:\/\/citeseerx.ist.psu.edu\/viewdoc\/download?doi=10.1.1.152.5198&rep=rep1&type=pdf."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"210","DOI":"10.1109\/JPROC.2011.2165269","article-title":"Cyber\u2013physical system security for the electric power grid","volume":"100","author":"Sridhar","year":"2011","journal-title":"Proc. IEEE"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Sun, C.C., Liu, C.C., and Xie, J. (2016). Cyber-physical system security of a power grid: State-of-the-art. Electronics, 5.","DOI":"10.3390\/electronics5030040"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"567","DOI":"10.1007\/s11633-015-0923-9","article-title":"Cyber-physical system security for networked industrial processes","volume":"12","author":"Huang","year":"2015","journal-title":"Int. J. Autom. Comput."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"74","DOI":"10.1016\/j.mfglet.2014.01.005","article-title":"Cyber-physical security challenges in manufacturing systems","volume":"2","author":"Wells","year":"2014","journal-title":"Manuf. Lett."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"215","DOI":"10.1109\/TMSCS.2016.2569446","article-title":"Introduction to cyber-physical system security: A cross-layer perspective","volume":"3","author":"Wurm","year":"2016","journal-title":"IEEE Trans. Multi-Scale Comput. Syst."},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"291","DOI":"10.1007\/s10669-015-9540-y","article-title":"Systems engineering framework for cyber physical security and resilience","volume":"35","author":"DiMase","year":"2015","journal-title":"Environ. Syst. Decis."},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"39","DOI":"10.1016\/j.ijcip.2015.08.003","article-title":"A multi-layered and kill-chain based security analysis framework for cyber-physical systems","volume":"11","author":"Hahn","year":"2015","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Ruan, K., Carthy, J., Kechadi, T., and Crosbie, M. (2011). Cloud forensics. IFIP International Conference on Digital Forensics, Springer.","DOI":"10.1007\/978-3-642-24212-0_3"},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"34","DOI":"10.1016\/j.diin.2013.02.004","article-title":"Cloud forensics definitions and critical criteria for cloud forensic capability: An overview of survey results","volume":"10","author":"Ruan","year":"2013","journal-title":"Digit. Investig."},{"key":"ref_45","unstructured":"Dykstra, J., and Sherman, A.T. (2011). Understanding Issues in Cloud Forensics: Two Hypothetical Case Studies, ADFSL Conference on Digital Forensics, Security and Law."},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"193","DOI":"10.1016\/j.compeleceng.2017.02.006","article-title":"Forensics framework for cloud computing","volume":"60","author":"Alex","year":"2017","journal-title":"Comput. Electr. Eng."},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"105","DOI":"10.1109\/MCOM.2017.1700322","article-title":"Vehicular fog computing: Architecture, use case, and security and forensic challenges","volume":"55","author":"Huang","year":"2017","journal-title":"IEEE Commun. Mag."},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"19293","DOI":"10.1109\/ACCESS.2017.2749422","article-title":"Security and privacy in fog computing: Challenges","volume":"5","author":"Mukherjee","year":"2017","journal-title":"IEEE Access"},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"13","DOI":"10.1109\/MCC.2017.30","article-title":"Challenges of connecting edge and cloud computing: A security and forensic perspective","volume":"4","author":"Esposito","year":"2017","journal-title":"IEEE Cloud Comput."},{"key":"ref_50","doi-asserted-by":"crossref","unstructured":"Mylonas, A., Meletiadis, V., Tsoumas, B., Mitrou, L., and Gritzalis, D. (2012). Smartphone forensics: A proactive investigation scheme for evidence acquisition. IFIP International Information Security Conference, Springer.","DOI":"10.1007\/978-3-642-30436-1_21"},{"key":"ref_51","doi-asserted-by":"crossref","first-page":"51","DOI":"10.1016\/j.cose.2013.03.007","article-title":"Smartphone sensor data as digital evidence","volume":"38","author":"Mylonas","year":"2013","journal-title":"Comput. Secur."},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"S12","DOI":"10.1016\/j.diin.2013.06.002","article-title":"Android forensics: Automated data collection and reporting from a mobile device","volume":"10","author":"Grover","year":"2013","journal-title":"Digit. Investig."},{"key":"ref_53","unstructured":"Mahalik, H., Tamma, R., and Bommisetty, S. (2016). Practical Mobile Forensics, Packt Publishing Ltd."},{"key":"ref_54","doi-asserted-by":"crossref","unstructured":"MacDermott, A., Baker, T., and Shi, Q. (2018, January 26\u201328). Iot forensics: Challenges for the ioa era. Proceedings of the 9th IFIP International Conference on New Technologies, Mobility and Security (NTMS), Paris, France.","DOI":"10.1109\/NTMS.2018.8328748"},{"key":"ref_55","unstructured":"Meffert, C., Clark, D., Baggili, I., and Breitinger, F. (September, January 29). Forensic State Acquisition from Internet of Things (FSAIoT) A general framework and practical approach for IoT forensics through IoT device state acquisition. Proceedings of the 12th International Conference on Availability, Reliability and Security, Reggio Calabria, Italy."},{"key":"ref_56","doi-asserted-by":"crossref","first-page":"265","DOI":"10.1016\/j.future.2018.09.058","article-title":"Internet of things forensics: Recent advances, taxonomy, requirements, and open challenges","volume":"92","author":"Yaqoob","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_57","doi-asserted-by":"crossref","first-page":"544","DOI":"10.1016\/j.future.2017.07.060","article-title":"Internet of Things security and forensics: Challenges and opportunities","volume":"78","author":"Conti","year":"2018","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_58","doi-asserted-by":"crossref","first-page":"44","DOI":"10.1109\/MC.2012.325","article-title":"Scada systems: Challenges for forensic investigators","volume":"45","author":"Ahmed","year":"2012","journal-title":"Computer"},{"key":"ref_59","doi-asserted-by":"crossref","first-page":"174","DOI":"10.1109\/TSUSC.2017.2782737","article-title":"Secure automated forensic investigation for sustainable critical infrastructures compliant with green computing requirements","volume":"5","author":"Elhoseny","year":"2017","journal-title":"IEEE Trans. Sustain. Comput."},{"key":"ref_60","doi-asserted-by":"crossref","unstructured":"Hilal, H., and Nangim, A. (2017, January 21\u201323). Network security analysis SCADA system automation on industrial process. Proceedings of the 2017 International Conference on Broadband Communication, Wireless Sensors and Powering (BCWSP), Jakarta, Indonesia.","DOI":"10.1109\/BCWSP.2017.8272569"},{"key":"ref_61","doi-asserted-by":"crossref","unstructured":"Sohl, E., Fielding, C., Hanlon, T., Rrushi, J., Farhangi, H., Howey, C., Carmichael, K., and Dabell, J. (2015, January 12). A field study of digital forensics of intrusions in the electrical power grid. Proceedings of the First ACM Workshop on Cyber-Physical Systems-Security and\/or PrivaCy, Denver, CO, USA.","DOI":"10.1145\/2808705.2808716"},{"key":"ref_62","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.comnet.2018.03.024","article-title":"Cyber-physical systems information gathering: A smart home case study","volume":"138","author":"Do","year":"2018","journal-title":"Comput. Netw."},{"key":"ref_63","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1016\/j.diin.2017.06.015","article-title":"Future challenges for smart cities: Cyber-security and digital forensics","volume":"22","author":"Baig","year":"2017","journal-title":"Digit. Investig."},{"key":"ref_64","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1109\/MCOM.2018.1800137","article-title":"Block4forensic: An integrated lightweight blockchain framework for forensics applications of connected vehicles","volume":"56","author":"Cebe","year":"2018","journal-title":"IEEE Commun. Mag."},{"key":"ref_65","doi-asserted-by":"crossref","unstructured":"Al Faruque, M.A., Chhetri, S.R., Canedo, A., and Wan, J. (2016). Forensics of Thermal Side-Channel in Additive Manufacturing Systems, University of California.","DOI":"10.1109\/ICCPS.2016.7479068"},{"key":"ref_66","unstructured":"North America Electric Reliability Corp, Defense Use Case (2016). Analysis of the Cyber Attack on the Ukrainian Power Grid, SANS Ind. Control Syst.. Tech. Rep."},{"key":"ref_67","doi-asserted-by":"crossref","first-page":"81","DOI":"10.1080\/00396338.2013.784468","article-title":"The Cyber Attack on Saudi Aramco","volume":"55","author":"Bronk","year":"2013","journal-title":"Survival"},{"key":"ref_68","doi-asserted-by":"crossref","first-page":"365","DOI":"10.1080\/09636412.2013.816122","article-title":"Stuxnet and the Limits of Cyber Warfare","volume":"22","author":"Lindsay","year":"2013","journal-title":"Secur. Stud."},{"key":"ref_69","first-page":"499","article-title":"Cyber-security incidents: A review cases in cyber-physical systems","volume":"9","author":"Ahmad","year":"2018","journal-title":"Int. J. Adv. Comput. Sci. Appl."},{"key":"ref_70","doi-asserted-by":"crossref","first-page":"57","DOI":"10.1016\/j.future.2016.07.016","article-title":"A method for evaluating the consequence propagation of security attacks in cyber\u2013physical systems","volume":"67","author":"Orojloo","year":"2017","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_71","doi-asserted-by":"crossref","first-page":"959","DOI":"10.1109\/ACCESS.2016.2521727","article-title":"Security tradeoffs in cyber physical systems: A case study survey on implantable medical devices","volume":"4","author":"AlTawy","year":"2016","journal-title":"IEEE Access"},{"key":"ref_72","unstructured":"Plumer, B. (2020, June 30). It\u2019s Way too Easy to Cause a Massive Blackout in the US. in Vox. Available online: https:\/\/www.vox.com\/2014\/4\/14\/5604992\/us-power-grid-vulnerability."},{"key":"ref_73","first-page":"18","article-title":"Defining Digital Forensics","volume":"4","author":"Zatyko","year":"2007","journal-title":"Forensic Mag."},{"key":"ref_74","unstructured":"Nelson, B., Phillips, A., and Steuart, C. (2016). Guide to Computer Forensics and Investigations, Cengage Learning. [5th ed.]."},{"key":"ref_75","doi-asserted-by":"crossref","first-page":"14","DOI":"10.1016\/j.diin.2010.02.003","article-title":"Network forensic frameworks: Survey and research challenges","volume":"7","author":"Pilli","year":"2010","journal-title":"Digit. Investig."},{"key":"ref_76","doi-asserted-by":"crossref","first-page":"1052","DOI":"10.1109\/JSYST.2013.2257594","article-title":"Intrusion detection in cyber-physical systems: Techniques and challenges","volume":"8","author":"Han","year":"2014","journal-title":"IEEE Syst. J."},{"key":"ref_77","doi-asserted-by":"crossref","first-page":"55","DOI":"10.1145\/2542049","article-title":"A survey of intrusion detection techniques for cyber-physical systems","volume":"46","author":"Mitchell","year":"2014","journal-title":"ACM Comput. Surv. (CSUR)"},{"key":"ref_78","unstructured":"(2020, June 01). E-Government Act of 2002, US Department of Justice, Available online: https:\/\/www.justice.gov\/opcl\/e-government-act-2002."},{"key":"ref_79","first-page":"21","article-title":"The General Data Protection Regulation: The next generation of EU data protection","volume":"18","author":"Bhaimia","year":"2018","journal-title":"Leg. Inf. Manag."},{"key":"ref_80","unstructured":"Catea, R.M. (2018). Challenges of the Not-So-Far Future: EU Robotics and AI Law in Business. Chall. Knowl. Soc., 213\u2013216."},{"key":"ref_81","doi-asserted-by":"crossref","unstructured":"Huang, J., Ling, Z., Xiang, T., Wang, J., and Fu, X. (2012, January 18\u201321). When digital forensic research meets laws. Proceedings of the 32nd International Conference on Distributed Computing Systems Workshops, Macau, China.","DOI":"10.1109\/ICDCSW.2012.45"},{"key":"ref_82","doi-asserted-by":"crossref","unstructured":"Montasari, R., and Hill, R. (2019, January 16\u201318). Next-generation digital forensics: Challenges and future paradigms. Proceedings of the 12th International Conference on Global Security, Safety and Sustainability (ICGS3), London, UK.","DOI":"10.1109\/ICGS3.2019.8688020"},{"key":"ref_83","doi-asserted-by":"crossref","unstructured":"Clever, S., Crago, T., Polka, A., Al-Jaroodi, J., and Mohamed, N. (2018). Ethical Analyses of Smart City Applications. Urban Sci., 2.","DOI":"10.3390\/urbansci2040096"},{"key":"ref_84","first-page":"481","article-title":"Legal Obligations of States Directly Affected by Cyber-Incidents","volume":"48","author":"Gross","year":"2015","journal-title":"Cornell Int. Law J."},{"key":"ref_85","doi-asserted-by":"crossref","unstructured":"Awad, R.A., Beztchi, S., Smith, J.M., Lyles, B., and Prowell, S. (2018, January 4). Tools, techniques, and methodologies: A survey of digital forensics for scada systems. Proceedings of the 4th Annual Industrial Control System Security Workshop, San Juan, PR, USA.","DOI":"10.1145\/3295453.3295454"},{"key":"ref_86","doi-asserted-by":"crossref","unstructured":"Mishra, S. (2019). Forensic Investigation Framework for Complex Cyber Attack on Cyber Physical System by Using Goals\/Sub-goals of an Attack and Epidemics of Malware in a System. Recent Trends in Communication, Computing, and Electronics, Springer.","DOI":"10.1007\/978-981-13-2685-1_47"},{"key":"ref_87","doi-asserted-by":"crossref","unstructured":"Aliabadi, M.R., Kamath, A.A., Gascon-Samson, J., and Pattabiraman, K. (2017, January 4\u20138). ARTINALI: Dynamic invariant detection for cyber-physical system security. Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering, Paderborn, Germany.","DOI":"10.1145\/3106237.3106282"},{"key":"ref_88","doi-asserted-by":"crossref","first-page":"1337","DOI":"10.1109\/TII.2014.2304633","article-title":"Cyber-physical system security with deceptive virtual hosts for industrial control networks","volume":"10","author":"Vollmer","year":"2014","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_89","first-page":"53","article-title":"Crawler and Spiderin usage in Cyber-Physical Systems Forensics","volume":"1","author":"Abedi","year":"2018","journal-title":"OIC-CERT J. Cyber Secur."},{"key":"ref_90","unstructured":"Alrimawi, F., Pasquale, L., Mehta, D., and Nuseibeh, B. (June, January 27). I\u2019ve seen this before: Sharing cyber-physical incident knowledge. Proceedings of the 1st International Workshop on Security Awareness from Design to Deployment, Gothenburg, Sweden."},{"key":"ref_91","doi-asserted-by":"crossref","unstructured":"Chan, R., and Chow, K.P. (2016). Forensic analysis of a Siemens programmable logic controller. International Conference on Critical Infrastructure Protection, Springer.","DOI":"10.1007\/978-3-319-48737-3_7"},{"key":"ref_92","doi-asserted-by":"crossref","unstructured":"Abeykoon, I., and Feng, X. (2017, January 21\u201323). A forensic investigation of the robot operating system. Proceedings of the 2017 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData), Exeter, UK.","DOI":"10.1109\/iThings-GreenCom-CPSCom-SmartData.2017.131"},{"key":"ref_93","doi-asserted-by":"crossref","first-page":"1217","DOI":"10.1016\/j.future.2018.07.028","article-title":"Live forensics of software attacks on cyber\u2013physical systems","volume":"108","author":"Alawneh","year":"2020","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_94","doi-asserted-by":"crossref","unstructured":"Grispos, G., Glisson, W.B., and Choo, K.R. (2017, January 17\u201319). Medical cyber-physical systems development: A forensics-driven approach. Proceedings of the 2nd IEEE\/ACM International Conference on Connected Health: Applications, Systems and Engineering Technologies, Philadelphia, PA, USA.","DOI":"10.1109\/CHASE.2017.68"},{"key":"ref_95","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1109\/MCC.2016.5","article-title":"Forensic-by-design framework for cyber-physical cloud systems","volume":"3","author":"Glisson","year":"2016","journal-title":"IEEE Cloud Comput."},{"key":"ref_96","doi-asserted-by":"crossref","unstructured":"Jones, A., Vidalis, S., and Abouzakhar, N. (2016, January 19\u201321). Information security and digital forensics in the world of cyber physical systems. Proceedings of the 2016 Eleventh International Conference on Digital Information Management (ICDIM), Porto, Portugal.","DOI":"10.1109\/ICDIM.2016.7829795"},{"key":"ref_97","doi-asserted-by":"crossref","first-page":"128","DOI":"10.1016\/j.compind.2016.02.004","article-title":"Big Data and virtualization for manufacturing cyber-physical systems: A survey of the current status and future outlook","volume":"81","author":"Babiceanu","year":"2016","journal-title":"Comput. Ind."},{"key":"ref_98","doi-asserted-by":"crossref","unstructured":"Guarino, A. (2013). Digital forensics as a big data challenge. ISSE 2013 Securing Electronic Business Processes, Springer.","DOI":"10.1007\/978-3-658-03371-2_17"},{"key":"ref_99","doi-asserted-by":"crossref","unstructured":"Zawoad, S., and Hasan, R. (2015, January 24\u201326). Digital forensics in the age of big data: Challenges, approaches, and opportunities. Proceedings of the 17th International Conference on High Performance Computing and Communications, 7th International Symposium on Cyberspace Safety and Security, and 12th International Conference on Embedded Software and Systems, New York, NY, USA.","DOI":"10.1109\/HPCC-CSS-ICESS.2015.305"},{"key":"ref_100","doi-asserted-by":"crossref","first-page":"36500","DOI":"10.1109\/ACCESS.2019.2903554","article-title":"Blockchain in Industries: A Survey","volume":"7","author":"Mohamed","year":"2019","journal-title":"IEEE Access"},{"key":"ref_101","doi-asserted-by":"crossref","unstructured":"Mohamed, N., and Al-Jaroodi, J. (2019, January 7\u20139). Applying blockchain in industry 4.0 applications. Proceedings of the 2019 IEEE 9th Annual Computing and Communication Workshop and Conference (CCWC), Las Vegas, NV, USA.","DOI":"10.1109\/CCWC.2019.8666558"},{"key":"ref_102","doi-asserted-by":"crossref","first-page":"8","DOI":"10.1109\/MNET.001.1900178","article-title":"Securing Smart Cities through Blockchain Technology: Architecture, Requirements, and Challenges","volume":"34","author":"Hakak","year":"2020","journal-title":"IEEE Netw."},{"key":"ref_103","doi-asserted-by":"crossref","unstructured":"Melhem, A., AlZoubi, O., Mardini, W., and Yassein, M.B. (2019, January 2\u20135). Applications of blockchain in smart cities. Proceedings of the 2nd International Conference on Data Science, E-Learning and Information Systems, Dubai, Arab Emirate.","DOI":"10.1145\/3368691.3368726"},{"key":"ref_104","doi-asserted-by":"crossref","first-page":"16","DOI":"10.1016\/S1353-4858(11)70086-1","article-title":"Advanced persistent threats and how to monitor and deter them","volume":"8","author":"Tankard","year":"2011","journal-title":"Netw. Secur."},{"key":"ref_105","doi-asserted-by":"crossref","first-page":"300","DOI":"10.1504\/IJTMCC.2013.056440","article-title":"Slow DoS attacks: Definition and categorization","volume":"1","author":"Cambiaso","year":"2013","journal-title":"Int. J. Trust. Manag. Comput. Commun."},{"key":"ref_106","doi-asserted-by":"crossref","unstructured":"Thuraisingham, B., Kantarcioglu, M., Hamlen, K., Khan, L., Finin, T., Joshi, A., Oates, T., and Bertino, E. (2016, January 28\u201330). A data driven approach for the science of cyber security: Challenges and directions. Proceedings of the IEEE 17th International Conference on Information Reuse and Integration (IRI), Pittsburgh, PA, USA.","DOI":"10.1109\/IRI.2016.10"},{"key":"ref_107","first-page":"51","article-title":"Understanding the relationship between human behavior and susceptibility to cyber attacks: A data-driven approach","volume":"8","author":"Prakash","year":"2017","journal-title":"ACM Trans. Intell. Syst. Technol. (TIST)"},{"key":"ref_108","unstructured":"Siminoff, J., Mitura, M.J., and Amazon Technologies Inc. (2018). Behavior-Aware Security Systems and Associated Methods. (Application 16\/001,627), U.S. Patent."},{"key":"ref_109","doi-asserted-by":"crossref","first-page":"12103","DOI":"10.1109\/ACCESS.2018.2805680","article-title":"A survey on security threats and defensive techniques of machine learning: A data driven view","volume":"6","author":"Liu","year":"2018","journal-title":"IEEE Access"},{"key":"ref_110","doi-asserted-by":"crossref","first-page":"335","DOI":"10.1016\/j.procir.2016.11.152","article-title":"The digital twin: Realizing the cyber-physical production system for industry 4.0","volume":"61","author":"Uhlemann","year":"2017","journal-title":"Procedia Cirp"},{"key":"ref_111","doi-asserted-by":"crossref","first-page":"124","DOI":"10.1016\/j.ijepes.2017.01.016","article-title":"Real-time cyber physical system testbed for power system security and control","volume":"90","author":"Poudel","year":"2017","journal-title":"Int. J. Electr. Power Energy Syst."},{"key":"ref_112","doi-asserted-by":"crossref","first-page":"847","DOI":"10.1109\/TSG.2012.2226919","article-title":"Cyber-physical security testbeds: Architecture, application, and evaluation for smart grid","volume":"4","author":"Hahn","year":"2013","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_113","unstructured":"Covington, M.J., Fogla, P., Zhan, Z., and Ahamad, M.A. (2002, January 9\u201313). A context-aware security architecture for emerging applications. Proceedings of the 18th Annual Computer Security Applications Conference, Las Vegas, NV, USA."}],"container-title":["Journal of Sensor and Actuator Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2224-2708\/9\/3\/37\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T09:54:29Z","timestamp":1760176469000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2224-2708\/9\/3\/37"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,8,5]]},"references-count":113,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2020,9]]}},"alternative-id":["jsan9030037"],"URL":"https:\/\/doi.org\/10.3390\/jsan9030037","relation":{},"ISSN":["2224-2708"],"issn-type":[{"value":"2224-2708","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,8,5]]}}}