A metamodeling approach for iot forensic investigation

Abstract

The Internet of Things (IoT) Investigation of Forensics (IoTFI) is one of the subdomains of Digital Forensics that aims to record and evaluate incidents involving the Internet of Things (IoT). Because of the many different standards, operating systems, and infrastructure-based aspects that make up the Internet of Things industry, this sector is extremely varied, ambiguate, and complicated. Many distinct IoTFI models and frameworks were developed, each one based on a unique set of investigation procedures and activities tailored to a particular IoT scenario. Because of these models, the domain becomes increasingly complicated and disorganized among those who perform domain forensics. As a result, the IoTFI domain does not have a general model for managing, sharing, and reusing the processes and activities that it offers. With the use of the metamodeling development process, this work aims to create an Internet of Things Forensic Investigation Metamodel (IoTFIM) for the IoTFI domain. Utilizing the metamodeling development process allows for the construction and validation of a metamodel and the verification that the metamodel is both comprehensive and consistent. The IoTFIM is divided into two phases: the first phase identifies the problem, and the second phase develops the IoTFIM. It is utilized to structure and organize IoTFI domain knowledge, which makes it easier for domain forensic practitioners to manage, organize, share, and reuse IoTFI domain knowledge. The purpose of this is to detect, recognize, extract, and match various IoTFI processes, concepts, activities, and tasks from various IoTFI models in an IoTFIM that was established, facilitating the process of deriving and instantiating solution models for domain practitioners. Utilizing several metamodeling methodologies, we were able to validate the generated IoTFMI’s consistency as well as its applicability (comparison against other models, frequency-based selection). Based on the findings, it can be concluded that the built IoTFIM is consistent and coherent. This makes it possible for domain forensic practitioners to simply instantiate new solution models by picking and combining concept elements (attribute and operations) based on the requirements of their models.