Drone Disrupted Denial of Service Attack (3DOS): Towards an Incident Response and Forensic Analysis of Remotely Piloted Aerial Systems (RPASs)

Abstract

According to the Federal Aviation Administration (FAA), the number of Remotely Piloted Air Systems (RPASs), colloquially known as drones, will rapidly increase in the near future. Challenges with drones are focused not only on the security of these devices, but also on the criminal uses for drones which need to be carefully considered. Incident response and forensic analysis of such cases have not been sufficiently addressed by the research community. This paper focuses on incident response of cybercrimes related to drones as well as some possible anti-forensic techniques that could be used to alter digital evidence associated with drones. In addition, this paper also revisits the enacted regulations that purport to restrict the operation of drones in critical infrastructure areas. We evaluate drone incident response by exploring a case study using a hypothetical drone forensic tool to illustrate the acquisition of GPS metadata from both media files and flight logs, with a view towards aiding the incident responders and digital forensic investigators in analyzing illegal flight activities and report such incidents effectively.