VTA-IH: A Fog-based Digital Forensics Framework

The wide acceptance of the Internet of Things (IoT) paradigm has contributed in recent years to a significant increase in the number of IoT applications and the existence of IoT devices generating large volumes of data. As a result, IoT devices have become vulnerable to cyberattacks. In addition, conventional digital forensics approaches are no longer effective for investigating a digital crime involving IoT devices and extracting traces across heterogeneous devices. To overcome these challenges, we propose VTA-IH, a fog-based digital forensics framework that employs a Complex Events Processing (CEP) model for intelligently identifying abnormalities in real-time events associated with IoT data streams. To this extent, we devise a Degree of Abnormality (DA) penalty mechanism that is adapted to identify vulnerabilities, threat, or attack patterns using multiple rules across devices and network-related events across fog environments. Throughout the paper, we discuss the architecture of the VTA-IH framework and demonstrate usefulness of the proposed CEP approach. Our proposed VTA-IH framework can be used in applications such as industrial IoT, autonomous vehicles, smart home systems, smart farming, among others.