IoTScent: Enhancing Forensic Capabilities in Internet of Things Gateways

TL;DR

IoTScent is an open-source forensic tool designed to capture and analyze IEEE 802.15.4-based IoT traffic, aiding digital investigations by simplifying data collection and feature extraction from IoT gateways.

Contribution

The paper introduces IoTScent, a novel tool specifically for IEEE 802.15.4 IoT traffic, with live capture, feature extraction, and practical device identification capabilities.

Findings

Effective traffic capture over Zigbee protocols.

Automated feature extraction for forensic analysis.

Successful device identification from Zigbee traffic.

Abstract

The widespread deployment of Consumer Internet of Things devices in proximity to human activities makes them digital observers of our daily actions. This has led to a new field of digital forensics, known as IoT Forensics, where digital traces generated by IoT devices can serve as key evidence for forensic investigations. Thus, there is a need to develop tools that can efficiently acquire and store network traces from IoT ecosystems. This paper presents IoTScent, an open-source IoT forensic tool that enables IoT gateways and Home Automation platforms to perform IoT traffic capture and analysis. Unlike other works focusing on IP-based protocols, IoTScent is specifically designed to operate over IEEE 802.15.4-based traffic, which is the basis for many IoT-specific protocols such as Zigbee, 6LoWPAN and Thread. IoTScent offers live traffic capture and feature extraction capabilities, providing a framework for forensic data collection that simplifies the task of setting up a data collection pipeline, automating the data collection process, and providing ready-made features that can be used for forensic evidence extraction. This work provides a comprehensive description of the IoTScent tool, including a practical use case that demonstrates the use of the tool to perform device identification from Zigbee traffic. The study presented here significantly contributes to the ongoing research in IoT Forensics by addressing the challenges faced in the field and publicly releasing the IoTScent tool.