Intelligent Forensics in Next-Generation Mobile Networks: Evidence, Methods, and Applications

TL;DR

This survey introduces an evidence-centric framework for wireless forensics in next-generation mobile networks, emphasizing a unified taxonomy, forensic workflow, and addressing key challenges like domain shift and generative evidence.

Contribution

It develops a comprehensive, evidence-focused framework and taxonomy for wireless forensics, integrating traditional and AI-assisted methods, and highlights open challenges in the field.

Findings

Organized wireless forensics into a unified taxonomy across multiple layers.

Systematized forensic workflow into distinct stages for better process management.

Reviewed applications and identified key open challenges in wireless forensics.

Abstract

This survey examines intelligent forensics in next-generation mobile networks, arguing that future wireless security must move beyond real-time detection toward accountable post-incident reconstruction. Unlike traditional digital forensics, wireless investigations rely on short-lived, distributed, and heterogeneous evidence, including radio waveforms, channel measurements, device-side artifacts, and network telemetry, affected by calibration, timing uncertainty, privacy constraints, and adversarial manipulation. To address this limitation, this paper develops an evidence-centric framework that treats wireless measurements as first-class forensic artifacts and organizes the field through a unified taxonomy spanning physical-layer, device-layer, network-layer, and cross-layer forensics. We further systematize the forensic workflow into readiness and preservation-by-design, acquisition, correlation and analysis, and reporting and reproducibility, while comparing the complementary roles of traditional methods and artificial intelligence-assisted techniques. Subsequently, we review major application areas, including anomaly discovery, attribution, provenance and localization, authenticity verification, and timeline reconstruction. Finally, we identify key open challenges, including domain shift, resource-aware evidence capture, and the benefits and admissibility risks of generative evidence. Overall, this paper positions wireless forensics as a foundational capability for trustworthy, auditable, and reproducible security in next-generation wireless systems. Readers can understand and streamline wireless forensics processes for specific applications, such as low-altitude wireless networks, vehicular communications, and edge general intelligence.