Cross-layer forensic investigation is addressed for Industrial Internet of Things (IIoT) device attacks in Critical Infrastructure (CI) applications. The operational motivation for cross-layer investigation is provided by the desire to directly correlate bit-level network anomaly detection with physical layer (PHY) device connectivity and/or status (normal, defective, attacked, etc.) at the time of attack. The technical motivation for developing cross-layer techniques is motivated by (a) having considerable capability in place for Higher-Layer Digital Forensic Information exploitation—real-time network cyberattack and postattack analysis, (b) having considerably less capability in place for Lowest-Layer PHY Forensic Information exploitation—the PHY domain remains largely under exploited, and (c) considering cyber-physical integration as a means to jointly exploit higher-layer digital and lowest-layer PHY forensic information to maximize investigative benefit in IIoT cyber forensics. A delineation of higher-layer digital and lowest-layer PHY elements is provided for the standard network Open Systems Interconnection model and the specific Perdue Enterprise Reference Architecture commonly used in IIoT Industrial Control System/Supervisory Control and Data Acquisition applications. Finally, a forensics work summary is provided for each delineated area based on selected representative publications and provides the basis for presenting the envisioned cross-layer forensic investigation.
@article{osti_1491327,
author = {Rondeau, Christopher M. and Temple, Michael and Lopez Jr, Juan},
title = {Industrial IoT cross-layer forensic investigation},
annote = {Cross-layer forensic investigation is addressed for Industrial Internet of Things (IIoT) device attacks in Critical Infrastructure (CI) applications. The operational motivation for cross-layer investigation is provided by the desire to directly correlate bit-level network anomaly detection with physical layer (PHY) device connectivity and/or status (normal, defective, attacked, etc.) at the time of attack. The technical motivation for developing cross-layer techniques is motivated by (a) having considerable capability in place for Higher-Layer Digital Forensic Information exploitation—real-time network cyberattack and postattack analysis, (b) having considerably less capability in place for Lowest-Layer PHY Forensic Information exploitation—the PHY domain remains largely under exploited, and (c) considering cyber-physical integration as a means to jointly exploit higher-layer digital and lowest-layer PHY forensic information to maximize investigative benefit in IIoT cyber forensics. A delineation of higher-layer digital and lowest-layer PHY elements is provided for the standard network Open Systems Interconnection model and the specific Perdue Enterprise Reference Architecture commonly used in IIoT Industrial Control System/Supervisory Control and Data Acquisition applications. Finally, a forensics work summary is provided for each delineated area based on selected representative publications and provides the basis for presenting the envisioned cross-layer forensic investigation.},
doi = {10.1002/wfs2.1322},
url = {https://www.osti.gov/biblio/1491327},
journal = {WIREs. Forensic Science},
issn = {ISSN 2573-9468},
number = {1},
volume = {1},
place = {United States},
publisher = {Wiley},
year = {2018},
month = {12}}
2015 IEEE 17th International Conference on High-Performance Computing and Communications; 2015 IEEE 7th International Symposium on Cyberspace Safety and Security; and 2015 IEEE 12th International Conference on Embedded Software and Systems, 2015 IEEE 17th International Conference on High Performance Computing and Communications, 2015 IEEE 7th International Symposium on Cyberspace Safety and Security, and 2015 IEEE 12th International Conference on Embedded Software and Systemshttps://doi.org/10.1109/HPCC-CSS-ICESS.2015.305
2016 3rd International Conference on Advanced Computing and Communication Systems (ICACCS ), 2016 3rd International Conference on Advanced Computing and Communication Systems (ICACCS)https://doi.org/10.1109/ICACCS.2016.7586396
3rd International Symposium for ICS & SCADA Cyber Security Research 2015 (ICS-CSR 2015), Electronic Workshops in Computinghttps://doi.org/10.14236/ewic/ICS2015.5
