Industrial IoT cross-layer forensic investigation

Rondeau, Christopher M.; Temple, Michael; Lopez Jr, Juan

doi:10.1002/wfs2.1322

Title: Industrial IoT cross-layer forensic investigation

Journal Article · 18 December 2018 · WIREs. Forensic Science

DOI: https://doi.org/10.1002/wfs2.1322 · OSTI ID:1491327

^[1]; Temple, Michael ^[1]; Lopez Jr, Juan ^[2]

US Air Force Institute of Technology, Wright-Patterson AFB, OH (United States)
Oak Ridge National Lab. (ORNL), Oak Ridge, TN (United States). Global Security Directorate

Cross-layer forensic investigation is addressed for Industrial Internet of Things (IIoT) device attacks in Critical Infrastructure (CI) applications. The operational motivation for cross-layer investigation is provided by the desire to directly correlate bit-level network anomaly detection with physical layer (PHY) device connectivity and/or status (normal, defective, attacked, etc.) at the time of attack. The technical motivation for developing cross-layer techniques is motivated by (a) having considerable capability in place for Higher-Layer Digital Forensic Information exploitation—real-time network cyberattack and postattack analysis, (b) having considerably less capability in place for Lowest-Layer PHY Forensic Information exploitation—the PHY domain remains largely under exploited, and (c) considering cyber-physical integration as a means to jointly exploit higher-layer digital and lowest-layer PHY forensic information to maximize investigative benefit in IIoT cyber forensics. A delineation of higher-layer digital and lowest-layer PHY elements is provided for the standard network Open Systems Interconnection model and the specific Perdue Enterprise Reference Architecture commonly used in IIoT Industrial Control System/Supervisory Control and Data Acquisition applications. Finally, a forensics work summary is provided for each delineated area based on selected representative publications and provides the basis for presenting the envisioned cross-layer forensic investigation.

View Accepted Manuscript (DOE)

Cite

Export

Save

Research Organization:: Oak Ridge National Laboratory (ORNL), Oak Ridge, TN (United States)

Sponsoring Organization:: USDOE

Grant/Contract Number:: AC05-00OR22725

OSTI ID:: 1491327

Journal Information:: WIREs. Forensic Science, Vol. 1, Issue 1; ISSN 2573-9468

Publisher:: WileyCopyright Statement

Country of Publication:: United States

Language:: English

References (37)

Information security and digital forensics in the world of cyber physical systems Jones, Andrew; Vidalis, Stilianos; Abouzakhar, Nasser 2016 Eleventh International Conference on Digital Information Management (ICDIM) https://doi.org/10.1109/ICDIM.2016.7829795	conference	September 2016
Radio Frequency Fingerprint Extraction of Radio Emitter Based on I/Q Imbalance zhuo, Fei; Huang, Yuanling; chen, Jian Procedia Computer Science, Vol. 107 https://doi.org/10.1016/j.procs.2017.03.092	journal	January 2017
Impacts of increasing volume of digital forensic data: A survey and future research challenges Quick, Darren; Choo, Kim-Kwang Raymond Digital Investigation, Vol. 11, Issue 4 https://doi.org/10.1016/j.diin.2014.09.002	journal	December 2014
Cross-Layer Attack and Defense in Cognitive Radio Networks Wang, Wenkai; Sun, Yan; Li, Husheng GLOBECOM 2010 - 2010 IEEE Global Communications Conference, 2010 IEEE Global Telecommunications Conference GLOBECOM 2010 https://doi.org/10.1109/GLOCOM.2010.5684069	conference	December 2010
A Forensic Taxonomy of SCADA Systems and Approach to Incident Response Eden, Peter; Blyth, Andrew; Burnap, Pete 3rd International Symposium for ICS & SCADA Cyber Security Research 2015 (ICS-CSR 2015), Electronic Workshops in Computing https://doi.org/10.14236/ewic/ICS2015.5	conference	September 2015
A review of passive forensic techniques for detection of copy-move attacks on digital videos Sharma, Shashank; Dhavale, Sunita V. 2016 3rd International Conference on Advanced Computing and Communication Systems (ICACCS ), 2016 3rd International Conference on Advanced Computing and Communication Systems (ICACCS) https://doi.org/10.1109/ICACCS.2016.7586396	conference	January 2016
Detecting rogue attacks on commercial wireless Insteon home automation systems Talbot, Christopher M.; Temple, Michael A.; Carbino, Timothy J. Computers & Security, Vol. 74 https://doi.org/10.1016/j.cose.2017.10.001	journal	May 2018
Authorized and Rogue Device Discrimination Using Dimensionally Reduced RF-DNA Fingerprints Reising, Donald R.; Temple, Michael A.; Jackson, Julie A. IEEE Transactions on Information Forensics and Security, Vol. 10, Issue 6 https://doi.org/10.1109/TIFS.2015.2400426	journal	June 2015
System-level design solutions: Enabling the IoT explosion Yang, Liwei; Chen, Yao; Zuo, Wei 2015 IEEE 11th International Conference on ASIC (ASICON ), 2015 IEEE 11th International Conference on ASIC (ASICON) https://doi.org/10.1109/ASICON.2015.7517023	conference	November 2015
SCADA Systems: Challenges for Forensic Investigators Ahmed, Irfan; Obermeier, Sebastian; Naedele, Martin Computer, Vol. 45, Issue 12 https://doi.org/10.1109/MC.2012.325	journal	December 2012
Forensic Readiness for SCADA/ICS Incident Response Eden, Peter; Blyth, Andrew; Burnap, Pete 4th International Symposium for ICS & SCADA Cyber Security Research 2016, Electronic Workshops in Computing https://doi.org/10.14236/ewic/ICS2016.16	conference	August 2016
Bit-level n-gram based forensic authorship analysis on social media: Identifying individuals from linguistic profiles Peng, Jian; Choo, Kim-Kwang Raymond; Ashman, Helen Journal of Network and Computer Applications, Vol. 70 https://doi.org/10.1016/j.jnca.2016.04.001	journal	July 2016
A Practical Method for Grid Structures Damage Location Yu, Zhefu; Huo, Linsheng Journal of Sensors, Vol. 2015 https://doi.org/10.1155/2015/246480	journal	January 2015
Cross-layer design for reducing delay and maximizing lifetime in industrial wireless sensor networks Tan, Jiawei; Liu, Anfeng; Zhao, Ming EURASIP Journal on Wireless Communications and Networking, Vol. 2018, Issue 1 https://doi.org/10.1186/s13638-018-1057-x	journal	March 2018
Securing ZigBee Commercial Communications Using Constellation Based Distinct Native Attribute Fingerprinting Rondeau, Christopher M.; Betances, J. Addison; Temple, Michael A. Security and Communication Networks, Vol. 2018 https://doi.org/10.1155/2018/1489347	journal	July 2018
Guide to Industrial Control Systems (ICS) Security Stouffer, Keith; Pillitteri, Victoria; Lightman, Suzanne https://doi.org/10.6028/NIST.SP.800-82r2	report	May 2015
Incident Analysis & Digital Forensics in SCADA and Industrial Control Systems Spyridopoulos, T.; May, J.; Tryfonas, T. 8th IET International System Safety Conference incorporating the Cyber Security Conference 2013 https://doi.org/10.1049/cp.2013.1720	conference	January 2013
Network forensic frameworks: Survey and research challenges Pilli, Emmanuel S.; Joshi, R. C.; Niyogi, Rajdeep Digital Investigation, Vol. 7, Issue 1-2 https://doi.org/10.1016/j.diin.2010.02.003	journal	October 2010
FAIoT: Towards Building a Forensics Aware Eco System for the Internet of Things Zawoad, Shams; Hasan, Ragib 2015 IEEE International Conference on Services Computing (SCC) https://doi.org/10.1109/SCC.2015.46	conference	June 2015
Effective identification of source code authors using byte-level information Frantzeskou, Georgia; Stamatatos, Efstathios; Gritzalis, Stefanos Proceeding of the 28th international conference on Software engineering - ICSE '06 https://doi.org/10.1145/1134285.1134445	conference	January 2006
Digital Forensics in the Age of Big Data: Challenges, Approaches, and Opportunities Zawoad, Shams; Hasan, Ragib 2015 IEEE 17th International Conference on High-Performance Computing and Communications; 2015 IEEE 7th International Symposium on Cyberspace Safety and Security; and 2015 IEEE 12th International Conference on Embedded Software and Systems, 2015 IEEE 17th International Conference on High Performance Computing and Communications, 2015 IEEE 7th International Symposium on Cyberspace Safety and Security, and 2015 IEEE 12th International Conference on Embedded Software and Systems https://doi.org/10.1109/HPCC-CSS-ICESS.2015.305	conference	August 2015
An Overview of Radio Frequency Fingerprinting for Low-End Devices Rehman, Saeed Ur; Alam, Shafiq; Ardekani, Iman T. International Journal of Mobile Computing and Multimedia Communications, Vol. 6, Issue 3 https://doi.org/10.4018/IJMCMC.2014070101	journal	July 2014
Radio frequency fingerprinting commercial communication devices to enhance electronic security Ii, William C. Suski; Temple, Michael A.; Mendenhall, Michael J. International Journal of Electronic Security and Digital Forensics, Vol. 1, Issue 3 https://doi.org/10.1504/IJESDF.2008.020946	journal	January 2008
Enhancing Critical Infrastructure and Key Resources (CIKR) Level-0 Physical Process Security Using Field Device Distinct Native Attribute Features Lopez, Juan; Liefer, Nathan C.; Busho, Colin R. IEEE Transactions on Information Forensics and Security, Vol. 13, Issue 5 https://doi.org/10.1109/TIFS.2017.2779447	journal	May 2018
The future for the policing of cybercrime Sommer, Peter Computer Fraud & Security, Vol. 2004, Issue 1 https://doi.org/10.1016/S1361-3723(04)00017-X	journal	January 2004
Network forensics: Review, taxonomy, and open challenges Khan, Suleman; Gani, Abdullah; Wahab, Ainuddin Wahid Abdul Journal of Network and Computer Applications, Vol. 66 https://doi.org/10.1016/j.jnca.2016.03.005	journal	May 2016
Modeling the network forensics behaviors Workshop of the 1st International Conference on Security and Privacy for Emerging Areas in Communication Networks, 2005. https://doi.org/10.1109/SECCMW.2005.1588287	conference	January 2005
A Cross-Layer Wireless Sensor Network Energy-Efficient Communication Protocol for Real-Time Monitoring of the Long-Distance Electric Transmission Lines Yu, Jun; Zhang, Xueying Journal of Sensors, Vol. 2015 https://doi.org/10.1155/2015/515247	journal	January 2015
Towards a SCADA Forensics Architecture Wu, Tina; Disso, Jules Ferdinand Pagna; Jones, Kevin 1st International Symposium for ICS & SCADA Cyber Security Research 2013 (ICS-CSR 2013), Electronic Workshops in Computing https://doi.org/10.14236/ewic/ICSCSR2013.2	conference	September 2013
Big forensic data reduction: digital forensic images and electronic evidence Quick, Darren; Choo, Kim-Kwang Raymond Cluster Computing, Vol. 19, Issue 2 https://doi.org/10.1007/s10586-016-0553-1	journal	March 2016
Radio Frequency Fingerprint Extraction Based on Multidimension Permutation Entropy Deng, Shouyun; Huang, Zhitao; Wang, Xiang International Journal of Antennas and Propagation, Vol. 2017 https://doi.org/10.1155/2017/1538728	journal	January 2017
Anomaly-based network intrusion detection: Techniques, systems and challenges García-Teodoro, P.; Díaz-Verdejo, J.; Maciá-Fernández, G. Computers & Security, Vol. 28, Issue 1-2 https://doi.org/10.1016/j.cose.2008.08.003	journal	February 2009
Network Forensics: An Analysis of Techniques, Tools, and Trends Hunt, Ray; Zeadally, Sherali Computer, Vol. 45, Issue 12 https://doi.org/10.1109/MC.2012.252	journal	December 2012
A unified data mining solution for authorship analysis in anonymous textual communications Iqbal, Farkhund; Binsalleeh, Hamad; Fung, Benjamin C. M. Information Sciences, Vol. 231 https://doi.org/10.1016/j.ins.2011.03.006	journal	May 2013
The cyber threat landscape: Challenges and future research directions Choo, Kim-Kwang Raymond Computers & Security, Vol. 30, Issue 8 https://doi.org/10.1016/j.cose.2011.08.004	journal	November 2011
Radio frequency fingerprinting based on the constellation errors 2012 18th Asia-Pacific Conference on Communications (APCC) https://doi.org/10.1109/APCC.2012.6388238	conference	October 2012
Probabilistic Radio-Frequency Fingerprinting and Localization on the Run Mirowski, Piotr; Milioris, Dimitrios; Whiting, Philip Bell Labs Technical Journal, Vol. 18, Issue 4 https://doi.org/10.1002/bltj.21649	journal	February 2014