FIViz: Forensics Investigation through Visualization for Malware in Internet of Things

Abstract

Adoption of the Internet of Things for the realization of smart cities in various domains has been pushed by the advancements in Information Communication and Technology. Transportation, power delivery, environmental monitoring, and medical applications are among the front runners when it comes to leveraging the benefits of IoT for improving services through modern decision support systems. Though with the enormous usage of the Internet of Medical Things, security and privacy become intrinsic issues, thus adversaries can exploit these devices or information on these devices for malicious intents. These devices generate and log large and complex raw data which are used by decision support systems to provide better care to patients. Investigation of these enormous and complicated data from a victim’s device is a daunting and time-consuming task for an investigator. Different feature-based frameworks have been proposed to resolve this problem to detect early and effectively the access logs to better assess the event. But the problem with the existing approaches is that it forces the investigator to manually comb through collected data which can contain a huge amount of irrelevant data. These data are provided normally in textual form to the investigators which are too time-consuming for the investigations even if they can utilize machine learning or natural language processing techniques. In this paper, we proposed a visualization-based approach to tackle the problem of investigating large and complex raw data sets from the Internet of Medical Things. Our contribution in this work is twofold. Firstly, we create a data set through a dynamic behavioral analysis of 400 malware samples. Secondly, the resultant and reduced data set were then visualized most feasibly. This is to investigate an incident easily. The experimental results show that an investigator can investigate large amounts of data in an easy and time-efficient manner through the effective use of visualization techniques.

A Survey of Forensic Analysis and Information Visualization Approach for Instant Messaging Applications

“…It is observed that each study incorporated more than one forensic visualization technique. Furthermore, most of the related studies demonstrated the selection of techniques based on data types, for example in [64], [57], [61], and [66]. This further indicates that different data types may require different visualization techniques.…”

“…The utility of the tool was evaluated through questions derived from forensic analysis goals: what cyber incident occurred, who was involved in the incident, and where, when, and how the incident occurred. Also applying timeline graph visualization, [66] presented a visualization-based approach to support malware investigations on the Internet of Things environment. This study applied the data mining method to preprocess DLL files and assign weights to represent malicious and benign files.…”

“…Therefore, there is a need for benchmarking evaluation methods in this research area. References Technical simulations (e.g., case studies) to evaluate tool usability [56], [59], [60], [61], [63] User testing to evaluate tool functionality and performance [64], [51], [62], [66] Focus group to solve forensic challenges [57], [58], [65] In relation to the automated forensic tools metrics proposed by Ayers [32], speed (absolute and relative), reliability, accuracy, and completeness are the evaluation metrics used in existing studies. This is in line with our finding from automated IM forensic analysis tools, which show that performance and functionality are the most applied metrics.…”

A review on security threats, vulnerabilities, and counter measures of 5G enabled Internet‐of‐Medical‐Things

“…These attacks not only threaten the integrity and confidentiality of IoMT devices, but they are also capable of shutting down any network server through DDoS attacks [61,62]. This can forcefully open a backdoor to a given medical system or device [63,64]. Besides, exploiting the security gap can also lead to unauthorized access to medical records, disclosure, IoMT devices, or deletion of patient's information [20].…”

An Attribute-Based Access Control for IoT Using Blockchain and Smart Contracts

“…Security devices are becoming vulnerable to privacy-threatening attacks launched by malicious users, and because of these attacks, it is difficult to completely control the widely distributed IoT devices. For controlling the data leakage from IoT devices, an authorized access mechanism is needed to protect sensitive and valuable information [4].…”