Formalization in Digital Forensic Triage for Identification of Malicious IoT Devices

Considering the large number of devices connected to the Internet of Things(IoT), identifying malicious devices for the purpose of “search & seizure” remainsa critical issue for digital investigators. Consequently, the need for techniques that automatically identify malicious devices can speed up the process of digital investigation. However, few conceptual approaches were proposed to identify malicious devices during IoT forensic investigation. To overcome that, a formal approach is proposed to automatically triage and fingerprint IoT Malicious devices with their respective states. It is expected that with the proposed formal approach, investigators can simply identify malicious devices, their states as well as determine the scope of investigation.