DIGITAL FORENSICS ASSESSMENT SYSTEM

Abstract

ABSTRACT A digital forensics assessment system (100) for Internet of Things (IoT) devices, the system (100) comprising: a data acquisition module (102) configured to gather necessary information from the IoT device; a processor (104) communicatively coupled with the data acquisition module (102), wherein the processor (104) is configured to preprocess the gathered data to extract relevant information for analysis and analyze the preprocessed data to detect malware by reviewing software installation files for suspicious artifacts, examining intrusion methods through chat logs and browsing history, and assessing known malware behavior; and a tracking module (106) configured to trace the command-and-control (C&C) server associated with detected malware to identify the responsible hackers by reverse engineering malware executable files and analyzing the data transmitted to the C&C server.

Specification

Description:FIELD OF THE DISCLOSURE
[0001] This invention generally relates to a field of digital forensics and, in particular, to a digital forensics assessment system designed to enhance the detection and analysis of malware on Internet of Things (IoT) devices through advanced data acquisition, preprocessing, and analytical techniques.
BACKGROUND
[0002]
[0003] The subject matter discussed in the background section should not be assumed to be prior art merely as a result of its mention in the background section. Similarly, a problem mentioned in the background section or associated with the subject matter of the background section should not be assumed to have been previously recognized in the prior art. The subject matter in the background section merely represents different approaches, which in and of themselves may also correspond to implementations of the claimed technology.
[0004] Traditional methods of digital forensics often rely on manual data collection and analysis, which can lead to incomplete assessment , Claims:1. A digital forensics assessment system (100) for Internet of Things (IoT) devices, the system (100) comprising:
a data acquisition module (102) configured to gather required information from the IoT device, including:
file system details of the /sdcard directory,
installation files of all applications on the device,
metadata of installed applications, including package names and timestamps of downloads and installations,
execution history of each application component, including background activity logs, usage durations, and startup times,
logs from web browsers, messaging applications, and other communication channels potentially exploited by malware,
file system metadata, including directory entries and inode tables;
a processor (104) communicatively coupled with the data acquisition module (102), wherein the processor (104) is configured to:
preprocess the gathered data to extract pertinent information for analysis,
analyze the preprocessed data to detect the presence of malware by:
reviewing software in

Documents