Harnessing federated learning for digital forensics in IoT: a survey and introduction to the IoT-LF framework

The proliferation of the Internet of Things (IoT) systems has fueled a surge in cybercrime, particularly through advanced persistent threats, such as botnets and ransomware, posing challenges for centralized Digital Forensics (DF) solutions in tracking decentralized attacks and ensuring data privacy. Despite these challenges, existing research has primarily focused on traditional DF methods, overlooking the unique demands of IoT environments. Federated Learning (FL) provides a promising solution for addressing these challenges by offering a privacy-preserving solution for detecting and investigating cyberattacks in IoT networks without compromising data privacy. However, the potential of FL in the context of IoT forensics remains largely unexplored. This paper bridges this gap by reviewing recent studies in IoT forensics and proposing a novel IoT Learning Forensics (IoT-LF) framework to detect and trace cyberattacks in IoT environments. In this framework, a multi-dimensional view of the environment, including telemetry, network, and application, is considered for data gathering. In addition, FL cycles are employed to automate the examination and analysis of these data during the investigation process. The feasibility and functionality of this framework are validated by a Proof of Concept, achieving a detection accuracy of approximately 81.69%, when trained on the TON-IoT dataset. Moreover, the research challenges, lessons learned, and future research solutions for applying FL for DF in an IoT environment are discussed.