POTENTIAL DIGITAL EVIDENCE COLLECTION DESIGN FOR FORENSIC READINESS SYSTEM IN THE SMART GRID

• Main Author: Candra Rumantyo, Danny
• Format: Theses
• Language: Indonesia
• Online Access: https://digilib.itb.ac.id/gdl/view/80136
• Institution: Institut Teknologi Bandung

Smart grid is an intelligent electrical network system that integrates the Internet network with electricity by collecting and analyzing information on the transmission, distribution and consumption of electrical power in real time. In this era, cases of cyber crime and security breaches are increasing targeting the Internet of Things (IoT). Security vulnerabilities can be exploited by attackers to become an "entry point" to carry out further exploitation. Security threats in the smart grid have the potential to cause access theft, weaken the functionality of electricity utility distribution, and theft of personal data. With the existence of threats and vulnerabilities, it is necessary to take mitigation and prevention steps, one of which is using the forensic readiness method. Forensic preparedness focuses on using a proactive approach to collect digital evidence before an incident occurs. Forensic readiness in IoT has its own challenges for investigators, this is due to the unique and heterogeneous characteristics of IoT devices. This research aims to design a forensic readiness system in an IoT environment. The methods used in this research are Design Science Research Methodology (DSRM). This research uses embedded systems, sensor nodes, and data aggregators/gateways as representations of smart grid architecture. The process of collecting evidence in the form of logs is implemented on the gateway side, using the random forest algorithm. The random forest algorithm can predict attack patterns from a collection of training datasets, by randomly combining several decision trees. The research results show that a forensic readiness system can proactively collect digital evidence when a DoS attack targets availability. The authenticity of digital evidence preserved using SHA-512 can be proven so that it meets the integrity aspect.