Digital forensic approaches for Amazon Alexa ecosystem

Hyunji Chung, Jungheum Park, Sangjin Lee

Research output: Contribution to journalArticle

21 Citations (Scopus)

Abstract

Internet of Things (IoT) devices such as the Amazon Echo – a smart speaker developed by Amazon – are undoubtedly great sources of potential digital evidence due to their ubiquitous use and their always-on mode of operation, constituting a human-life's black box. The Amazon Echo in particular plays a centric role for the cloud-based intelligent virtual assistant (IVA) Alexa developed by Amazon Lab126. The Alexa-enabled wireless smart speaker is the gateway for all voice commands submitted to Alexa. Moreover, the IVA interacts with a plethora of compatible IoT devices and third-party applications that leverage cloud resources. Understanding the complex cloud ecosystem that allows ubiquitous use of Alexa is paramount on supporting digital investigations when need raises. This paper discusses methods for digital forensics pertaining to the IVA Alexa's ecosystem. The primary contribution of this paper consists of a new efficient approach of combining cloud-native forensics with client-side forensics (forensics for companion devices), to support practical digital investigations. Based on a deep understanding of the targeted ecosystem, we propose a proof-of-concept tool, CIFT, that supports identification, acquisition and analysis of both native artifacts from the cloud and client-centric artifacts from local devices (mobile applications and web browsers).

Original languageEnglish
Pages (from-to)S15-S25
JournalDigital Investigation
Volume22
DOIs
Publication statusPublished - 2017 Aug 1

Fingerprint

assistant
Ecosystems
Ecosystem
Equipment and Supplies
artifact
Internet
Artifacts
Web browsers
Web Browser
Mobile Applications
Mobile devices
resources
evidence
Digital forensics
Internet of things

Keywords

  • Amazon Alexa
  • Amazon Echo
  • CIFT
  • Client centric forensics
  • Cloud native forensics
  • Cloud-based IoT
  • Intelligent virtual assistant (IVA)
  • Internet of Things

ASJC Scopus subject areas

  • Computer Science Applications
  • Medical Laboratory Technology
  • Law

Cite this

Digital forensic approaches for Amazon Alexa ecosystem. / Chung, Hyunji; Park, Jungheum; Lee, Sangjin.

In: Digital Investigation, Vol. 22, 01.08.2017, p. S15-S25.

Research output: Contribution to journalArticle

Chung, Hyunji ; Park, Jungheum ; Lee, Sangjin. / Digital forensic approaches for Amazon Alexa ecosystem. In: Digital Investigation. 2017 ; Vol. 22. pp. S15-S25.
@article{77c48f2df88d4a1a8a67fb82b5bfdcae,
title = "Digital forensic approaches for Amazon Alexa ecosystem",
abstract = "Internet of Things (IoT) devices such as the Amazon Echo – a smart speaker developed by Amazon – are undoubtedly great sources of potential digital evidence due to their ubiquitous use and their always-on mode of operation, constituting a human-life's black box. The Amazon Echo in particular plays a centric role for the cloud-based intelligent virtual assistant (IVA) Alexa developed by Amazon Lab126. The Alexa-enabled wireless smart speaker is the gateway for all voice commands submitted to Alexa. Moreover, the IVA interacts with a plethora of compatible IoT devices and third-party applications that leverage cloud resources. Understanding the complex cloud ecosystem that allows ubiquitous use of Alexa is paramount on supporting digital investigations when need raises. This paper discusses methods for digital forensics pertaining to the IVA Alexa's ecosystem. The primary contribution of this paper consists of a new efficient approach of combining cloud-native forensics with client-side forensics (forensics for companion devices), to support practical digital investigations. Based on a deep understanding of the targeted ecosystem, we propose a proof-of-concept tool, CIFT, that supports identification, acquisition and analysis of both native artifacts from the cloud and client-centric artifacts from local devices (mobile applications and web browsers).",
keywords = "Amazon Alexa, Amazon Echo, CIFT, Client centric forensics, Cloud native forensics, Cloud-based IoT, Intelligent virtual assistant (IVA), Internet of Things",
author = "Hyunji Chung and Jungheum Park and Sangjin Lee",
year = "2017",
month = "8",
day = "1",
doi = "10.1016/j.diin.2017.06.010",
language = "English",
volume = "22",
pages = "S15--S25",
journal = "Digital Investigation",
issn = "1742-2876",
publisher = "Elsevier Limited",

}

TY - JOUR

T1 - Digital forensic approaches for Amazon Alexa ecosystem

AU - Chung, Hyunji

AU - Park, Jungheum

AU - Lee, Sangjin

PY - 2017/8/1

Y1 - 2017/8/1

N2 - Internet of Things (IoT) devices such as the Amazon Echo – a smart speaker developed by Amazon – are undoubtedly great sources of potential digital evidence due to their ubiquitous use and their always-on mode of operation, constituting a human-life's black box. The Amazon Echo in particular plays a centric role for the cloud-based intelligent virtual assistant (IVA) Alexa developed by Amazon Lab126. The Alexa-enabled wireless smart speaker is the gateway for all voice commands submitted to Alexa. Moreover, the IVA interacts with a plethora of compatible IoT devices and third-party applications that leverage cloud resources. Understanding the complex cloud ecosystem that allows ubiquitous use of Alexa is paramount on supporting digital investigations when need raises. This paper discusses methods for digital forensics pertaining to the IVA Alexa's ecosystem. The primary contribution of this paper consists of a new efficient approach of combining cloud-native forensics with client-side forensics (forensics for companion devices), to support practical digital investigations. Based on a deep understanding of the targeted ecosystem, we propose a proof-of-concept tool, CIFT, that supports identification, acquisition and analysis of both native artifacts from the cloud and client-centric artifacts from local devices (mobile applications and web browsers).

AB - Internet of Things (IoT) devices such as the Amazon Echo – a smart speaker developed by Amazon – are undoubtedly great sources of potential digital evidence due to their ubiquitous use and their always-on mode of operation, constituting a human-life's black box. The Amazon Echo in particular plays a centric role for the cloud-based intelligent virtual assistant (IVA) Alexa developed by Amazon Lab126. The Alexa-enabled wireless smart speaker is the gateway for all voice commands submitted to Alexa. Moreover, the IVA interacts with a plethora of compatible IoT devices and third-party applications that leverage cloud resources. Understanding the complex cloud ecosystem that allows ubiquitous use of Alexa is paramount on supporting digital investigations when need raises. This paper discusses methods for digital forensics pertaining to the IVA Alexa's ecosystem. The primary contribution of this paper consists of a new efficient approach of combining cloud-native forensics with client-side forensics (forensics for companion devices), to support practical digital investigations. Based on a deep understanding of the targeted ecosystem, we propose a proof-of-concept tool, CIFT, that supports identification, acquisition and analysis of both native artifacts from the cloud and client-centric artifacts from local devices (mobile applications and web browsers).

KW - Amazon Alexa

KW - Amazon Echo

KW - CIFT

KW - Client centric forensics

KW - Cloud native forensics

KW - Cloud-based IoT

KW - Intelligent virtual assistant (IVA)

KW - Internet of Things

UR - http://www.scopus.com/inward/record.url?scp=85026735513&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85026735513&partnerID=8YFLogxK

U2 - 10.1016/j.diin.2017.06.010

DO - 10.1016/j.diin.2017.06.010

M3 - Article

AN - SCOPUS:85026735513

VL - 22

SP - S15-S25

JO - Digital Investigation

JF - Digital Investigation

SN - 1742-2876

ER -