Challenges of Network Forensic Investigation in Fog and Edge Computing

Abstract

While network forensics has matured over the decades and even made progress in the last 10 years when deployed in virtual networks, network forensics in fog and edge computing is still not progressed to that level despite the now widespread use of these paradigms. By using an approach similar to software testing, i.e., a mixture of systematic and experience, we analyze obstacles specific to forensics in fog and edge computing such as spatial dispersion and possibly incomplete recordings, and derive how far these obstacles can be overcome by adapting processes and techniques from other branches of network forensics, and how new solutions could look otherwise. In addition, we present a discussion of open problems of network forensics in fog and edge environments and discusses the challenges for an investigator.