Behavioral Fingerprinting of IoT Devices for Forensic Identification Post-Attack

The rapid adoption of Internet of Things (IoT) devices has amplified security risks, particularly in post-incident scenarios where accurate device attribution and evidence reconstruction are required. Existing intrusion detection solutions mainly focus on real-time detection and provide limited forensic support after an attack. This paper proposes a phase-aware behavioral fingerprinting framework for post-attack forensic analysis of IoT devices. The approach models normal device behavior and compares it with post-incident activity to identify persistent behavioral deviations caused by compromise. A layered learning strategy is employed, combining supervised detection and attribution with unsupervised anomaly identification to capture residual and previously unseen behaviors. Temporal segmentation into pre-attack, attack, and post-attack phases enables reliable forensic timeline reconstruction and realistic evaluation. Experiments on a real-world IoT traffic dataset demonstrate high detection accuracy, strong generalization to unseen devices, and effective identification of post-attack residual behavior. The framework produces time-aligned forensic evidence that enables reconstruction of attack progression and post-attack behavior.