⚡ electrical engineering

Intelligent Forensics in Next-Generation Mobile Networks: Evidence, Methods, and Applications

This survey presents an evidence-centric framework and unified taxonomy for intelligent forensics in next-generation mobile networks, systematizing the forensic workflow from acquisition to reporting while comparing traditional and AI-assisted methods to address challenges in accountability, reproducibility, and security across physical, device, and network layers.

Original authors: Jiacheng Wang, Weihong Qin, Jialing He, Changyuan Zhao, Dusit Niyato, Tao Xiang

Published 2026-04-01

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Jiacheng Wang, Weihong Qin, Jialing He, Changyuan Zhao, Dusit Niyato, Tao Xiang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a detective trying to solve a crime, but the crime scene isn't a room with fingerprints and broken glass. Instead, the crime scene is the air itself.

In our modern world, everything from your smartphone to self-driving cars talks to each other using invisible radio waves. When something goes wrong—a hacker steals data, a drone crashes, or a network is jammed—the "evidence" isn't a physical object you can put in an evidence bag. It's a fleeting whisper in the air that disappears in a millisecond.

This paper is a guidebook for "Intelligent Forensics" in these next-generation mobile networks (like 5G and the upcoming 6G). It argues that we need to stop just trying to catch the bad guy in the moment and start building a system that can reconstruct exactly what happened after the fact, with proof that holds up in court.

Here is the breakdown of the paper using simple analogies:

1. The Problem: The "Ghost" Evidence

In a traditional computer crime, you might look at a hard drive to see what files were deleted. But in wireless networks, the evidence is like smoke.

It's short-lived: Radio waves vanish instantly.
It's messy: The signal bounces off buildings, gets distorted by rain, and changes as devices move.
It's hidden: Much of the data is encrypted (locked), so you can't read the message, only see the "shape" of the envelope.

If you don't catch the smoke while it's there, the crime scene is gone forever.

2. The Solution: A Four-Layer Detective Kit

The authors propose a new way to look at evidence, organized into four layers, like peeling an onion:

Layer 1: The Physical Layer (The "Voiceprint")
- Analogy: Even if two people say the same words, their voices sound slightly different due to their unique throat shape. Similarly, every radio device has a tiny, unique hardware "voiceprint" caused by manufacturing imperfections.
- The Forensics: We analyze the raw radio waves to identify exactly which device sent the signal, even if the hacker tried to hide their identity.
Layer 2: The Device Layer (The "Black Box")
- Analogy: Like the black box on a plane, the device itself (the phone or modem) keeps internal logs of what it was doing.
- The Forensics: We dig into the device's internal memory to see if it was tricked, hacked, or forced to behave strangely.
Layer 3: The Network Layer (The "Traffic Camera")
- Analogy: Imagine a highway camera that sees how many cars passed and when, but can't see inside the cars.
- The Forensics: We look at the network logs to see the flow of traffic. Who connected to whom? When did the data flow stop? This helps reconstruct the timeline.
Layer 4: Cross-Layer Fusion (The "Jigsaw Puzzle")
- Analogy: One layer might say "a car was here," another says "a voice was heard," and a third says "the door was open." Only by putting them together do you get the full picture.
- The Forensics: We combine all these clues to prove that Device A sent a signal at Time B, which caused Event C.

3. The New Tool: AI as the "Super-Intern"

The paper discusses using Artificial Intelligence (AI) to help.

Traditional Forensics: Like a human detective looking at a list of rules. "If the door is open, check the window." It's slow and rigid.
AI Forensics: Like a super-intern who has read every crime novel ever written. It can spot patterns humans miss.
- The Catch: The AI is great at guessing, but in a court of law, you can't just say "The computer thinks it's a crime." You need to know why the computer thinks that. The paper warns that AI can be tricked (like a student memorizing answers instead of learning the lesson) and must be used carefully to ensure the evidence is real.

4. The Workflow: How to Do It Right

The authors outline a step-by-step process for a perfect investigation:

Be Ready (Preservation-by-Design): Don't wait for a crime to happen. Set up your cameras and recorders before the crime starts.
Catch the Evidence (Acquisition): When something weird happens, grab the "smoke" immediately. Use smart sensors to decide what to save so you don't run out of storage space.
Connect the Dots (Correlation): Line up the timestamps. Make sure the "voiceprint" matches the "traffic camera" log.
Tell the Story (Reporting): Present the findings in a way that anyone else can replay the investigation and get the same result. If you can't replay it, it's not evidence; it's just a guess.

5. Why This Matters (The "So What?")

As we move toward 6G, our world will be run by these networks.

Self-driving cars need to know if a signal was hacked or just a glitch.
Smart cities need to know who caused a power outage.
Security needs to prove that a specific drone was the one flying over a restricted area.

Without this "Intelligent Forensics," we would be flying blind. We might know an attack happened, but we wouldn't know who did it, how they did it, or be able to prove it in court.

Summary

This paper is a blueprint for building a time machine for wireless networks. It teaches us how to capture the invisible, fleeting signals of the future, organize them into a clear story, and use smart tools (AI) to solve crimes that happen in the air, ensuring that justice can be served even when the evidence is as elusive as a ghost.

1. Problem Statement

The paper addresses the critical gap in post-incident reconstruction for next-generation wireless networks (5G/6G and beyond). While traditional security focuses on real-time detection and mitigation, future wireless systems face unique challenges that make forensic investigation difficult:

Ephemeral Evidence: Wireless traces (radio waveforms, channel measurements) are short-lived and often overwritten.
Distributed & Heterogeneous Sources: Evidence is fragmented across radio access networks (RAN), edge devices, cloud cores, and user equipment, often owned by different stakeholders.
Environmental Uncertainty: Radio signals are heavily affected by propagation conditions, calibration drift, timing synchronization errors, and mobility.
Adversarial Manipulation: Attackers can spoof signatures, poison machine learning (ML) pipelines, or manipulate channel state information (CSI).
Privacy Constraints: Encryption and privacy regulations limit the visibility of payloads and device logs, complicating attribution.

Current digital forensics methods, designed for static, file-based systems, are insufficient for the dynamic, signal-native nature of wireless environments. There is a need for an intelligent, evidence-centric framework that treats wireless measurements as first-class forensic artifacts.

2. Methodology

The authors propose a unified, evidence-centric framework that organizes wireless forensics across four layers and systematizes the workflow into a four-stage pipeline.

A. Unified Taxonomy of Wireless Evidence

The paper categorizes forensic evidence into four distinct layers, each with specific evidence types, claims, and vulnerabilities:

Physical-Layer Forensics: Focuses on raw waveforms, baseband I/Q samples, and Channel State Information (CSI).
- Claims: Incident manifestation, source association (RF fingerprinting), and spatiotemporal constraints.
- Challenges: Calibration drift, propagation distortion, and adversarial signature forgery.
Device-Layer Forensics: Examines endpoint artifacts like baseband firmware, radio interface layers (RIL), and modem states.
- Claims: Radio stack behavioral attribution and hardware-backed identity integrity.
- Challenges: Vendor firmware opacity, privilege isolation, and log evasion.
Network-Layer Forensics: Utilizes packet traces, flow records, and control-plane logs (e.g., 5G core signaling).
- Claims: Encrypted service identification, intrusion detection, and timeline reconstruction.
- Challenges: Structural incompleteness due to sampling, semantic ambiguity from encryption, and traffic obfuscation.
Cross-Layer Fusion: Integrates data from all layers to strengthen attribution and validate provenance.
- Claims: Identity-physical binding and operational provenance validation.
- Challenges: Decoupling due to encryption and environmental feature drift.

B. Systematized Forensic Workflow

The paper restructures the forensic process into a closed-loop workflow, comparing Traditional vs. AI-Assisted approaches:

Readiness & Preservation-by-Design:
- Traditional: Static logging, centralized storage, and rule-based triggers.
- AI-Assisted: Adaptive retention, risk-aware sampling, and "autonomic" readiness that adjusts capture density based on anomaly confidence.
Acquisition:
- Traditional: Fixed-rate capture using tools like Intel 5300 or Nexmon.
- AI-Assisted: Confidence-aware sampling, active sensing (using RIS/ISAC to probe the environment), and evidence reconstruction (super-resolution) to fill gaps.
Correlation & Analysis:
- Traditional: Deterministic signal disentanglement (matched filtering, blind source separation) and rule-based correlation.
- AI-Assisted: Multimodal fusion, causal inference using Graph Neural Networks (GNNs), and hypothesis ranking to handle partial observability.
Reporting & Reproducibility:
- Key Requirement: Reports must include provenance metadata (calibration, sync status, tool versions) and uncertainty quantification (confidence intervals).
- AI Role: AI outputs must be treated as "derived artifacts" requiring human review and explicit separation from raw evidence to ensure admissibility.

3. Key Contributions

Unified Taxonomy: The first survey to treat wireless measurements (RF, CSI, waveforms) as primary forensic evidence, explicitly mapping them to physical, device, network, and cross-layer domains.
Workflow Systematization: A comprehensive framework distinguishing between traditional deterministic methods and AI-assisted techniques, highlighting where AI adds value (e.g., adaptive capture, causal ranking) and where it introduces risk (e.g., hallucination, bias).
Application Review: Detailed analysis of five key application areas:
- Anomaly Discovery: Unsupervised learning for spectrum and KPI anomalies.
- Attribution: Signal-native device identification and infrastructure-side service attribution.
- Provenance & Localization: Generating defensible spatial claims with confidence regions (e.g., trajectory reconstruction).
- Authenticity: Physical-layer tags and RIS-based challenge-response mechanisms to prevent forgery.
- Timeline Reconstruction: Fusing telemetry with wireless sensing to create replayable event narratives.
Identification of Open Challenges: Highlighting domain shift (generalization across sites), resource-aware evidence capture, and the legal/admissibility risks of generative AI-enhanced evidence.

4. Results and Case Studies

The paper reviews numerous representative studies and case studies to validate the framework:

Localization: A case study using CSI and geometric reasoning (Time-of-Flight) achieved median localization errors of 1.78m in non-line-of-sight (NLoS) scenarios, demonstrating that raw signal logs can yield defensible spatial evidence.
Anomaly Detection: AI-driven detectors using LSTM-GANs on KPI time series achieved F1 scores of 0.94 for sudden drops, outperforming traditional ARIMA models.
Rogue Detection: On-device learning frameworks detected fake base stations with 96% accuracy and low power consumption (<2mW).
Authenticity: RIS-based challenge-response schemes demonstrated the ability to reduce spoofing success rates significantly (misdetection probability $10^{-5}$ to $10^{-3}$ ) while maintaining spectral efficiency.
Generative Evidence: Experiments showed that generative models (diffusion models) could denoise CSI and improve trajectory estimation, but emphasized that these must be flagged as "derived" to maintain forensic integrity.

5. Significance

This survey is significant for several reasons:

Paradigm Shift: It moves the field from "detection-only" to "accountable reconstruction," arguing that future wireless security requires the ability to prove what happened and why after an incident.
Bridging Disciplines: It connects signal processing (RF physics), networking (protocol telemetry), and AI (learning-based analysis) into a cohesive forensic discipline.
Legal & Operational Readiness: By emphasizing provenance, calibration, and uncertainty quantification, the paper provides a roadmap for making wireless evidence admissible in legal proceedings and auditable in operational environments.
Future-Proofing: It addresses the specific needs of 6G, including Integrated Sensing and Communication (ISAC), Reconfigurable Intelligent Surfaces (RIS), and edge intelligence, ensuring that forensic capabilities evolve alongside network technology.

In conclusion, the paper establishes that intelligent wireless forensics is not merely an extension of digital forensics but a distinct, foundational capability required for trustworthy, auditable, and reproducible security in next-generation mobile networks.