Intelligent Forensics for Trusted Execution Environments in RISC-V Architectures (available)

Project Description:

Trusted Execution Environments (TEEs) offer a promising approach to securing computation on embedded systems, but digital forensics capabilities within these environments remain underexplored. This project investigates how Machine Learning (ML) and Artificial Intelligence (AI) techniques can be integrated into a lightweight digital forensics framework tailored for TEEs, with a focus on RISC-V-based systems and the open-source Keystone enclave platform.

The student will begin with a comprehensive review of existing forensics frameworks, standards, and methodologies relevant to embedded and resource-constrained devices. Particular attention will be given to recent EU and UK initiatives on cybersecurity and digital forensics for IoT and embedded technologies.

The goal is to conceptualise and prototype a multi-layered digital forensics architecture capable of gathering evidence from:

1. Hardware level (e.g. side channels, physical attack indicators),
2. Firmware level,
3. Operating System level, and
4. Application level.

A key innovation of the project lies in exploring the feasibility of incorporating ML/AI methods directly on-device for intelligent data collection and preliminary analysis—overcoming the limitations posed by low processing power and memory.

The student will have access to a range of RISC-V platforms housed in the Smart Card and IoT Security Centre. Practical work will begin using simulation tools before progressing to experimentation on physical hardware.

Student Prerequisites:

Some familiarity with embedded systems, computer architecture, and an interest in cybersecurity are desirable. Basic knowledge of Python or C/C++ and experience with Linux will be beneficial. Prior exposure to ML/AI concepts would be advantageous but is not essential.