A specification-based IDS for detecting attacks on RPL-based network topology

Le, Anhtuan, Loo, Jonathan, Chai, Kok Keong and Aiash, Mahdi ORCID logoORCID: https://orcid.org/0000-0002-3984-6244 (2016) A specification-based IDS for detecting attacks on RPL-based network topology. Information, 7 (2) , 25. ISSN 2078-2489 [Article] (doi:10.3390/info7020025)

PDF - Published version (with publisher's formatting)
Available under License Creative Commons Attribution 4.0.

Download (1MB) | Preview


Routing Protocol for Low power and Lossy network (RPL) topology attacks can downgrade the network performance significantly by disrupting the optimal protocol structure. To detect such threats, we propose a RPL-specification, obtained by a semi-auto profiling technique that constructs a high-level abstract of operations through network simulation traces, to use as reference for verifying the node behaviors. This specification, including all the legitimate protocol states and transitions with corresponding statistics, will be implemented as a set of rules in the intrusion detection agents, in the form of the cluster heads propagated to monitor the whole network. In order to save resources, we set the cluster members to report related information about itself and other neighbors to the cluster head instead of making the head overhearing all the communication. As a result, information about a cluster member will be reported by different neighbors, which allow the cluster head to do cross-check. We propose to record the sequence in RPL Information Object (DIO) and Information Solicitation (DIS) messages to eliminate the synchronized issue created by the delay in transmitting the report, in which the cluster head only does cross-check on information that come from sources with the same sequence. Simulation results show that the proposed Intrusion Detection System (IDS) has a high accuracy rate in detecting RPL topology attacks, while only creating insignificant overhead (about 6.3%) that enable its scalability in large-scale network.

Item Type: Article
Additional Information: This article belongs to the Special Issue Preserving Privacy and Security in IoT
Research Areas: A. > School of Science and Technology > Computer Science
Item ID: 23706
Notes on copyright: © 2016 by the authors; licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC-BY) license (http://creativecommons.org/licenses/by/4.0/).
Useful Links:
Depositing User: Mahdi Aiash
Date Deposited: 28 Feb 2018 16:54
Last Modified: 29 Nov 2022 21:56
URI: https://eprints.mdx.ac.uk/id/eprint/23706

Actions (login required)

View Item View Item


Activity Overview
6 month trend
6 month trend

Additional statistics are available via IRStats2.