12940 IEEE SENSORS JOURNAL, VOL. 21, NO.

11, JUNE 1, 2021

Intrusion Detection Systems in RPL-Based

6LoWPAN: A Systematic Literature Review
Aryan Mohammadi Pasikhani, John A. Clark, Prosanta Gope , Senior Member, IEEE,
and Abdulmonem Alshahrani

Abstract —Drastic reduction in the manufacturing cost of

sensors and actuators has resulted in considerable growth
in the number of smart objects. The so-called Internet of
Things (IoT) blends the real and virtual environments and
removes time and distance barriers. It is widely perceived as
a major enabler for the efficient and effective provision of ser-
vices across a range of sectors. It has naturally attracted the
interest of cyberattackers. Due to the heterogeneity, resource-
constraints, scale, and internet connectivity of IoT devices,
each IoT layer is prone to various threats. Intruders con-
sider the network layer of IoT as the gateway and leverage
vulnerabilities in the routing protocol to compromise the
Confidentiality, Integrity, and Availability (CIA) of connected
nodes. Researchers have proposed different security infrastructures to mitigate harm to IoT networks. One of these is the
Intrusion Detection System (IDS). An IDS is an essential component for the network security layer and is widely adopted
to reinforce the security of the IoT network. This systematic literature review explores the IPv6 Routing Protocol for Low
Power and Lossy Networks (RPL) and its existing threats, classifies relevant IDS techniques and identifies areas requiring
further investigation. We review 103 published papers in this domain.
Index Terms — RPL attacks, IDS taxonomy, detection strategies, 6LoWPAN, monitoring techniques, IoT, LLN.

I. I NTRODUCTION According to Cisco [1], over 75 billion devices are expected

T HE Internet of Things (IoT) provides a framework where

vast numbers of devices can communicate with each
other and so collaborate to provide services across many
to connect to the Internet by the year 2025. Due to the
increased number of IoT devices, IPv4 does not apply in
this domain and use of IPv6 is essential. Sensors collect
domains with increased efficiency and effectiveness. Such and actuate a massive amount of data that requires precise
enhanced operation is underpinned by increased sophistication analysis. However, because of resource limitations, Low Power
of information processing. It has become common to describe and Lossy Networks (LLNs) have to transfer generated data
various nodes as ‘smart’ but in practice, the degree of smart- to a device/server with sufficient computational resources for
ness encapsulated in individual nodes varies hugely. However, storing it and for conducting computation tasks, such as data
the ease with which nodes may now communicate means analysis. Information can then be sent to the actuators to
that highly sophisticated system operation is possible, with take identified actions. The IPv6 over Low-Power Wireless
responsibilities for different aspects of service provision being Personal Area Networks (6LoWPAN) was developed to pro-
distributed across the network. Quite basic nodes now play a vide a compact IPv6 to LLN nodes in Personal Area Net-
critical role in the provision of such sophisticated services. works (PANs) and enable nodes to interact over the Internet.
However, many of these ‘things’ in IoT based systems suffer Making actuators, sensors, and devices connected to outside
from limited computational and energy resources. wired networks is a profitable business. However, the resource
Manuscript received December 25, 2020; revised February 12, 2021; limitations of LLN nodes makes them vulnerable to internal
accepted March 6, 2021. Date of publication March 23, 2021; date of and external malice and raises many security concerns. Most
current version May 28, 2021. The work of John A. Clark was supported nodes in LLNs are battery-powered, lack heavy-computation
in part by the Engineering and Physical Sciences Research Council (The
Active Building Centre) under Award EP/S016627/1 and in part by the capabilities, and inherit inadequate computation capabilities
Research England’s Connecting Capability Fund (CCF) IoT Knowledge and limited storage capacity as a consequence of the need for
Exchange Project–Pitch-In. The associate editor coordinating the review low manufacturing costs. Although IoT devices have slightly
of this article and approving it for publication was Dr. Thilo Sauter.
(Corresponding author: Prosanta Gope.) better computational resources than Wireless Sensor Net-
The authors are with the Department of Computer Science, work (WSN) nodes and are heterogeneous in design [2], [3],
The University of Sheffield, Sheffield S1 4DP, U.K. (e-mail: the devices usually need to work in an unstable environment,
[email protected]; [email protected];
[email protected]; [email protected]). where the neighboring nodes may go on and off to conserve
Digital Object Identifier 10.1109/JSEN.2021.3068240 energy. Parent nodes may move outside their children’s range

1558-1748 © 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See https://www.ieee.org/publications/rights/index.html for more information.

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
PASIKHANI et al.: IDSs IN RPL-BASED 6LoWPAN: A SYSTEMATIC LITERATURE REVIEW 12941

and become unreachable; therefore, children need to find new TABLE I

parents in a timely manner. These require a scalable, energy- A BBREVIATIONS
and resource-efficient routing protocol. The Routing Protocol
for LLNs (RPL) is designed to address these needs.
A substantial amount of research has addressed security
concerns in LLNs through cryptography, intrusion detection
systems (IDSs), intrusion prevention systems (IPSs), authenti-
cation and trust-based mitigation approaches, etc. IoT devices
and traditional computers use some similar protocols in the
application, transport, network, and physical layers, as dis-
cussed in section II. The constrained computational and energy
resources of a LLN’s devices are the primary barrier to
adopting existing security mechanisms at IoT interfaces [4].
LLN devices generate huge volumes of data but lack the
resources to store and process it further.
RPL plays a critical and widespread role in service provision
in IoT systems. As a consequence, it is an obvious target
for attack and a critical candidate for defence. One aspect
of defence that must now be considered is how intrusions on
RPL systems can be detected.
Here we present a systematic review of the most influential
approaches and methods providing IDS for RPL networks.
We examine existing routing threats and their negative impacts.
The strengths and weaknesses of IDS strategies and mitigation
techniques are also addressed, as are validation methods.
Our review classifies and provides a taxonomy of these IDS
methods.
Several surveys and reviews, such as [5], [6], and [7],
study RPL functionality, IoT threats, and some proposed
mitigation methods. However, the existing studies provide only
a light introduction to IDSs for RPL and do not cover the
state-of-the-art attacks. They are not comparative and do not
evaluate the pros and cons of each proposed method from
different perspectives. Our survey provides a more rigorous
characterization of IDS strategies together with finer grained
evaluation than is currently available in the literature. The
increased evaluation detail will facilitate further research and
help those considering IDS implementation.
We comment on a wide range of aspects: objectives of
each proposed approach, the effectiveness of each proposed
detection strategies, monitoring techniques, and to what degree
each research achieved its goals. We also consider val-
idation and evaluation methods, configuration setups, and
testbeds used by researchers. Our study focuses on the
most high profile RPL mitigation techniques, concentrating
on IDSs.
The rest of the article is organized as follows. In Section I.A
we define a set of research questions to provide increased
rigor and focus to our review. Section II describes the func-
tioning and the potential vulnerabilities of RPL. Section III
details discovered intrusions and vulnerabilities of RPL. Next,
IDS in terms of the source of monitored data, detection
strategies, response types, monitoring techniques, and valida-
tion and evaluation methods are classified and described in
Sections IV.A, IV.B, IV.C, V, and VI, respectively. After pro-
viding a taxonomy for IDSs for RPL, Section VII addresses the Lastly, Section VIII determines research gaps and opportuni-
identified research questions and provides statistical evidence ties. Table I presents the list of abbreviations and definitions
for the findings based on our investigation of 103 papers. used throughout this paper.

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
12942 IEEE SENSORS JOURNAL, VOL. 21, NO. 11, JUNE 1, 2021

A. Scope of This Survey and Contributions II. P RELIMINARIES

Our survey is concerned with IDSs that target RPL net- Several network protocols have been introduced that form
works. Salient features and methods of papers in this context connections between IoT devices and the various computers
are extracted and the characteristics are detailed. We primarily on the Internet, as shown in Fig. 1. Such protocols can be clas-
aim to address the following research questions: sified based on network coverage, energy overhead, and trans-
Q 1. What types of routing threats exist in this domain and mission rate. The 6LoWPAN is the combination of IPv6 and
how have they been addressed so far? Low-Power Wireless Personal Network (LoWPAN) protocols
Q 2. What is the impact of each attack in an LLN and to and is the adaption layer of IPv6 for 802.15.4 LLNs. It is a
what extent do they damage 6LoWPAN? version of IPv6 optimized for LLNs and was mainly designed
Q 3. What are the technical performance objectives of the to provide Internet connections to resource-constrained nodes
research in this field? in PANs (Personal Area Networks). However, 6LoWPAN can
Q 4. How do the proposed approaches monitor the network be implemented over different platforms and is not restricted to
to detect anomalies and to what extent are particular monitor- radio links. The 6LoWPAN follows the IEEE802.15.4 standard
ing methods used by researchers? and covers connection ranges of 10s of meters with ∼250Kb/s
Q 5. What IDS strategies exist to protect RPL networks and transmission rate. Implementing the original IPv6 is compu-
how widely is each used? tationally expensive for LLNs. This adaption aims to provide
Q 6. What are the advantages and disadvantages of each mechanisms to reduce computational expense, such as address
proposed approach? header compression, packet fragmentation, IPv6 neighbor dis-
Q 7. What datasets or simulators are available for RPL net- covery requirements. There is no default IoT stack layer in
works, and to what extent are they employed by researchers? this domain; however, we can see the standards and protocols
What configuration and setup of simulated and test networks introduced for IoT from different perspectives. Fig. 1 illus-
(e.g. number of intruders, the distances between nodes, run- trates the TCP/IP protocol layer and the most common stack
time duration) have researchers used to conduct their experi- layer described by researchers.
ments?
Q 8. What validation and evaluation methods are used to
measure the performance of the proposed methods and to what A. Routing Protocol for Low-Power and Lossy
extent have the researchers improved performance? Networks (RPL)
Q 9. What are open questions in this domain, and what The Routing Protocol for low-Power and Lossy Net-
vulnerabilities remained unaddressed? works (RPL) is designed to provide IPv6 communication
among LLNs, i.e., IoT devices. LLNs include constrained
B. Publication Statistics devices with limited memory, processing power, and some-
In this paper the publications, literature, and methods are times battery operated energy resources. Such devices have
chosen with regards to their research scope, expert opinions, a lossy connection, typically supporting only low data rates
and the quality of the publication and its impact on the research that are usually unstable with relatively low packet delivery
published afterward. Web of Knowledge, Google Scholar, and rates (PDRs). RPL was initially designed to work in an
IEEE Xplore search engines were used to discover and obtain environment with static nodes in fixed locations; however,
the proposed papers between the years 2008 and 2020. some mobility methods [15] were introduced that enable the
participation of mobile nodes in the RPL network. In general,
C. Relevant Reviews LLNs that use RPL inherit two features, namely, a meagre
In [14], the authors review the security issues and mitigation data rate, usually something below ∼250kbps [5], and also
techniques of the edge layer in IoT. The paper does not cover very high collision and dropped packet rates, which negatively
RPL attacks and mitigation techniques. A comprehensive impact the application throughput. RPL supports three kinds
review of trust-based IDS for RPL is given by [7]. In [9], of communication: P2P (peer to peer also called point to
the authors study the impacts of a few RPL attacks on 6LoW- point); P2MP (a central node to multiple points on network);
PAN and to what degree the built-in security mechanisms of and MP2P (from multiple nodes to a central server). It uses
RPL can resolve the negative impacts of such attacks. [10] a distance vector routing protocol based on its Destination
and [6] review several RPL attacks and a few mitigation Oriented Directed Acyclic Graph (DODAG). Multiple RPL
techniques. However, they study only a few proposed method instances, each with a unique RPLinstanceid, can operate
and do so in limited detail. In [5], the authors concentrate on concurrently in the LLN. RPL is capable of constructing
classifying IDS approaches. They do not provide an overview multiple paths back to the same destination and switches to
of RPL attacks and their adverse impact on the 6LoWPAN alternative routes whenever default routes become corrupted
nor discuss the computational cost of each IDS approach on (either intentionally or unintentionally). The protocol generates
the LLN. In [11], the authors provide a review on the use a directed acyclic graph (DAG) based on associated policies
of Machine Learning (ML) based security infrastructures to imposed by Low power and lossy Border Router (LBR). The
mitigate security vulnerabilities of IoT, but do not include LBR is the root of the DAG and usually has rank 1. This border
RPL attacks. Table II shows the contribution, scope, and router and the rest of the nodes interconnect in a hierarchical
shortcomings of each related review and indicates how our structure, which combines mesh and tree topologies referred
work complements it. to as a DODAG. The ranking system was designed to prevent

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
PASIKHANI et al.: IDSs IN RPL-BASED 6LoWPAN: A SYSTEMATIC LITERATURE REVIEW 12943

TABLE II
R ELATED R EVIEWS

and detect any probable routing loop in RPL. The rank enables CORPL (Cognitive RPL) and CARP (Channel Aware Routing
LLN nodes to identify their parents and children. The RPL Protocol). The CORPL is an extended version of RPL and
requires the nodes to store a list of parents, allowing a child designed for cognitive networks. However, unlike RPL, it does
node to switch to another parent easily should a current one not support storage management, and all nodes need to track
become unavailable. The Rank in RPL is computed based on forwarding records. (The parents are not the only ones respon-
the distance from the 6BR with different metrics, such as Link sible for this task.) The CORPL is designed for underwater
Quality (LQ), Delay, Hop Counts, Connectivity etc., defined communication scenarios, and unlike RPL, it does not support
in the Objective Function (OF). security and server technologies. Initially, no mobility was
Although RPL is the most popular and standardized routing considered in the RPL network and all nodes were considered
protocol in IoT networks [16], several other protocols have to be static. However, several researchers [16] have confirmed
also been developed to enhance routing in LLNs, namely the possibility of placing mobile nodes in RPL.

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
12944 IEEE SENSORS JOURNAL, VOL. 21, NO. 11, JUNE 1, 2021

Fig. 1. IoT stack layer.

Fig. 2. DODAG graphing and RPL storing modes.

B. DODAG the parents’ rank value and other parameters and multicast
The RPL is capable of building several DODAG a new DIO to the nodes in their neighborhood for attracting
graphs [17], with identical roots in each graph characterized potential children. Calculating the rank depends on several
with different DODAG Id’s. Each node is only permitted factors, such as the distance from the root, energy resource
to join a single DODAG graph and be a child of a parent of the node etc. The node’s rank identifies its position in
node at the same time; however, nodes with different roots the network topology, which is a top-down hierarchy. A child
and DODAGs can communicate with each other. A DODAG always has a higher, less valuable rank than its parents. IoT
builds its graph in several steps, as represented in Fig. 2. devices consider neighbors with a lower rank value as a parent.
The formation of the topology starts with the 6BR/Root, also Optimal routes (parents, hops) in the DAG are obtained from
referred to as the sink node. The root multicasts a DODAG metrics and constraints. In order to update the DAG, a DIO
Information Object (DIO) to all nodes in its neighborhood message is multicasted periodically according to the timer set
to initiate the formation of a DODAG. A DIO packet carries by the border router (as part of the trickle algorithm).
essential information required by nodes to discover an RPL Meanwhile, if any new node wants to join the DODAG,
instance, learn configuration parameters, select a parent set, it will multicast DODAG Information Solicitation (DIS)
and maintain the DODAG graph. requests to discover a DODAG network and listen for a DIO
Neighboring nodes receiving the DIOs from the root choose reply from a node in its neighborhood. The DAO is intended
the sender as the parent by replying with DAO (Destination to be used for creating a downward hierarchy. If a node
Advertisement Object) messages. Next, the parent node may loses connection with its parent, either it can wait for an
accept their request by sending DAO-ACK to each individual. incoming DIO message (taking 1-60 minutes) or send a DIS
The neighboring nodes then calculate their ranks concerning message [18].

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
PASIKHANI et al.: IDSs IN RPL-BASED 6LoWPAN: A SYSTEMATIC LITERATURE REVIEW 12945

TABLE III
O BJECTIVE F UNCTIONS

If the parent node becomes unreachable or disappears, have been proposed to address this limitation, namely Resid-
a couple of repair procedures are designed to avoid recon- ual Energy OF, Energy Efficient and path Reliability Aware
structing the entire topology. The primary technique lets OF (ERAOF), Energy-Oriented Routing OF (OF-EOR), and
nodes send their packets through their neighboring node with Expected Lifetime OF (ELT). For brevity, this review paper
the same rank, and the second mechanism guides them to does not review each OF. The reader is referred to [24]
select another parent from the preferred parent set. DODAG and [25] which provide comprehensive reviews of OFs and
also introduces a global repair mechanism to reconstruct the to [26] and [27] which study and analyze MRHOF and
topology completely. Although such a mechanism can play OF0 performance over several measures and LLN scenarios.
an essential role in reviving an IoT network, it increases Based on their findings, both OF0 and MRHOF cause long
the vulnerability and enables malicious nodes to sabotage hops in a dense network with a large number of nodes,
the network. Such attacks can exhaust battery-powered nodes, introducing an OF is essential.
leading to shutdown.
The RPL IPv6 header option with the special flag ‘O’ D. Routing Protocol Vulnerabilities
indicates the intended packet direction, and ‘R’ notifies a rank The 6LoWPAN routing protocol is venerable to various
error occurrence during packet forwarding between sender threats (such as Sinkhole, Version Number, Wormhole, etc.)
and receiver nodes. There are two downward routing modes, and does not have any concrete mechanism to ensure security
namely storing and non-storing mode, illustrated in Fig. 2. in its routing protocol (RPL). [28] provides a comprehensive
Each routing node is stateful in storing mode, and creates a study and analysis of RPL performance in an extensive scale
downward routing table for its sub-DODAG to route incoming network. Studying RPL performance in a multi-hop network
and outgoing traffic. In non-storing mode all nodes transfer reveals the existence of link quality, energy exhaustion, infor-
their packets towards the border router/root, then the root node mation leakage, maintenance of routing information, integrity,
transfers the packet to the destination address. In non-storing and availability issues.
mode, the root does not create any routing table.
III. RPL ATTACKS
C. Routing Metrics There are three types of RPL attacks, distinguishable by
In the DODAG, the duty of configuring routing metrics, the harm they cause to the LLN [10], as illustrated in Fig. 5.
optimization objectives, rank calculation, and parent selec- If the attack is against the victim nodes’ resources, then it falls
tion policy is defined by the OF (Objective Function) pol- into the resource attack category. This category consists of two
icy. The IETF proposed several OFs, using a variety of subcategories, namely direct and indirect attacks. In a direct
link attributes, for different applications and environmental attack, the malicious node by itself establishes the attack while
conditions [19]–[23]. The OFs follow diverse policies with in the indirect category the intruder initiates the attack with
different goals. An OF may aim to enhance the packet end the help of compromised nodes. Both approaches aim to drain
to end delay or preserve LLN nodes’ energy resources by neighboring nodes’ resources. However, detection of indirect
avoiding routing through battery-powered nodes. Table III attacks is more challenging because usually there is more
introduces existing, fully defined, or drafted OFs. than one attacker node present in the network and detection
Energy calculation is not considered as an element in the of their master, the primary intruder node, is harder since it
routing path drawing of MRHOF and OF0. Several OFs does not target the LLN nodes directly. If the intruder aims

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
12946 IEEE SENSORS JOURNAL, VOL. 21, NO. 11, JUNE 1, 2021

to generate an unoptimized network topology, it is called a Algorithm 1 : Sinkhole, Black-Hole, Selective_

topology attack. Topology attacks divide into sub-optimization forwarding Attacks
and isolation subcategories. In the sub-optimization attacks, Initialization
the network diverges from optimal performance. In isolation A: Attacker node
attacks, targeted nodes become isolated from the network N: Neighbor list ⊂ legitimate LLN nodes
and cannot receive or transfer packets. The third category is B: a neighboring node ∈ N
against RPL network traffic, so it is called a traffic attack. This P: Current packet
category divides into Eavesdropping (if the intruder node sniffs R: a lower more powerful rank, usually assigned as the
and analyses the network stream) and misappropriation (where sink node rank
the identity of other nodes is stolen and used to advantage). Attack_type = {Sinkhole, Black-hole,
In the following, we describe the prevalent RPL attacks in the Selective_forwarding}
framework mentioned above. Input: "A" receives DIOs from A.N and calculates
Intruders can obtain a malicious rank either by observing Min(advertised_ranks)
its neighborhood and then advertising lower, more powerful, Output: "A" obtains a lower, malicious rank and
malicious rank values or by deceiving neighboring nodes by multi-casts it with DIO to all nodes, ∀ node ∈
manipulating the OF and persuading other nodes to assign a A.N
better rank to it. The OF manipulation enables the intruder to if (P is DIO) ∧ (P.sender_i d ∈ A.N) then
adapt to the changes in the network and work dynamically. if P.sender _i d ∈ A.N ∧ P.sender _i d = r oot_i d
This makes the detection of intruder nodes harder for the then
IDS [29]. Usually, the intruders combine attacks such as if D I O.r ank ≤ A.mali ci ous_r ank then
sinkhole and blackhole with selective forwarding in order to A.mali ci ous_r ank ←− R
achieve their goals by making detection harder. Because such if (A.received(DIS from B)) ∨ (A trickle_timer activated)
malicious activities aim to disturb the repair and routing mech- then
anism of RPL, they are termed RPL attacks. Several researches A.multicast((DIO with mali ci ous_r ank) to node
[9], [29]–[33] analyzed the adverse effect of different RPL ∀nodes ∈ A.N)
attacks on the LLN. Watching each attack’s symptoms over B.receive(DIO from A)
the LLNs can help researchers design a countermeasure by if DIO.rank < B.rank then
monitoring the affected parameters. Table IV demonstrates B nominate A as preferred_parent
the different negative impacts each RPL attack has on the B unicast application packets to its preferred_parent,
network [9], [29]–[33]. which is "A" now, in order to transfer it to the
destination
A. Sinkhole (SH) if Attack_type is Sinkhole then
A collect packets from B and transfer it to next hop
A sinkhole attack is a sort of eavesdropping attack that
sniffs the victims’ data by persuading them to select the else if Attack_type is Blackhole then
attacker node as the parent. This causes the construction of an A collect packets from B then drop all of them
unoptimized topology among the LLN nodes in the network. else if Attack_type is Selective_forwarding then
In Fig. 3, node 3 is the intruder and starts a sinkhole attack A collect packets from B and selectively or
by multicasting DIO messages with a lower malicious rank randomly drop some and transfer others to next
of 2 while its legitimate rank is 7. As a result of this false hop
advertisement, the neighboring nodes express their interest
in being children of the intruder by unicasting DAOs. Next,
the victim node sends their packets to their parent, now
the intruder node, to transfer the information to 6BR and the neighboring nodes by advertising a better malicious rank
other nodes. In the illustrated scenario, nodes 1 and 2 refuse with DIOs, but instead of forwarding application packets,
the DIOs from node 3 because they already have rank 2, it drops all received information. A BH attack launched from a
and node 8 is not affected by the malicious DIO message strategically chosen node can cause a massive loss in network
because it does not receive it. As a result of this falsified traffic. A Selective-forwarding (SF) attack, also called a Gray-
advertisement, the malicious node will more frequently be hole attack, is a variant of this. Here the intruder selectively
nominated as a preferred parent by its neighbors, while it or randomly drops some of the packets and forwards the rest.
does not provide a better performance based on the network Detecting this form of attack is more challenging.
Objective Function (OF). Algorithm 1 provides a pseducode
of such an attack. C. Increase Rank (IR)
This attack is against LLN nodes’ resources and indirectly
B. Blackhole (BH) disrupts victim nodes to exhaust their computational and
The blackhole attack divides the LLN into isolated sub- energy resources. It also causes a communication disruption in
networks, which cause an adverse effect on the network the LLN. The intruder initiates the attack by increasing its rank
throughput. Similar to the SH attack, the intruder node attracts and multicasting DIO messages with the modified malicious

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
PASIKHANI et al.: IDSs IN RPL-BASED 6LoWPAN: A SYSTEMATIC LITERATURE REVIEW 12947

Algorithm 2 : Increase Rank Attack Algorithm 3 : Wormhole Attack

Initialization Initialization
A: Attacker node A1 , A2 :Attacker 1 and 2
N: Neighbor list N: Neighbor list
P: Current packet B: a neighboring node ∈ N
R1 : is the initial, legitimate rank P: Current packet
R2 : is a high, less valuable rank Control_Packet = {DIO, DAO, DIS, DAO-Ack}
Input: "A" increases its rank to much higher rank and Input: B Multi-casts Control_Packet to nodes, ∀ node ∈
multi-casts it with DIO B.N
Output: "A" receives a DIO containing a lower rank Output: A1 or A2 transfer the received Control_Packet
from a neighboring node, then decreases its from B to its counterpart
rank and multi-casts it with DIO if (P is Control_Packet) then
if (P = DIO) ∧ (P.sender_i d = A.id) then if P.sour ce_i d ∈ A1 .N then
if A.rank = R1 then A1 .transfer(P to A2 )
A.rank ⇐ R2 A2 .multicast(P, ∀ node ∈ A2 .N)
else if A.rank = R1 then else if P.sour ce_i d ∈ A2 .N then
A.rank ⇐ R1 A2 .transfer(P to A1 )
A.Multicast(DIO to A.N) A1 .multicast(P, ∀ node ∈ A1 .N)
if (P is DIO) ∧ (P.sender _i d ∈ A.N ) then
if (P.Rank < A.Rank) ∧ (P.sender_i d =
r ootnode_i d) then
A.rank ⇐ R1 by the intruder node 9, transferring the collected control
A.Multicast(DIO, ∀ nodes ∈ A.N ) packets from its neighborhood to its accessory, the intruder
node 10, placed on another part of the RPL network; the
node 10 multicasts the received control packets and confuses
the nearby nodes by making them believe that the generators
higher (less valuable) rank value to its neighboring nodes. of control packets (i.e. node 4, 8, 13 and 14) are in their
By doing this, it forces the children to search and find a new neighborhood. This action encourages the victims to add
parent to approach the border router. After causing significant the initiators to their neighbor lists. The WH attack causes
network overhead, and when finally the children find a new unoptimized route construction in the network topology and
parent, the intruder node reverts back to the previous rank greatly increases network overheads. Several studies [32], [33]
or alternatively advertises a lower (better) rank to attract analyze the negative impact of the WH attack on LLNs. The
neighboring nodes to reselect it as a parent. The process WH attack can also be considered as an external intrusion if
is illustrated in Algorithm 2; it repeats continuously until it the attacker creates a tunnel between a node inside the RPL
exhausts the power resources of the victim nodes and forces network and a device outside the LLN. The manipulated or
them to shut down. In Fig. 3, the attacker node 5, initiates an malicious node inside the RPL network can be equipped with a
IR attack by increasing its rank to 6. As a result, its children more powerful antenna to transfer collected data to an external
nodes 7, 8, and 9 lose their connection to the border router and device outside the network. Due to the fact that in such attack,
set about finding a new parent by multicasting DIS messages. attackers use a private channel for transferring data, and the
Node 4 receives DISs from 7 and 8 and replies to their request border router is not involved in transferring data, detection of
by unicasting a DIO to them. Node 9 is not in the range an external wormhole attack is more sophisticated. As far as
of node 4 and sends DIOs periodically until nodes 7 and 8 we are aware, there are no IDS proposals to mitigate external
join the DODAG and respond to its DIS with a DIO. When WH attack.
the intruder realizes that the victim has found a new route to
the border router, it tries to re-attract them by advertising the E. DIS Flooding (DF)
original or better rank. This loop continues until all targets run This attack aims to exhaust target nodes’ resources by
out of power. generating a large amount of traffic in the victim network.
This also disrupts communication among the LLN nodes. The
D. Wormhole (WH) DF attack significantly increases control packet overheads and
This attack aims to disturb and obstruct the RPL topology by energy consumption, and causes routing disruption. In the
causing victim nodes to create unoptimized routes with regards flooding attack, the intruder node can be placed inside or
to a falsified OF. This happens when two or more widely outside the network, and in the most extreme scenario, it suc-
spaced attacker nodes, connected through a private channel or ceeds in exhausting all targets’ resources. As explained earlier
tunnel, over a wired or wireless connection established with in II.B, a new node or the node that has lost its connection
the help of a powerful antenna mounted on the intruder nodes, with its preferred parent and nodes in its parent list, uses
dominate two parts of the network with their broad radio a DIS message to discover a DODAG network in the RPL
coverage. Algorithm 3 demonstrates the implementation of the routing protocol. As in Algorithm 4, the intruder abuses the
Wormhole attack. Consider Fig. 3. Here the attack is initiated vulnerability of this method and multicasts a DIS message to

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
12948 IEEE SENSORS JOURNAL, VOL. 21, NO. 11, JUNE 1, 2021

Fig. 3. Illustration of attacks in a RPL network.

Algorithm 4 DIS Flooding attack but to their neighborlist (B). This RPL attack causes network
Initialization congestion and the saturation of the LLN nodes. It increases
A: Attacker node control packet overheads considerably. In the multicast DIS
N: Neighbor list Flooding attack, the victim node, the receiver node here, will
I: Current node id reset its trickle timer and multicast its DIO message when
B: a neighboring node ∈ N its receives a multicasted DIS message from the intruder. In a
V: Victim list unicast DIS flooding attack, the receiver node of unicasted DIS
P: Current_packet message unicasts a DIO to the intruder without resetting its
Attack_type = {Unicast DIS Flooding, Multicast DIS trickle timer. Since it is not required to be part of the DODAG
Flooding} to send DIS control packets, an intruder can initiate the DIS
Contr ol_Packet = {DIO, DAO, DIS, DAO-Ack} flooding attack outside of the network [10].
Input: "A" uni-casts or multi-casts DIS to node(s), ∀
nodes ∈ A.N
Output: "B" uni-casts or multi-casts DIO message F. Clone Id (CI) & Sybil Attacks
if A.Attack_type is Unicast DIS Flooding then Both of these attacks are inherited from WSNs. In the
A.unicast(DIS ⇒ B, B ∈ A.N) Clone ID attack, the intruder node clones or takes the identity
B.unicast(DIO ⇒ A) (MAC address, IP address, rank, etc.) of a victim node,
else if A.Attack_type is Multicast DIS Flooding then then multicasts or unicasts packets to its neighbors to disrupt
A.Multicast(DIS, ∀B ∈ A.N) the network and threaten confidentiality and integrity of the
for ∀B ∈ A.N do targeted node data. On the other hand, in the Sybil attack,
B.Multicast(DIO, ∀node ∈ B.N) the intruder aims to disturb a vast number of nodes by stealing
the identity of several nodes. The intruder then multicasts and
unicasts the control packets of targeted nodes simultaneously.
The placement of intruder node(s) in a Sybil attack affects the
degree of negative impact on the network; this has been studied
the neighboring node then listens for a DIO reply; this action in [38]–[40]. The intruder node(s) can manipulate data by
repeats in order to drain resources and cause a considerable bonding to an area and disturbing a smaller quantity of nodes
number of collisions in the network. Fig. 3 illustrates a DIS by stealing their identity and collecting their data; the process
flooding attack scenario. In the scenario (A), node 7 is is presented in Algorithm 5. They are also capable of scaling
assigned as the intruder and establishes the flooding attack by the attack domain by influencing nodes in different locations
multicasting DISs to its neighbor list. As a result, its neighbors to impact a larger proportion of network. The aim in this kind
reply to its request by multicasting DIOs not only to node 7 of placement is to damage the routing mechanism and make

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
PASIKHANI et al.: IDSs IN RPL-BASED 6LoWPAN: A SYSTEMATIC LITERATURE REVIEW 12949

Algorithm 5 Sybil Attack Algorithm 7 Version Number attack

Initialization A: Attacker node N: Neighbor list P: Initialization
Current packet L: Target List S: sender node A: Attacker node
Control_Packet = {DIO, DIS } N: Neighbor list
Attack_Types = {Sybil, Clone_Id} I: Current node id
Input: Control_packet initiated by victim node(s) B: a node
Output: "A" steals victim nodes credentials, then P: Current packet
uni-casts or multi-casts control packets with M_VN: Malicious Version Number
their identities Contr ol_Packet: {DIO, DAO, DIS, DAO-Ack}
if (P ∈ Control_Packet) ∧ (P.sender _i d ∈ A.N) then Input: "A" collects DIO from the root or a neighboring
//attacker can select the victim(s) selectively or target node and reads the current version number
its children Output: "A" increases the current version number and
if (S.node_i d ∈ A.children_list) then puts it in (M_VN) and advertise it through
if (Attack_Type = Sybil) then multi-casting DIO
if (S.node_i d ∈ A.L) then if (P = DIO ∧ P.destination_id = A.id) then
A.clone(S.credential) if (P.version_number = 1) ∨ (P.version_number ≤
A.Multicast(Control_Packet ⇒ A.N) ∨ M_VN) then
A.Unicast(Control_Packet ⇒ A.N[node_id]) A.DIO[version_number] ⇐ M_VN
else if (L.length = 1 ∧ Attack_Type = Clone_Id) A.multicast(DIO, ∀B ∈ A.N)
then M_VN ⇐ M_VN ++
A.clone(S.credential)
else if (P.version_number > M_VN) then
A.Multicast(Control_Packet ⇒ A.N) ∨ A trigger repair mechanism of DODAG and
A.Unicast(Control_Packet ⇒ A.N[node_id]) recalculate its rank
M_VN ⇐ P.DIO[version_number] ++
A.DIO[version_number] ⇐ M_VN
Algorithm 6 Worst Parent Attack A.multicast(DIO)
Initialization A: Attacker node N: Neighbor list P:
Current packet Control_Packet = {DIO, DIS, DAO,
DAO-Ack } or can alter the received packet from a neighboring node
Input: "A" discovers the neighboring node with the
and enable its ‘O’ and ‘R’ flags before forwarding it to the
highest, least valuable rank, providing the worst
destination. This causes significant control packet and energy
OF
overheads and increases packet delivery time. If the intruder
Output: "A" selects the discovered worst parent as the
decides to manipulate the received packet before transferring
preferred parent to reduce routing performance
it, the detection becomes harder. It causes isolation in the
if (P = DIO) ∧ (P.sender_i d ∈ A.N) then
if (A.preferred_parent[rank] < Node.Rank, ∀ Nodes ∈ network because the receiver node always drops the packet
A.N) then and initiates the repair mechanism.
A.preferred_parent = Node.id
I. Version Number Attack (VN)
Since there is no built-in security mechanism to ensure that
the ranking system or OF ineffective. Detection of distributed only the root node can modify the value of a DODAG version
attack scenarios is harder if malicious nodes are mobile. The number in a LLN, the intruder can abuse this vulnerability to
study [40], describes various types of Sybil attacks. cause an adverse impact on the functionality of a DODAG.
G. Worst Parent Attack (WP) In a VN attack (Algorithm 7), the intruder node incrementally
increases the repair mechanism value and then advertises
As in Algorithm 6, the intruder selects the worst parent
it through its DIO message. This encourage LLN nodes
to transfer data [29] while multicasting its actual rank with
to enable the global repair procedure and recalculate their
DIOs. The idea behind this attack is to cause lengthy end-to-
routing paths more frequently. VN causes significant energy
end delays and create an unoptimized path from children nodes
overheads in LLN nodes while exhaust-ing their computational
to the 6BR. Detection of this attack is more challenging than
resources. This attack can become much more sophisticated if
other attacks because the intruder does not show any abnormal
the intruder node is far from the 6BR, i.e., in the lower level
attitude through multicasting control packets; however, if the
of the DODAG hierarchy. In [30], [31], the authors analyze
intruder decides to impact larger nodes and attract more
the negative impact of the VN attack on LLNs.
children by advertising lower rank, detection becomes more
feasible. No current study covers this attack.
J. Ranks Attack (RA)
H. DODAG Inconsistency This attack is harder to be detected because the intruder
The intruder can either multicast malicious control packets node does not initiate any malicious packet or manipulate any
with enabled ‘O’ and ‘R’ flags in the opposite direction legitimate packet. It disregards the rank error initiated by its

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
12950 IEEE SENSORS JOURNAL, VOL. 21, NO. 11, JUNE 1, 2021

TABLE IV
RPL ATTACKS AND T HEIR I MPACTS ON LLNs

neighboring or child node [29]. The DODAG only allows an error in the network. This results in computational exhaustion
increase of the rank in a downward direction and decreases in of LLN nodes and an increase in control packet overheads in
upward direction, as illustrated in Fig. 2. The nodes have to the network, because victim nodes have to recalculate their
check the rank condition when sending and receiving packets. routes to the malicious node.
If LLN nodes find any error in this procedure, they have to
enable the rank-error bit defined in the RPL protocol and L. Replay Attack
inform neighboring nodes about inconsistency in the network; The intruder records legitimate control packets, such as
this prevents the formation of a loop in the network. In the DIO, DAO, DIS, generated by its neighboring nodes, and
rank attack, the intruder does not enable the rank-error bit then later it unicasts or multicasts the collected packets. This
when it discovers a rank error. This attack difficult to detect causes inconsistency, and creation of expired routing paths in
because the intruder does not display any abnormal behavior the network because some configuration in advertised control
(e.g., it satisfies all protocol conventions, except honesty). packets are outdated and cause the network to function erro-
In the long run, this malicious behavior causes the formation neously. Algorithm 8 represents such an attack. Because the
of a loop in the network, damaging the network topology. intruder forwards the collected control packets from legitimate
Moreover, it isolates the nodes with a rank error in the nodes, built-in security mechanisms of RPL and the use of
network and results a massive number of error packets and cryptography cannot prevent it [8].
inconsistencies in the routing mechanism. It [29] analyses the Even RPL secure mode and cryptography cannot secure
impact of the rank attack on LLNs. the LLN against such intrusions because knowing the keys
is not required for an intruder to replay collected packets.
The consequence of this attack is discussed in Table IV. The
K. Local Repair Attack (LR) intruder replays the application packet in the replay attack for
The intruder initiates this attack by sending a repair packet the WSN platform, while in the RPL, the intruder replays
to the node in its neighborlist while there is no inconsistency or control messages only.

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
PASIKHANI et al.: IDSs IN RPL-BASED 6LoWPAN: A SYSTEMATIC LITERATURE REVIEW 12951

Algorithm 8 Replay Attack data, analysis type, detection strategy, monitoring technique,
Initialization A: Attacker node N: Neighbor list P: the form of response, and detection time. Next, each criterion
Current packet L: Target List R: List of recorded control is discussed in detail and the relevant proposed methods
packets Control_Packet = {DIO, DIS, DAO, DAO-Ack } categorized. Fig. 5 gives a taxonomy of IDS for RPL and
Input: "A" records Control_Packet initiated by "L" Table VI shows the IDS approaches employed by researchers.
Output: "A" multi-casts R Before classifying IDSs, we define what an IDS is. In recent
if (P ∈ Control_Packet) ∧ (P.sender _i d ∈ A.N) then years we have seen inconsistency in the definitions of IDS in
//attacker can select the victim(s) selectively or target RPL. The IDS is the software or hardware designed to monitor
its children and analyze the events taking place inside the host machine,
if (P.sender _i d ∈ A.L) then or packets sniffed through the network traffic, in order to dis-
Add(R ⇐ P) cover any suspicious activities and raise an alarm. An IDS does
if (Attack_triggertimer.status = Activated) then not have any mitigation duty. On the other hand, an Intrusion
A.multicast(R, ∀ nodes ∈ A.N) Prevention System (IPS) can work with an IDS to mitigate
suspicious behavior.
Although IPS can autonomously prevent intrusions, security
M. DIO Suppression attack (DS) administrators sometimes may prefer to implement IDS rather
The authors of [96] study the DIO suppression vulnerability than IPS. Moreover, detecting suspicious activities (via an
of RPL and analyze its adverse impacts on LLNs. In the DS IDS) or mitigating the effects of an intrusion (using an IPS) it
attack, the intruder advertises a DIO frequently in order to slow is often desired simply to understand the situation better. For
down the DIO message process. Neighboring nodes of the example, administrators like to discover the aim and identity of
attacker consider the received DIO consistent after collecting intruders by tracing the path of attackers seeking information.
enough similar DIO messages from the malicious node. This This may be achieved, for example, by using a honeypot or a
leads victim nodes to suppress their DIO multicasting process, variety of situational awareness tools.
which in turn leads to the isolation of some LLN nodes since
they cannot discover their neighboring nodes, and some routes A. Source of Monitoring Data
that are providing better OF will remain undiscovered. A study The source of data for monitoring can be defined with
and analysis of the consequences of a DIO suppression attack regards to the type of intrusion the IDS aims to counter.
in LLN can be found in [94]. It also proposes a mitigation It may aim to secure the IoT network against attacks manip-
method [94]. ulating the content of the application layer, such as SQL
injection, bruteforce, or side-channel attacks. In this case,
N. DAO Inconsistency attack (DI) monitoring audit-logs, system events of the client machine,
In RPL, the forwarding-error flag is designed to indicate or in some scenarios, the payload contents of network packets
that the stored path in the routing table of the parent is no after decryption plays a vital role in detecting intrusions.
longer valid and needs to be removed. This is done by enabling On the other hand, the attacks that alter the parameters of
‘F’ flag in the option header of the received packet and a legitimate network packet or generate malicious packets
replaying it to the parent. In RPL storing-mode, the intruder require the appliance of network security infrastructure such
exploits the vulnerability of this mechanism to initiate a DAO as an IDS to monitor and analyze network traffic. Therefore,
inconsistency attack. Upon receiving a packet sourced from the IDS obtains network-packets and audit-logs of the host
an ancestor of the intruder node, the intruder enables the machine, or both for monitoring purposes.
‘F’ flag of the received packet and replays it to its parent 1) Network-Based IDS (NIDS): Since RPL is in the net-
to claim that the indicated downward route in the packet is work layer of the IoT stack, detecting RPL attacks requires
no longer available. This misleads the parent into removing analyzing network packets. The NIDS analyses the flow of
the legitimate downward route from its routing table. As a network traffic in the LLN. Researchers commonly use NIDS
result, the parent node also has to inform its parents that for detecting RPL based intrusions. However, NIDS cannot
the destination node is no longer available when it receives a analyze the encrypted contents of packets’ payloads without
packet that wants to use the expired route. The authors of [87] possessing the encryption key. The NIDS monitors the network
study the impact of this attack on LLNs. traffic either through several monitoring agents placed among
LLN nodes, or each LLN node is required to participate in the
IV. I NTRUSION D ETECTION S YSTEMS monitoring task, as discussed in Section V. The advantages and
Security infrastructures such as encryption may perform disadvantages of NIDS in 6LoWPAN are given below. NIDS
well in securing 6LoWPAN against external intrusions but are widely used by researchers in this domain because they
they are computationally expensive [87], [90], [97] for LLN can monitor 6LoWPAN on a large scale. NIDS operates in
nodes and cannot make RPL resilient in the face of internal hidden mode, also called ghost-mode, and is concealed from
malicious activities [49], [98]. However, Intrusion Detection the eyes of intruders; therefore, attackers cannot probe them
Systems (IDSs) show outstanding performance with accept- in order to compromise them [48].
able energy overhead for detection of internal and external Additionally, NIDS can function in passive mode and cause
intrusions. The structure of IDS for 6LoWPAN can be clas- less energy and computational overhead for LLN nodes.
sified along several axes, namely the source of monitoring This also leads to less disruption in network traffic and less

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
12952 IEEE SENSORS JOURNAL, VOL. 21, NO. 11, JUNE 1, 2021

congestion and dropped packets. A strategically placed probe of misuse-based IDS, while this detection strategy is unable
can monitor an extensive network. However, centralized NIDS to detect unknown intrusions. Intrusions are the ones not
are very likely to face difficulties in dealing with volumes of stored in the system profile/database, because it is either a
incoming data from an extensive scale network, especially if zero-day attack or one whose signature is otherwise not yet
the assigned monitoring node has resource constrained LLN included. So this category of IDS only performs well over
devices. They may miss incoming attacks during periods of known intrusions and shows poor performance over unknown
high traffic. Secondly, NIDS cannot analyze the encrypted attacks. Continual updating of the database is needed. Also,
content in sniffed packets’ payloads. Finally, the network signature-based IDS demands significant storage space, which
communication between the central IDS and the sensors in the is scarce in IoT nodes; researchers usually place such IDS in
active decentralized, hybrid IDS generates a very significant the 6BR or at the edge.
control packet overhead, leading to network congestion. 2) Anomaly-Based: Unlike misuse-based IDS, an anomaly-
2) Host-Based IDS (HIDS): The HIDS, in its traditional based IDS adapts to normal activities and highlights any devia-
meaning, is designed to monitor and analyze not only the tion from the system’s normal behavioral profile. This enables
network inputs and outputs of the host machine but also anomaly IDS to detect unknown attacks. It does so through
the internal system events that are taking place inside the statistical, knowledge-based, or machine-learning methods.
host machine. It monitors system logs and events to identify However, such IDS is known for having a considerable FPR;
suspicious activities. Because HIDSs are hosted in LLN nodes, that is because lots of normal activities are not considered
they may place very significant demands on the computational or have been missed in the profile-building/training phase.
and energy resources of the host machine. As mentioned This form of IDS constructs a profile of normal activities
earlier, there is no use of HIDS in its traditional definition across nodes in the LLN. The anomaly-based IDS requires
for detecting RPL attacks; all researchers employ NIDS to less storage compared to the misuse-based IDS, but consumes
counter such attacks. However, the use of HIDS is essential, more processing power, especially in the training period [16].
especially for attacks manipulating IoT in the application layer Additionally, determining what is normal requires a compre-
and when analyzing encrypted content of packet’s payload is hensive dataset of legitimate activities and also requires a long
required. In the RPL domain the proposed IDS is sometimes adaptation period.
called host-based by researchers if LLN nodes are required 3) Specification-Based: This IDS uses a defined notion of
to send their device information in terms of geographical normal behavior and highlights any deviation from it. How-
location, RSSI (Received Signal Strength Indication), routing ever, and unlike the anomaly-based approach, expert manual
table, neighboring node information etc., to an IDS or an assistance is typically required to define the specification of the
internal IDS of the node. Researchers typically categorize this normal profile. (This may take the form of a protocol specifica-
IDS as being one of active monitoring. tion for example.) This strategy is widely used by researchers
3) Hybrid IDS: The IDS is called hybrid, in terms of the on account of its small storage requirement and reasonable
data source, if both HIDS and NIDS security mechanisms are FPR and FNR performance and requiring no training period.
incorporated in a network, among LLN nodes, to monitor the Furthermore, according to [41], this approach is well-suited
network events that are taking place from different perspec- to detecting topology or rank-based attacks in RPL networks.
tives. Although this technique provides the IDS management However, specification-based IDS cannot update its normal
system with a broader monitoring oversight of the 6LoWPAN profile when the network topology changes or when there is an
and secures the network against a more extensive range of increase or decrease in the number of nodes. Manual updates
malicious activities threatening different stack layers of IoT, to the specification will be needed.
there is no any research that covers this type of IDS yet. 4) Hybrid: To remedy the shortcomings of the detection
strategies mentioned above, researchers have sought to com-
B. Detection Strategy bine the detection strategies to produce hybrid IDSs to mon-
There are two main approaches to the analysis of events itor the network. A hybrid IDS typically provides a better
for detecting attacks [99]: detection of malicious signatures detection rate and performance at the expense of greater
and detection of anomalies. Signature detection is broadly resource (computation and energy) consumption. Researchers
employed by most security software companies in the mar- seek practical trade-offs between accuracy and LLN nodes
ket. Anomaly-based IDS has attracted researchers over many resource exhaustion.
years. A third approach, specification-based IDS, compares
behaviors against reference behaviors defined more formally, C. Response
e.g. by protocol specifications. Below we describe each of the An IDS generally seeks to detect intrusions. Once detected,
proposed methods. a decision needs to be made as to how to respond. We can
1) Signature-Based: The signature-based IDS, also known categorize responses into two major groups:
as misuse-based, compares the collected data against the 1) Passive Response: Here, the security administrator or
already stored signatures of malicious software to identify the system users will be informed about the occurrence of
abnormal activities. This type of IDS relies on stored patterns abnormal activities. No automated corrective action is taken
of known intrusions, collected by experts through real-world as a result. The ‘response’ must be manually invoked.
experience, and empirical or simulation experiments. Causing 2) Active Response: Here, the response is automatic and
the lowest False Positive Rate (FPR) is a major strength takes place when specific categories of attacks are noticed.

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
PASIKHANI et al.: IDSs IN RPL-BASED 6LoWPAN: A SYSTEMATIC LITERATURE REVIEW 12953

TABLE V
M ONITORING T ECHNIQUES AND D ETECTION S TRATEGIES IN IDS

Active intrusion detection systems log and notify the security sensors have limited resources and IDS computation may drain
administrator in the same way as passive ones do, but they can their computational resources (processing, storage, ROM, and
also take extra actions to counter the intrusion. For instance, energy). Placing IDS agents across dedicated nodes can reduce
they may alter Access Control Lists (ACLs) on a firewall in monitoring traffic, provide us with more processing capacity,
order to terminate malevolent traffic, block processes on the and enable the IDS to monitor a wider area.
server subject to the intrusion, or guide the intruder to a trap The IDS can be placed at various locations in the IoT
or “safe environment” created by security administrators. network, such as sinknode/6BR, predefined devices, or all
nodes. Nodes that host IDS can have different responsibilities.
V. M ONITORING T ECHNIQUES In the distributed IDS the nodes can be responsible for
monitoring neighboring sensors. A node that is responsible for
Earlier IDSs dedicated a solitary monitoring node to analyze
monitoring its neighbors is usually referred to as a watchdog.
and watch the events either in a hosted device or a specific
The centralized IDS is placed at an individual node and works
network. This is called Centralised IDS (CIDS). In the RPL
alone. In an IoT network it typically is placed on the border
network the CIDS is usually placed at the 6BR because it
router or a dedicated host. Since the border router is the bridge
incurs lower energy and computational overheads compared
between LLNs and outside world placing the IDS in the 6BR
with LLN nodes. CIDS is prone to highly sophisticated and
allows monitoring and analysis of the internal and external
distributed intrusions and Single Point of Failure (SPoF). That
traffic to the 6LoWPAN network [16].
is because the computational power of 6BR may sometimes
Nevertheless, analyzing traffic between LLNs and the Inter-
be overwhelmed and a considerable proportion of incoming
net that traverses the border router is not enough to secure the
network traffic not being analyzed. To address CIDS issues the
network because it cannot watch the activities that are taking
Distributed IDS (DIDS) carries out data monitoring and/or IDS
place among the nodes unless they are near the 6BR. Addi-
detection tasks at several locations. Although DIDS is a bet-
tionally, the centralized IDS may have difficulty monitoring
ter candidate for computer networks, demanding 6LoWPAN
compromised nodes. The IDS monitoring technique divides
network nodes participate in monitoring and detection tasks
into two categories called Active and Passive monitoring,
causes very significant network overheads. Researchers have
whether the LLN node participates in the monitoring tasks
considered different placements of DIDS in LLNs to balance
or not. Table V gives the pros and cons of each monitoring
the number of agents in a way that covers a reasonable number
technique.
of nodes. In the most computationally expensive scenarios the
monitoring and detection duty is spread across all nodes. One
of the most effective distributed placements of IDSs, a cluster- A. Active Monitoring
ing placement that divides the LLN into clusters with cluster In this kind of monitoring, the LLN nodes are responsible
heads with various combinations of tasks among nodes and for monitoring tasks. The monitoring tasks can be transferring
heads, is discussed in detail in [111]. The placement of IDSs packets or gathering monitored information, and analyzing
and their monitoring nodes plays an essential role in reducing them. This monitoring technique divides into three subcate-
network overheads, saving energy resources, reducing FAR, gories: centralized, decentralized or hybrid.
and increasing the detection rate of attacks. Fig. 4 depicts 1) Centralized Monitoring: In active centralized monitoring,
existing monitoring techniques for IDS in LLN. a single central unit is responsible for analyzing and judging
Although the 6BR has sufficient hardware resources to the collected packets. Meanwhile, the rest of the nodes need
carry out heavy computation and host a comprehensive IDS, to monitor, capture, and store the data and transfer them to
communication between LLN nodes and the 6BR results the Central Manager unit (CM). The CM node aggregates
in very significant overheads on the network. Placing IDS received data and analyses it. Usually, the CM has better
agents on the sensors can reduce the control packet overhead computational hardware resources than other nodes in the
associated with network monitoring. However, such LLN RPL network. It can be a local server or manifest itself as a

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
12954 IEEE SENSORS JOURNAL, VOL. 21, NO. 11, JUNE 1, 2021

Fig. 4. Monitoring techniques.

cloud-based service. This type of IDS works well over small 1) Centralised: In this approach, the monitoring nodes pas-
scale networks. However, in larger-scale networks the CM is sively listen to the communications in the network, then
more likely to face route congestion and suffer from significant collect the data before sending it to the sink node, which
overheads and SPoF. is responsible for analyzing and decision-making. PCIDS is
2) Decentralized Monitoring: This type of monitoring is capable of conducting a more in-depth analysis of the collected
similar to a centralized approach where each node still has data remotely, on the edge or cloud, where more computational
responsibility for packet collection and transportation. How- resources are available; however, this results in a delay for
ever, unlike active centralized IDS, the distributed nodes are attack detection.
usually router nodes or cluster heads and need to perform 2) Decentralized: In this approach, the central manage-
decision making tasks. Therefore, there would be reduced load ment unit and several monitoring nodes are responsible for
on the LLN nodes in the network compared with central- monitoring tasks like data aggregation and analysis. Several
ized monitoring. Although decentralized monitoring conserves monitoring nodes can be placed in the network to do data
nodes’ hardware resources better than a centralized one, it still collection, and aggregation tasks. The sniffers can be involved
places significant computational and energy demands on LLN in sending the collected data from their neighboring nodes to
resources. the monitoring nodes. Next, monitoring nodes can perform
3) Hybrid Monitoring: In an active hybrid approach, both the data aggregation before forwarding information to the sink
CM and distributed nodes share responsibility for monitoring node for deeper analysis. In this way, the target node gets
and decision-making in the network. However, LLN nodes analyzed from both local and global perspectives.
must still collect and transfer their information to IDS agent
nodes and so there may be computational exhaustion of LLN VI. VALIDATION
nodes’ resources. A. Validation Approaches
Researchers use different IDS validation approaches, as dis-
cussed below.
B. Passive Monitoring 1) Simulation: This strategy is the most widely used
In this approach, monitoring nodes (sniffers) are assigned in approach for IDS validation in this domain. Here, researchers
the 6LoWPAN to sniff and collect control packets from their either validate their method against a dataset generated through
neighborhood. They are responsible for collecting information simulation of several normal and attack scenarios or implement
about nodes and events occurring in the target network. Passive their proposed algorithm in the simulator and validate its
monitoring employs centralized and decentralized approaches, performance at run-time using different evaluation metrics.
as described below. There are several pros and cons to using this validation

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
PASIKHANI et al.: IDSs IN RPL-BASED 6LoWPAN: A SYSTEMATIC LITERATURE REVIEW 12955

TABLE VI
S TATE - OF - THE -A RT IDS T ECHNIQUES

method. The main advantage of simulation is its low cost, 5) No Validation: There are several researches in this field
low implementation effort, and compressed experimental time that did not provide any evidence for their proposed methods.
(i.e. simulated time is far quicker than real-time). The majority This is the most unreliable approach for validation.
of simulators in this field are open-source and implementing
a large number of nodes does not significantly increase the B. Evaluation Metrics
project cost. Moreover, the time taken to implement and Researchers use several metrics to measure the performance
test ideas can be drastically decreased compared to empiri- of their proposed methods. It is common to measure the
cal approaches. However, simulation outcomes may be less accuracy and effectiveness of the proposed IDS in classifying
reliable than those of empirical validation. malicious and normal packets. One of the most comprehensive
2) Empirical: This approach collects the evidence through ways to calculate the performance of a classifier is the confu-
an experimental network setup. It is considered as the most sion matrix, illustrated in Fig. 6. It summarizes four aspects
reliable approach for evaluating any proposed system. How- of binary classification: the numbers of True Positives (TP),
ever due to high economic costs, effort and time barriers, True Negatives (TN), False Positives (FP), and False Nega-
the implementation and use of an extensive heterogeneous IoT tives (FN). Each source event is classified as either an attack
network in a wide geographical area for a long duration is not or normal. The positive is the intrusion class, and negative
feasible using this validation method. is the normal one. Most studies seek to minimize the False
3) Theoretical: a solid theoretical argument to support Positive Rate (FPR) and False Negative Rate (FNR). Both
research outcomes. This includes, e.g. relating a model to false classification of malicious activity as normal (FN) and the
attribute properties it is intended to represent [112]. false classification of normal packets as malicious (FP) incur
4) Hypothetical: This validation strategy is used when the costs. In contrast, the correct classification of intrusions (TP)
applicability of the proposed method in practice is not clearly and normal activities (TN) incurs no cost other than the
specified. costs of deploying the IDS (C0) (Fig 6, B). Reducing the

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
12956 IEEE SENSORS JOURNAL, VOL. 21, NO. 11, JUNE 1, 2021

Fig. 5. IDS taxonomy.

FPR is generally considered easier than reducing the FNR. the proposed detection technique.
Of course, the FNR is significantly sensitive to inability to FN
detect unknown intrusions. FNR = (1)
FN + T P
In Fig. 6, FNs and FPs have different negative conse- FP
quences. A considerable number of FPs causes system man- FPR = (2)
FP + T N
agement to waste time and can lead to loss of confidence.
The Packet Delivery Ratio (PDR), equation 3, is the ratio
A high FN indicates that the IDS is failing to perform the
between the total number of application packets received by
primary task it was designed for. The FN rate, equation 1,
the final destination nodes and the total number of application
is usually higher than the FP rate, equation 2. Reducing FP
packets sent by senders.
is more challenging but essential. Normal packets usually n
significantly outnumber malicious ones and this will generally i=1 Preceivedi
PDR =  n (3)
have consequences for the reliability of trained classifiers for j =1 Psent j

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
PASIKHANI et al.: IDSs IN RPL-BASED 6LoWPAN: A SYSTEMATIC LITERATURE REVIEW 12957

Fig. 6. Decision threshold and confusion matrix.

The Detection Rate (DR), equation 4, is another widely used is not the aim of this study. Table VII and, VIII summarize the
metric in this field. It declares how and in what measure the results provided in each piece of research using the evaluation
IDS succeeds in detecting the attacks. metrics discussed in section VI-B. Studying and analyzing
TP Tables IV, VI, VII, and VIII help us to answer each question
Recall = DR = TPR = (4) in turn.
T P + FN
The Control Packet Overhead (CPO) is the total number
of DODAG control packets (DIO, DAO, and DIS) initiated A. To What Extent Are RPL Attacks Addressed
by each node, equation 5. In order to calculate the power so Far (Q 1)
consumption of a node, researchers use equation 6, which is In Section IV, we introduced and described a comprehen-
the sum of total energy consumed by the machine and the sive set of known RPL attacks. Fig. 7.A illustrates to what
network (Energy consumption) divided by the elapsed time extent each RPL attack has been addressed so far, based
in seconds. on Table VII and VIII data. The extracted information shows
n that the proposals mostly concentrate on addressing sinkhole,
CPO = (DO D AGContr ol Packet)i (5) selective forwarding, DIS flooding, and blackhole attacks, with
i=1 21%, 14%, 10%, and 10% of papers, respectively. The rest of
Energy consumed(mJ) the attacks constitute less than half of the researches’ attention,
Power Consumption = (6)
Time(s) 45% in total. There are two explanations; either the dominant
attacks are the most disruptive malicious activities that are
The End to End (E2E) delay gives the average time elapsed
harming LLN, or the less considered attacks are less easily
when transferring a packet from a source to its destination,
detected. Hence, there is a significant need for research to
equation 7.
n mitigate all intrusions or concentrate more on those receiving
di little attention. Our survey did not find any study propos-
E2E Delay = i=1 (7)
n ing an IDS to mitigate Worst Parent, External Wormhole,
Accuracy, given in Equation 8, is the fraction of all events OF Manipulation Attacks. Also, very few propose IDS to
that are correctly classified (either as malicious or normal). mitigate Replay, DODAG inconsistency, DAO inconsistency,
Precision, given in Equation 9, is the fraction of all posi- Neighbor attacks, and Rank attacks. No comprehensive study
tive classifications (i.e. alarms) that are correct. Precision is in this field mitigates all types of RPL attack. Because some
focused on positive classifications whilst accuracy considers RPL attacks are similar in nature, the ideal IDS should be able
both positive and negative classifications. not only to detect the occurrence of attacks but also identify the
type of attack accurately and identify intruder nodes correctly.
TP +TN
Accuracy = (8)
T P + FP + T N + FN
TP B. Negative Impact of Each RPL Attack (Q 2)
Precision = (9)
T P + FP Studying the proposed methods enables us to determine to
what degree each RPL attacks cause abnormality in 6LoW-
VII. D ISCUSSION PAN. Discovering the adverse impact level of each RPL
Our study reviews 103 papers in order to answer the attack requires an in-depth analysis of each intrusion over
questions posed in section I.A. The results provided by several LLN scenarios, which is accomplished by the already
researchers are considered as the basis for evaluating and reviewed researches mentioned in section III. Table IV shows
comparing their proposed methods. Justifying the correctness the negative impact of each attack from different perspectives
and trustworthiness of the provided results claimed by authors that are scaled with regards to terminology used in the studied

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
12958 IEEE SENSORS JOURNAL, VOL. 21, NO. 11, JUNE 1, 2021

TABLE VII
S TATE - OF - THE -A RT R ESEARCH O UTCOMES ON IDS IN L OW P OWER AND L OSSY N ETWORK (LLN)

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
PASIKHANI et al.: IDSs IN RPL-BASED 6LoWPAN: A SYSTEMATIC LITERATURE REVIEW 12959

TABLE VIII
S TATE - OF - THE -A RT R ESEARCH E XPERIMENT S ETUP ON IDS IN L OW P OWER AND L OSSY N ETWORK (LLN)

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
12960 IEEE SENSORS JOURNAL, VOL. 21, NO. 11, JUNE 1, 2021

Fig. 7. Mitigated attacks (A) and research objectives (B) proportions.

Fig. 9. Negative impact level of each RPL attack.

Fig. 8. The adverse effects of RPL attacks on LLN.

networks (Obj7), resilience against unknown intrusions (Obj8),
providing intrusion prevention mechanisms (Obj9), and high
paper. This answers Q2 and helps researchers to concentrate PDR (Obj10). There are multiple objectives that can be used
more on the most destructive malicious activities. Table IV, for evaluation purposes. Many pieces of research address only
Fig. 8 and Fig. 9 reveal that the version number attack is the one or a small number of these and provide no information
most disruptive intrusion on the LLN, while OF manipulation on the others. We cannot assume that the implemented sys-
and worst parent attacks cause the least disruption (which tems perform well on objectives that have not been formally
makes their detection harder). Analyzing the affected para- evaluated, and so the practical applicability of such IDS
meters would help researchers to detect such attacks. Each in real-world networks is doubtful. Often researchers call
RPL attack manipulates and harms the target network in their method comprehensive in all terms without providing
various aspects with different strengths; therefore, precise and sufficient evidence to prove their claim. Table IX and Fig. 7.B
accurate algorithms are required for IDS to not only detect the show the objective of each study based on statements and
occurrence of attack but also to classify the type of intrusion the results provided in their paper. In order to discover
to distinguish the intruder node correctly. the minimum, maximum, first quartile, mean, median, third
quartile value of each detection and monitoring technique
C. Technical Performance Objectives (Q 3) used by researchers, we analyze the provided results in
The primary stated objectives of the reviewed IDS Table VII and VIII and extract essential information shown in
approaches are to achieve the high TPR/Detection Rate (Obj1), Fig. 11. With regards to extracted data we illustrate to what
low energy consumption overheads (Obj2), low Control Packet extent researchers satisfy the objectives, in Fig. 10. Enhancing
Overhead (Obj3), low FAR(Obj4), ability to protect networks the detection rate (Objective 1) is the primary aim of 17% of
that have mobile nodes (Obj5), provide mitigation for mul- the reviewed papers. Although 58% of researches satisfied the
tiple attacks (Obj6), evaluation over many and heterogeneous requirement of this objective, 8.7% could not fully answer this

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
PASIKHANI et al.: IDSs IN RPL-BASED 6LoWPAN: A SYSTEMATIC LITERATURE REVIEW 12961

TABLE IX
R ESEARCHERS O BJECTIVES

Fig. 10. Aimed objectives.

need, and 33.3% did not address this essential requirement of

IDS. This study discovers that 65.2% of proposed methods
would be able to detect unknown intrusions (Objective 8) with
the attention of 23% of papers.

D. Monitoring Techniques Implementation

Proportion (Q 4)
76.8% of the proposed methods use active monitoring sys-
tems and the remaining 23.2% use passive monitoring, using
Fig. 12.A. Active monitoring techniques enable the researcher
to reduce the financial cost of the network, as there is no need
for extra equipment and sniffers to probe the LLN. Further-
more, LLN nodes can provide host machine configuration and
other information, which is not available in passive monitoring
techniques. However, assigning the monitoring tasks to the
LLN constrained nodes increases network traffic overhead
as nodes need to transfer their information to centralized or
decentralized IDSs. The passive monitoring technique can
reduce the active monitoring shortcomings while providing
IDS with less detail about LLN nodes. Moreover, even though
passive monitoring can provide a comprehensive view of
the monitored network [113], the use of separate network
communication (i.e. a collection of probes) may increase E. Proposed IDS Strategies (Q 5)
overhead costs and restricts their benefit to the small-scale Sections IV and V discussed existing IDS techniques and
and controlled network. As a result, and as seen from Fig. 12, monitoring methods in the literature. Fig. 12.B, and Fig. 12.C
most proposals use active monitoring. Researchers in [89] use show the proportions of each IDS strategy built on by the
a different channel for IDS agents’ communication to reduce reviewed papers and the proportion of their response types,
the negative impacts of IDS communication on LLN in pas- respectively. We can see that the majority, 54%, of the
sive monitoring techniques. Table VI shows what monitoring introduced methods use a specification-based detection strat-
technique is used in each research, and Table V gives each egy to mitigate RPL attacks, 21% are hybrid, 17% are
monitoring technique’s strengths and weaknesses. anomaly-based, and the remaining 8% are signature-based

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
12962 IEEE SENSORS JOURNAL, VOL. 21, NO. 11, JUNE 1, 2021

Fig. 11. Statistical results regarding monitoring(left) and detection(right) strategies.

IDS. This noticeable difference in proportions is because

specification-based IDS uses less storage space and con-
sumes less computational resource than misuse-based and
anomaly-based detection approaches. However, such IDSs are
inflexible and do not adapt automatically to attacks, as stated
in section IV-B.

F. Shortcomings of Proposed Methods (Q 6)

Studying Fig. 10 and Fig. 11 shows the vulnerabilities and
disadvantages of each IDS strategy in LLN. Further study
is required to address the shortcomings stated in Table V.
From Fig. 11, we can see that researchers receive the least
FPR and the best TPR using misuse detection techniques
with 1% and 95.2% FPR and TPR, respectively. However,
none of the proposed misused-based IDS, which constitute
8% of all proposed methods, provides any evaluation of
FNR, which is an essential metric, especially for evaluating
signature-based IDS. Anomaly IDS provides the researchers
with the least FNR of 5.8% and better detection rate than the
specification-based method, on average, 92.3% TPR. However,
as we expect in section IV-B, the FPR of anomaly-based and
specification-based methods was higher than signature-based
IDS, with 5% and 12.2% FPR, respectively. Although 21%
of researchers attempt to minimize the FPR and receive the Fig. 12. The proportion of each monitoring technique (A), detection
strategy (B) and response type (C).
optimum TPR by developing a hybrid IDS, this detection
strategy provides researchers with 88.4% TPR and 6.8% FPR
on average. The illustrated results in Fig. 11 and the proportion the mentioned datasets include either 6LoWPAN traffic or any
of detection strategies in Fig. 12, reveal the need for further RPL-based attacks. This is because they were not generated
investigation into hybrid detection strategies to boost the through IoT simulation or empirical experiments and mostly
performance of IDS in the 6LoWPAN. include application layer intrusions. The lack of an official,
reliable dataset compelled researchers in this field to evaluate
G. Datasets and Simulators Used by Researchers (Q 7) their proposed methods through simulation or empirical exper-
There are several well-known intrusion datasets developed iments. Table X introduces several simulators that exist in this
through simulations, Capture The Flag (CTF) competitions, field and are widely used by researchers for simulation and
or empirical lab experiments. These have been used by evaluation purposes. Some of these simulators are employed
researchers to train and test their proposed methods to detect more than others. 73% of the proposed researches in this
various types of attacks. Some very well known datasets are domain have used the Cooja simulator for simulation and
KDD 99, NSL-KDD, Defcon, and CDX. However, none of evaluation purposes. The authors of [114] compared different

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
PASIKHANI et al.: IDSs IN RPL-BASED 6LoWPAN: A SYSTEMATIC LITERATURE REVIEW 12963

TABLE X
T HE M OST P OPULAR N ETWORK S IMULATORS

simulators for RPL networks. However, some well-known

simulators such as Netsim, Opnet, NS-3, and Matlab did not
appear in their study; we include them here while adding more
detail to the information on existing simulators. The average
numbers of normal and malicious nodes in the testbeds are
49 and 4, respectively. Researchers model 8.2% of nodes as
malicious on average. The minimum, average, and maximum
experiment runtimes were 30, 2196, and 50000 seconds,
respectively.

H. Used Evaluation and Validation Methods (Q 8)

We investigated to what extent each validation method was
Fig. 13. The evaluation metrics and their usage.
used to evaluate the proposed mitigation technique in this
domain. Using a simulator for validation has the lion’s share
with 86%, while empirical validation makes up only 7%. by comparing the performance of the proposed method over
Providing more evaluation results can help the readers to normal and attack scenarios. Researchers provide the least evi-
understand the strength and weaknesses of the investigated dence for FNR while it is crucial for evaluating the capability
IDS. However, researchers mostly did not provide sufficient of IDS. Fig. 13 reveals to what extent each evaluation metric
evidence to justify the achievement of their aimed contribution was considered by researchers.

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
12964 IEEE SENSORS JOURNAL, VOL. 21, NO. 11, JUNE 1, 2021

TABLE XI
ML B ASED IDS FOR RPL

VIII. F UTURE R ESEARCH D IRECTIONS E. ML-Based Intrusions

Reviewing the proposed IDS approaches for RPL enables us ML has proven to be very powerful and effective in detect-
to identify gaps and research opportunities. We believe further ing intrusions but what if intruders decide to use ML to
study on the aforementioned and less-investigated research establish ML-based RPL intrusions? After discovering vulner-
questions can enhance RPL security and make it more resilient. abilities in the targeted LLN, intruders can adopt an ML-based
Below we summarize the remaining gaps and provide some malicious system (e.g., using a reinforcement learning algo-
suggestions to address them. Further study opportunities are rithm) to enter a game with the RPL network and discover
provided to answer Q9. the most effective intrusion for damaging nodes’ CIA. Since
intruders may use advanced ML algorithms to achieve their
A. Lack of a Comprehensive, Collaborative IDS goals, detecting such intrusions might be challenging. Thus,
Fig. 12.A and Table VI reveal that the majority of proposed ML may be used to synthesize effective and highly stealthy
methods employ active hybrid monitoring techniques. How- strategies for attack. This study has not found any IDS research
ever, the conducted researches consider only one DODAG capable of securing LLN against such sophisticated intrusions.
with a single border router in their scenarios. Secure 6LoW-
PAN against sophisticated intrusions (e.g. cooperative attacks) F. Evaluating the Detection of Unknown Attacks
requires the development of distributed collaborative IDS to The anomaly-based, specification-based, and hybrid IDSs
monitor several LLNs from a global perspective, with different are known for their capability in detecting unknown intrusions.
LLNs informing each other of newly discovered intrusions. Although 17%, 54%, and 21% of existing IDSs employ
such detection strategies respectively, we did not find any
B. Lack of Hybrid IDS in Terms of the System Design performance evaluation of these IDS over unknown attacks.
We did not find any combination of HIDS and NIDS to Here, an unknown intrusion is an attack that IDS is not trained
secure IoT against both application layer and network layer for.
attacks. IoT faces significant attacks from both levels and so
fusing the best aspect of HIDS and NIDS seems essential.
G. Study Dynamic Scenarios
C. Comprehensive in Detecting Attacks The proposed IDSs mostly consider a network scenario with
Existing studies in IDS are often limited to the detection of a fixed number of nodes in a static environment. However,
one or a very small number of RPL attacks. Our review did not an LLN is a lossy and unstable dynamic network. Nodes may
find any proposed IDS securing LLN against all known types continuously move in and out of the LLN. Hence, the number
of RPL attacks. There seems to be significant opportunity for of nodes increases and decreases over time. Therefore, it is
detectors that can operate effectively over the range of possible essential to consider such a dynamic, unstable and scalable
attacks (both known and unknown). network while developing IDS for RPL because such elements
have a direct effect in the detection of attacks such as DIS
D. Exploiting Machine Learning for Defence flooding, SH, SF etc.
Table XI shows the ML-based IDSs proposed to secure
networks against RPL-attacks. Some of the proposed H. Improve Validation Strategies
approaches [45] are scenario-based and may not perform well Validating a detection technique in order to design effective
in LLNs different to the training target. There is a significant security measures for IoT networks and, more specifically,
opportunity to further explore the rich defensive possibilities for RPL-based networks, requires realistic traces. The main
offered by ML. Crafting resource efficient intrusion detectors two approaches to generate traces are simulation and test-
seems an obvious and important target for the application beds. Several simulation tools available in this domain, some
of ML, e.g. use ML to synthesize RPL attack detectors that open-source and others with paid licenses, are compared
consume little power. in Table X. Modeling the real world IoT-RPL environment

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
PASIKHANI et al.: IDSs IN RPL-BASED 6LoWPAN: A SYSTEMATIC LITERATURE REVIEW 12965

requires a proper simulation tool. Having the right RPL [2] T. Park, N. Abuzainab, and W. Saad, “Learning how to
behavior will enable the researchers to simulate the aforemen- communicate in the Internet of Things: Finite resources and
heterogeneity,” 2016, arXiv:1610.01586. [Online]. Available:
tioned attacks and evaluate practical detection and mitigation https://arxiv.org/abs/1610.01586
techniques. [3] D. Midi, A. Rullo, A. Mudgerikar, and E. Bertino, “Kalis—A system
A physical testbed provides another validation means. How- for knowledge-driven adaptable intrusion detection for the Internet of
Things,” in Proc. IEEE 37th Int. Conf. Distrib. Comput. Syst. (ICDCS),
ever, researchers generally use a very small-scale collection Jun. 2017, pp. 656–666.
of devices, which in return cannot mimic the actual IoT [4] E. Fernandes, A. Rahmati, K. Eykholt, and A. Prakash, “Internet of
networks running RPL as the routing protocol. As indicated Things security research: A rehash of old ideas or new intellectual
challenges?” IEEE Secur. Privacy, vol. 15, no. 4, pp. 79–84, Aug. 2017.
in section VII.G, the average number of nodes of the testbeds
[5] B. B. Zarpelao, R. S. Miani, C. T. Kawakani, and S. C. de Alvarenga,
implemented by researchers was 49. A large-scale testbed of, “A survey of intrusion detection in Internet of Things,” J. Netw.
say, a smart city, that includes a large number of IoT devices Comput. Appl., vol. 84, pp. 25–37, Apr. 2017. [Online]. Available:
would be a major resource. https://www.sciencedirect.com/science/article/pii/S1084804517300802
[6] P. Pongle and G. Chavan, “A survey: Attacks on RPL and 6LoWPAN in
There is a pressing need for a comprehensive RPL network IoT,” in Proc. Int. Conf. Pervasive Comput. (ICPC), Jan. 2015, pp. 1–6.
dataset that is freely available for researchers. This would be [7] D. Airehrour, J. Gutierrez, and S. K. Ray, “Secure routing for Internet
a major research enabler, allowing meaningful evaluation of of Things: A survey,” J. Netw. Comput. Appl., vol. 66, pp. 198–213,
May 2016. [Online]. Available: https://www.sciencedirect.
any proposed RPL IDS techniques. com/science/article/pii/S1084804516300133
[8] A. Raoof, A. Matrawy, and C.-H. Lung, “Routing attacks and mit-
I. Real Time Notification igation methods for RPL-based Internet of Things,” IEEE Commun.
Surveys Tuts., vol. 21, no. 2, pp. 1582–1606, 2nd Quart., 2019.
Accurate and timely detection of malicious activities criti-
[9] L. Wallgren, S. Raza, and T. Voigt, “Routing attacks and countermea-
cally depends on the monitoring technique adopted. The ability sures in the RPL-based Internet of Things,” Int. J. Distrib. Sensor Netw.,
to detect breaches early is the most valuable aspect of any IDS. vol. 9, no. 8, Aug. 2013, Art. no. 794326, doi: 10.1155/2013/794326.
As stated in section V, there are several proposed methods [10] A. Mayzaud, R. Badonnel, I. Chrisment, and I. G. Est-Nancy, “A tax-
onomy of attacks in RPL-based Internet of Things,” Int. J. Netw. Secur.,
for deciding on where to place the monitoring nodes and the vol. 18, no. 3, pp. 459–473, 2016.
IDS agents for monitoring and detection purposes. However, [11] F. Hussain, R. Hussain, S. A. Hassan, and E. Hossain, “Machine
the large number of geographically spaced connected devices learning in IoT security: Current solutions and future challenges,”
IEEE Commun. Surveys Tuts., vol. 22, no. 3, pp. 1686–1721,
makes it hard to inspect packets in real-time. This negatively 3rd Quart., 2020.
impacts the alarm and response time. There is a need for more [12] A. Verma and V. Ranga, “Security of RPL based 6LoWPAN networks
research to provide the means for IDS to detect RPL attacks in the Internet of Things: A review,” IEEE Sensors J., vol. 20, no. 11,
pp. 5666–5690, Jun. 2020.
accurately while providing real-time notifications.
[13] H.-S. Kim, J. Ko, D. E. Culler, and J. Paek, “Challenging the IPv6
routing protocol for low-power and lossy networks (RPL): A sur-
J. Adopt a Lightweight Approach vey,” IEEE Commun. Surveys Tuts., vol. 19, no. 4, pp. 2502–2525,
Sep. 2017.
The LLN nodes are constrained by nature and barely
[14] A. Mosenia and N. K. Jha, “A comprehensive study of security of
function properly for their assigned tasks; they are constrained Internet-of-Things,” IEEE Trans. Emerg. Topics Comput., vol. 5, no. 4,
in processing, memory and power and may not be able to pp. 586–602, Dec. 2017.
hold tasks other than the ones assigned to them. Furthermore, [15] I. E. Korbi, M. B. Brahim, C. Adjih, and L. A. Saidane, “Mobility
enhanced RPL for wireless sensor networks,” in Proc. 3rd Int. Conf.
the network suffers from a wide range of different disruptive Netw. Future (NOF), Nov. 2012, pp. 1–8.
attacks, as mentioned in section III. Designing a complex [16] S. Raza, L. Wallgren, and T. Voigt, “SVELTE: Real-time intrusion
detection algorithm that can mitigate major RPL attacks is detection in the Internet of Things,” Ad Hoc Netw., vol. 11, no. 8,
pp. 2661–2674, 2013. [Online]. Available: https://www.sciencedirect.
more likely to exhaust LLN node computational and energy com/science/article/pii/S1570870513001005
resources. Therefore, future IoT-RPL intrusion detection solu- [17] A. Le, J. Loo, Y. Luo, and A. Lasebae, “Specification-based IDS for
tions must be powerful yet lightweight. securing RPL from topology attacks,” in Proc. IFIP Wireless Days
(WD), 2011, pp. 1–3.
IX. C ONCLUSION [18] T. Winter et al., RPL: IPv6 Routing Protocol for Low-Power and Lossy
Networks, document RFC 6550, 2012, pp. 1–157.
The features and capabilities of IoT devices allow them to [19] J. Vasseur, M. Kim, K. Pister, N. Dejean, and D. Barthel, Routing
be utilized and incorporated everywhere: in health care sectors, Metrics Used for Path Calculation in Low-Power and Lossy Networks,
smart cities, smart homes, and industrial environments. They document RFC 6551, IETF, 2012, pp. 1–30.
[20] J. Martocci, P. De Mil, N. Riou, and W. Vermeylen, Building
have become significant targets while their computational Automation Routing Requirements in Low-Power and Lossy Networks,
limitations make them vulnerable. The RPL protocol underpins document RFC 5867, Internet Engineering Task Force, 2010.
the network operation of many modern LLNs. This review has [21] A. Brandt, J. Buron, G. Porcu, and T. Italia, Home Automation Routing
Requirements in Low-Power and Lossy Networks, document RFC 5826,
explored attacks against this protocol and identified the state- 2010.
of-the-art in the use of IDSs to mitigate attacks on networks [22] M. Dohler, T. Watteyne, T. Winter, and D. Barthel, Routing Require-
that run this protocol. We have identified significant research ments for Urban Low-Power and Lossy Networks, document RFC 5548,
2009.
gaps and proposed possible future research directions.
[23] K. Pister, P. Thubert, C. Systems, S. Dwars, and T. Phinney,
Industrial Routing Requirements in Low-Power and Lossy Networks,
R EFERENCES document RFC 5673, 2009.
[1] L. Horwitz. The Future of IoT Miniguide: The Burgeoning IoT [24] A. Khosla and T. C. Aseri, “Comparative analysis of objective functions
Market Continues. Accessed: Mar. 20, 2021. [Online]. Avail- in routing protocol for low power and lossy networks,” Int. J. Future
able: https://www.cisco.com/c/en/us/solutions/internet-of-things/future- Revolution Comput. Sci. Commun. Eng., vol. 4, no. 3, pp. 556–562,
of-iot.html 2018.

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
12966 IEEE SENSORS JOURNAL, VOL. 21, NO. 11, JUNE 1, 2021

[25] J. V. V. Sobral, J. J. P. C. Rodrigues, R. A. L. Rabêlo, J. Al- [46] E. Kfoury, J. Saab, P. Younes, and R. Achkar, “A self organizing
Muhtadi, and V. Korotaev, “Routing protocols for low power and map intrusion detection system for RPL protocol attacks,” Int. J.
lossy networks in Internet of Things applications,” Sensors, vol. 19, Interdiscipl. Telecommun. Netw., vol. 11, no. 1, pp. 30–43, Jan. 2019.
no. 9, p. 2144, 2019. [Online]. Available: https://www.mdpi.com/1424- [47] S. Choudhary and N. Kesswani, “Detection and prevention of routing
8220/19/9/2144 attacks in Internet of Things,” in Proc. 17th IEEE Int. Conf. Trust,
[26] A. Musaddiq, Y. B. Zikria, Zulqarnain, and S. W. Kim, “Routing Secur. Privacy Comput. Commun./12th IEEE Int. Conf. Big Data Sci.
protocol for low-power and lossy networks for heterogeneous traffic Eng. (TrustCom/BigDataSE), Aug. 2018, pp. 1537–1540.
network,” EURASIP J. Wireless Commun. Netw., vol. 2020, no. 1, [48] A. Verma and V. Ranga, “ELNIDS: Ensemble learning based network
pp. 1–23, Dec. 2020. intrusion detection system for RPL based Internet of Things,” in
[27] N. Pradeska, Widyawan, W. Najib, and S. S. Kusumawardani, “Per- Proc. 4th Int. Conf. Internet Things, Smart Innov. Usages (IoT-SIU),
formance analysis of objective function MRHOF and OF0 in routing Apr. 2019, pp. 1–6.
protocol RPL IPv6 over low power wireless personal area networks [49] S. Choudhary and N. Kesswani, “Cluster-based intrusion detection
(6LoWPAN),” in Proc. 8th Int. Conf. Inf. Technol. Electr. Eng. (ICI- method for Internet of Things,” in Proc. IEEE/ACS 16th Int. Conf.
TEE), Oct. 2016, pp. 1–6. Comput. Syst. Appl. (AICCSA), Nov. 2019, pp. 1–8.
[28] X. Liu, Z. Sheng, C. Yin, F. Ali, and D. Roggen, “Performance analysis [50] A. Althubaity, H. Ji, T. Gong, M. Nixon, R. Ammar, and S. Han,
of routing protocol for low power and lossy networks (RPL) in large “ARM: A hybrid specification-based intrusion detection system for
scale networks,” IEEE Internet Things J., vol. 4, no. 6, pp. 2172–2185, rank attacks in 6TiSCH networks,” in Proc. 22nd IEEE Int. Conf.
Dec. 2017. Emerg. Technol. Factory Automat. (ETFA), Sep. 2017, pp. 1–8.
[29] A. Le, J. Loo, A. Lasebae, A. Vinel, Y. Chen, and M. Chai, “The impact
[51] J. Foley, N. Moradpoor, and H. Ochenyi, “Employing a machine
of rank attack on network topology of routing protocol for low-power
learning approach to detect combined Internet of Things attacks
and lossy networks,” IEEE Sensors J., vol. 13, no. 10, pp. 3685–3692,
against two objective functions using a novel dataset,” Secur. Commun.
Oct. 2013.
Netw., vol. 2020, pp. 1–17, Feb. 2020.
[30] A. Aris, S. F. Oktug, and S. B. O. Yalcin, “RPL version number
attacks: In-depth study,” in Proc. IEEE/IFIP Netw. Oper. Manage. [52] M. Sheikhan and H. Bostani, “A security mechanism for detecting
Symp. (NOMS), Apr. 2016, pp. 776–779. intrusions in Internet of Things using selected features based on MI-
[31] A. Mayzaud, A. Sehgal, R. Badonnel, I. Chrisment, and J. Schönwälder, BGSA,” Int. J. Inf. Commun. Technol. Res., vol. 9, no. 2, pp. 53–62,
“A study of RPL DODAG version attacks,” in Monitoring and Securing 2017.
Virtualized Networks and Services, A. Sperotto, G. Doyen, S. Latré, [53] S. M. H. Mirshahjafari and B. S. Ghahfarokhi, “Sinkhole+cloneid:
M. Charalambides, and B. Stiller, Eds. Berlin, Germany: Springer, A hybrid attack on RPL performance and detection method,” Inf.
2014, pp. 92–104. Secur. J., Global Perspective, vol. 28, nos. 4–5, pp. 107–119, 2019,
[32] P. Perazzo, C. Vallati, D. Varano, G. Anastasi, and G. Dini, “Imple- doi: 10.1080/19393555.2019.1658829.
mentation of a wormhole attack against a RPL network: Challenges [54] U. Shafique, A. Khan, A. Rehman, F. Bashir, and M. Alam, “Detection
and effects,” in Proc. 14th Annu. Conf. Wireless Demand Netw. Syst. of rank attack in routing protocol for low power and lossy networks,”
Services (WONS), Feb. 2018, pp. 95–102. Ann. Telecommun., vol. 73, nos. 7–8, pp. 429–438, Aug. 2018.
[33] N. Song, L. Qian, and X. Li, “Wormhole attacks detection in wireless [55] R. Stephen and L. Arockiam, “E2V: Techniques for detecting and
ad hoc networks: A statistical analysis approach,” in Proc. 19th IEEE mitigating rank inconsistency attack (RInA) in RPL based Internet of
Int. Parallel Distrib. Process. Symp., Apr. 2005, p. 8. Things,” J. Phys., Conf. Ser., vol. 1142, Nov. 2018, Art. no. 012009,
[34] P. Thubert et al., Objective Function Zero for the Routing Protocol for doi: 10.1088/1742-6596/1142/1/012009.
Low-Power and Lossy Networks (RPL), document RFC 6552, 2012. [56] L. Zhang, G. Feng, and S. Qin, “Intrusion detection system for RPL
[35] O. Gnawali and P. Levis, The Minimum Rank With Hysteresis Objective from routing choice intrusion,” in Proc. IEEE Int. Conf. Commun.
Function, document RFC 6719, 2012. Workshop (ICCW), Jun. 2015, pp. 2652–2658.
[36] O. Gnawali and P. Levis. (2010). The ETX Objective Function for RPL. [57] T. Matsunaga, K. Toyoda, and I. Sasase, “Low false alarm rate RPL
[Online]. Available: https://draft-gnawali-roll-etxof-01 network monitoring system by considering timing inconstancy between
[37] A. Brachman, “RPL objective function impact on LLNs topology the rank measurements,” in Proc. 11th Int. Symp. Wireless Commun.
and performance,” in Internet of Things, Smart Spaces, and Next Syst. (ISWCS), Aug. 2014, pp. 427–431.
Generation Networking, S. Balandin, S. Andreev, and Y. Koucheryavy, [58] D. Airehrour, J. Gutierrez, and S. K. Ray, “Securing RPL routing
Eds. Berlin, Germany: Springer, 2013, pp. 340–351. protocol from blackhole attacks using a trust-based mechanism,” in
[38] F. Medjek, D. Tandjaoui, M. R. Abdmeziem, and N. Djedjig, “Analyti- Proc. 26th Int. Telecommun. Netw. Appl. Conf. (ITNAC), Dec. 2016,
cal evaluation of the impacts of Sybil attacks against RPL under mobil- pp. 115–120.
ity,” in Proc. 12th Int. Symp. Program. Syst. (ISPS), Apr. 2015, pp. 1–9. [59] A. Sehgal, A. Mayzaud, R. Badonnel, I. Chrisment, and J. Schonwalder,
[39] K. Zhang, X. Liang, R. Lu, and X. Shen, “Sybil attacks and their “Addressing DODAG inconsistency attacks in RPL networks,” in Proc.
defenses in the Internet of Things,” IEEE Internet Things J., vol. 1, Global Inf. Infrastruct. Netw. Symp. (GIIS), Sep. 2014, pp. 1–8.
no. 5, pp. 372–383, Oct. 2014.
[60] D. Airehrour, J. Gutierrez, and S. K. Ray, “A trust-aware RPL
[40] S. Murali and A. Jamalipour, “A lightweight intrusion detection for
routing protocol to detect blackhole and selective forwarding
Sybil attack under mobile RPL in the Internet of Things,” IEEE
attacks,” J. Telecommun. Digit. Econ., vol. 5, no. 1, pp. 50–69, 2017.
Internet Things J., vol. 7, no. 1, pp. 379–388, Jan. 2020.
[Online]. Available: https://search.informit.org/doi/10.3316/informit.
[41] A. Le, J. Loo, K. K. Chai, and M. Aiash, “A specification-based IDS for
752286025338502
detecting attacks on RPL-based network topology,” Information, vol. 7,
no. 2, p. 25, 2016. [Online]. Available: https://www.mdpi.com/2078- [61] H. B. Patel and D. C. Jinwala, “Blackhole detection in 6LoWPAN
2489/7/2/25 based Internet of Things: An anomaly based approach,” in Proc. IEEE
[42] C. Cervantes, D. Poplade, M. Nogueira, and A. Santos, “Detection Region Conf. (TENCON), Oct. 2019, pp. 947–954.
of sinkhole attacks for supporting secure routing on 6LoWPAN for [62] A. Amouri, V. T. Alaparthy, and S. D. Morgera, “Cross layer-based
Internet of Things,” in Proc. IFIP/IEEE Int. Symp. Integr. Netw. intrusion detection based on network behavior for IoT,” in Proc. IEEE
Manage. (IM), May 2015, pp. 606–611. 19th Wireless Microw. Technol. Conf. (WAMICON), Apr. 2018, pp. 1–4.
[43] H. Bostani and M. Sheikhan, “Hybrid of anomaly-based and [63] E. G. Ribera, B. M. Alvarez, C. Samuel, P. P. Ioulianou, and
specification-based IDS for Internet of Things using unsupervised V. G. Vassilakis, “Heartbeat-based detection of blackhole and greyhole
OPF based on mapreduce approach,” Comput. Commun., vol. 98, attacks in RPL networks,” in Proc. 12th Int. Symp. Commun. Syst.,
pp. 52–71, Jan. 2017. [Online]. Available: https://www.sciencedirect. Netw. Digit. Signal Process. (CSNDSP), Jul. 2020, pp. 1–6.
com/science/article/pii/S0140366416306387 [64] S. Luangoudom, D. Tran, T. Nguyen, H. A. Tran, G. Nguyen, and
[44] M. Surendar and A. Umamakeswari, “InDReS: An intrusion detection Q. T. Ha, “svBLOCK: Mitigating black hole attack in low-power and
and response system for Internet of Things with 6LoWPAN,” in lossy networks,” Int. J. Sensor Netw., vol. 32, no. 2, pp. 77–86,
Proc. Int. Conf. Wireless Commun., Signal Process. Netw. (WiSPNET), 2020. [Online]. Available: https://www.inderscienceonline.com/
Mar. 2016, pp. 1903–1908. doi/abs/10.1504/IJSNET.2020.104923
[45] M. N. Napiah, M. Y. I. B. Idris, R. Ramli, and I. Ahmedy, “Compres- [65] F. Gara, L. B. Saad, and R. B. Ayed, “An intrusion detection system
sion header analyzer intrusion detection system (CHA–IDS) for 6LoW- for selective forwarding attack in IPv6-based mobile WSNs,” in
PAN communication protocol,” IEEE Access, vol. 6, pp. 16623–16638, Proc. 13th Int. Wireless Commun. Mobile Comput. Conf. (IWCMC),
2018. Jun. 2017, pp. 276–281.

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
PASIKHANI et al.: IDSs IN RPL-BASED 6LoWPAN: A SYSTEMATIC LITERATURE REVIEW 12967

[66] A. Nikam and D. Ambawade, “Opinion metric based intrusion [86] B. Ghaleb, A. Al-Dubai, E. Ekonomou, M. Qasem, I. Romdhani, and
detection mechanism for RPL protocol in IoT,” in Proc. 3rd Int. Conf. L. Mackenzie, “Addressing the DAO insider attack in RPL’s Internet
Converg. Technol. (ICT), Apr. 2018, pp. 1–6. of Things networks,” IEEE Commun. Lett., vol. 23, no. 1, pp. 68–71,
[67] C. Pu and S. Hajjar, “Mitigating forwarding misbehaviors in RPL- Jan. 2019.
based low power and lossy networks,” in Proc. 15th IEEE Annu. [87] C. Pu, “Mitigating DAO inconsistency attack in RPL-based low power
Consum. Commun. Netw. Conf. (CCNC), Jan. 2018, pp. 1–6. and lossy networks,” in Proc. IEEE 8th Annu. Comput. Commun.
[68] P. Pongle and G. Chavan, “Real time intrusion and wormhole attack Workshop Conf. (CCWC), Jan. 2018, pp. 570–574.
detection in Internet of Things,” Int. J. Comput. Appl., vol. 121, no. 9, [88] M. C. Belavagi and B. Muniyal, “Multiple intrusion detection in RPL
pp. 1–9, Jul. 2015. based networks,” Int. J. Electr. Comput. Eng., vol. 10, no. 1, p. 467,
[69] S. Deshmukh-Bhosale and S. S. Sonavane, “A real-time intrusion detec- Feb. 2020.
tion system for wormhole attack in the RPL based Internet of Things,” [89] A. Mayzaud, A. Sehgal, R. Badonnel, I. Chrisment, and J. Schonwalder,
Procedia Manuf., vol. 32, pp. 840–847, Jan. 2019. [Online]. Available: “Using the RPL protocol for supporting passive monitoring in the
https://www.sciencedirect.com/science/article/pii/S2351978919303282 Internet of Things,” in Proc. IEEE/IFIP Netw. Oper. Manage. Symp.
[70] P. Shukla, “ML-IDS: A machine learning approach to detect wormhole (NOMS), Apr. 2016, pp. 366–374.
attacks in Internet of Things,” in Proc. Intell. Syst. Conf. (IntelliSys), [90] A. Mayzaud, A. Sehgal, R. Badonnel, I. Chrisment, and
Sep. 2017, pp. 234–240. J. Schonwalder, “Mitigation of topological inconsistency attacks in
[71] D. B. Gothawal and S. Nagaraj, “Intrusion detection for enhancing RPL-based low-power lossy networks,” Int. J. Netw. Manage., vol. 25,
RPL security,” Procedia Comput. Sci., vol. 165, pp. 565–572, no. 5, pp. 320–339, 2015. [Online]. Available: https://onlinelibrary.
Jan. 2019. [Online]. Available: https://www.sciencedirect.com/ wiley.com/doi/abs/10.1002/nem.1898
science/article/pii/S1877050920300594 [91] C. Pu, “Sybil attack in RPL-based Internet of Things: Analysis and
[72] P. Kaliyar, W. B. Jaballah, M. Conti, and C. Lal, “LiDL: Localization defenses,” IEEE Internet Things J., vol. 7, no. 6, pp. 4937–4949,
with early detection of Sybil and wormhole attacks in IoT Jun. 2020.
networks,” Comput. Secur., vol. 94, Jul. 2020, Art. no. 101849. [92] D. Airehrour, J. A. Gutierrez, and S. K. Ray, “Sectrust-RPL: A
[Online]. Available: https://www.sciencedirect.com/science/article/pii/ secure trust-aware RPL routing protocol for Internet of Things,”
S016740482030122X Future Gener. Comput. Syst., vol. 93, pp. 860–876, Apr. 2019.
[73] A. Mayzaud, R. Badonnel, and I. Chrisment, “A distributed monitoring [Online]. Available: https://www.sciencedirect.com/science/article/pii/
strategy for detecting version number attacks in RPL-based networks,” S0167739X17306581
IEEE Trans. Netw. Service Manage., vol. 14, no. 2, pp. 472–486, [93] F. Medjek, D. Tandjaoui, I. Romdhani, and N. Djedjig, “A trust-based
Jun. 2017. intrusion detection system for mobile RPL based networks,” in Proc.
[74] P. Ioulianou, V. Vasilakis, I. Moscholios, and M. Logothetis, “A IEEE Int. Conf. Internet Things (iThings), IEEE Green Comput.
signature-based intrusion detection system for the Internet of Things,” Commun. (GreenCom), IEEE Cyber, Phys. Social Comput. (CPSCom),
in Proc. IEICE Inf. Commun. Technol. Forum. Graz, Austria: The Insti- IEEE Smart Data (SmartData), Jun. 2017, pp. 735–742.
tute of Electronics, Information and Communication Engineers, 2018. [94] A. Verma and V. Ranga, “CoSec-RPL: Detection of copycat attacks
in RPL based 6LoWPANs using outlier analysis,” Telecommun. Syst.,
[75] A. Arış, S. B. Ö. Yalçın, and S. F. Oktuğ, “New lightweight
vol. 75, no. 1, pp. 43–61, Sep. 2020.
mitigation techniques for RPL version number attacks,” Ad Hoc Netw.,
[95] A. Verma and V. Ranga, “Addressing flooding attacks in IPv6-
vol. 85, pp. 81–91, Mar. 2019. [Online]. Available: https://www.
based low power and lossy networks,” in Proc. IEEE Region Conf.
sciencedirect.com/science/article/pii/S1570870518307625
(TENCON), Oct. 2019, pp. 552–557.
[76] E. Aydogan, S. Yilmaz, S. Sen, I. Butun, S. Forsstrom, and M. Gidlund,
[96] P. Perazzo, C. Vallati, G. Anastasi, and G. Dini, “DIO suppression
“A central intrusion detection system for RPL-based industrial Internet
attack against routing in the Internet of Things,” IEEE Commun. Lett.,
of Things,” in Proc. 15th IEEE Int. Workshop Factory Commun. Syst.
vol. 21, no. 11, pp. 2524–2527, Nov. 2017.
(WFCS), May 2019, pp. 1–5.
[97] A. Saeed, A. Ahmadinia, A. Javed, and H. Larijani, “Intelligent
[77] J. Canedo and A. Skjellum, “Using machine learning to secure IoT intrusion detection in low-power IoTs,” ACM Trans. Internet Technol.,
systems,” in Proc. 14th Annu. Conf. Privacy, Secur. Trust (PST), vol. 16, no. 4, pp. 1–25, Dec. 2016, doi: 10.1145/2990499.
Dec. 2016, pp. 219–222. [98] T. Tsao, R. Alexander, M. Dohler, V. Daza, A. Lozano, and
[78] A. Verma and V. Ranga, “Mitigation of DIS flooding attacks in RPL- M. Richardson, A Security Threat Analysis for the Routing Protocol
based 6LoWPAN networks,” Trans. Emerg. Telecommun. Technol., for Low-Power and Lossy Networks (RPLs), document RFC 7416,
vol. 31, no. 2, p. e3802, 2020. [Online]. Available: https://onlinelibrary. Internet Engineering Task Force, 2015.
wiley.com/doi/abs/10.1002/ett.3802 [99] O. Lounis and B. Malika, “A new vision for intrusion detection
[79] B. Farzaneh, M. A. Montazeri, and S. Jamali, “An anomaly-based IDS system in information systems,” in Proc. Sci. Inf. Conf. (SAI),
for detecting attacks in RPL-based Internet of Things,” in Proc. 5th Jul. 2015, pp. 1352–1356.
Int. Conf. Web Res. (ICWR), Apr. 2019, pp. 61–66. [100] S. Sonavane, “Design and implementation of RSSI based intrusion
[80] P. P. Ioulianou and V. G. Vassilakis, “Denial-of-service attacks and detection system for RPL based IoT network,” Int. J. Comput. Sci.
countermeasures in the RPL-based Internet of Things,” in Computer Netw. Secur., vol. 19, no. 12, pp. 1–9, 2020.
Security, S. Katsikas et al., Eds. Cham, Switzerland: Springer, 2020, [101] T. Jones, A. Dali, M. R. Rao, N. Biradar, J. Madassery, and K. Liu,
pp. 374–390. “Towards a layered and secure Internet-of-Things testbed via hybrid
[81] P. Kasinathan, C. Pastrone, M. A. Spirito, and M. Vinkovits, “Denial- mesh,” in Proc. IEEE Int. Congr. Internet Things (ICIOT), Jul. 2018,
of-service detection in 6LoWPAN based Internet of Things,” in pp. 17–24.
Proc. IEEE 9th Int. Conf. Wireless Mobile Comput., Netw. Commun. [102] Z. A. Khan and P. Herrmann, “A trust based distributed intrusion
(WiMob), Oct. 2013, pp. 600–607. detection mechanism for Internet of Things,” in Proc. IEEE 31st Int.
[82] S. O. Amin, M. S. Siddiqui, C. S. Hong, and S. Lee, “RIDES: Robust Conf. Adv. Inf. Netw. Appl. (AINA), Mar. 2017, pp. 1169–1176.
intrusion detection system for IP-based ubiquitous sensor networks,” [103] E. Viegas, A. Santin, L. Oliveira, A. Franca, R. Jasinski, and
Sensors, vol. 9, no. 5, pp. 3447–3468, 2009. [Online]. Available: V. Pedroni, “A reliable and energy-efficient classifier combination
https://www.mdpi.com/1424-8220/9/5/3447 scheme for intrusion detection in embedded systems,” Comput. Secur.,
[83] P. Kasinathan, G. Costamagna, H. Khaleel, C. Pastrone, and vol. 78, pp. 16–32, Sep. 2018. [Online]. Available: https://www.
M. A. Spirito, “DEMO: An IDS framework for Internet of Things sciencedirect.com/science/article/pii/S0167404818306175
empowered by 6LoWPAN,” in Proc. ACM SIGSAC Conf. Comput. [104] H. Sedjelmaci, S. M. Senouci, and M. Al-Bahri, “A lightweight
Commun. Secur. (CCS), 2013, pp. 1337–1340, doi: 10.1145/2508859. anomaly detection technique for low-resource IoT devices: A game-
2512494. theoretic methodology,” in Proc. IEEE Int. Conf. Commun. (ICC),
[84] V. Pandu, J. Mohan, and T. P. Kumar, “Network intrusion detection May 2016, pp. 1–6.
and prevention systems for attacks in IoT systems,” in Countering [105] J. Li, Z. Zhao, R. Li, and H. Zhang, “AI-based two-stage intrusion
Cyber Attacks and Preserving the Integrity and Availability of Critical detection for software defined IoT networks,” IEEE Internet Things
Systems. Hershey, PA, USA: IGI Global, 2019, pp. 128–141. J., vol. 6, no. 2, pp. 2093–2102, Apr. 2019.
[85] B. Farzaneh, M. Koosha, E. Boochanpour, and E. Alizadeh, “A [106] J. Arshad, “COLIDE: A collaborative intrusion detection framework
new method for intrusion detection on RPL routing protocol using for Internet of Things,” IET Netw., vol. 8, pp. 3–14, Jan. 2019. [Online].
fuzzy logic,” in Proc. 6th Int. Conf. Web Res. (ICWR), Apr. 2020, Available: https://digital-library.theiet.org/content/journals/10.1049/iet-
pp. 245–250. net.2018.5036

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.
12968 IEEE SENSORS JOURNAL, VOL. 21, NO. 11, JUNE 1, 2021

[107] N. B. Mohammadi, J. Misic, V. B. Misic, and H. Khazaei, “A John A. Clark is a Professor of Computer
framework for intrusion detection system in advanced metering and Information Security with The University
infrastructure,” Secur. Commun. Netw., vol. 7, no. 1, pp. 195–205, of Sheffield, and also leads the Security of
2014. [Online]. Available: https://onlinelibrary.wiley.com/doi/abs/ Advanced Systems Research Group. Previously,
10.1002/sec.690 he was a Professor of Critical Systems with the
[108] D. B. Gothawal and S. V. Nagaraj, “Anomaly-based intrusion detection University of York. His major research interests
system in RPL by applying stochastic and evolutionary game models include cybersecurity and software engineering,
over IoT environment,” Wireless Pers. Commun., vol. 110, no. 3, most notably the use of artificial intelligence
pp. 1323–1344, Feb. 2020. to these areas. His publications have included
[109] D. Shreenivas, S. Raza, and T. Voigt, “Intrusion detection in the work on: threat modeling, security policies, covert
RPL-connected 6LoWPAN networks,” in Proc. 3rd ACM Int. channel analysis, cryptographic building blocks,
Workshop IoT Privacy, Trust, Secur. (IoTPTS). New York, NY, intrusion detection, insider detection, and automated synthesis of secu-
USA: Association for Computing Machinery, 2017, pp. 31–38, doi: rity protocols. His current research interests include automated discovery
10.1145/3055245.3055252. of classical cryptanalytic strategies, intrusion detection, and the search
[110] A. Rghioui, A. Khannous, and M. Bouhorma, “Monitoring behavior- for quantum approaches to cryptanalysis via evolutionary computation.
based intrusion detection system for 6LoWPAN networks,” Int. J. He is particularly interested right now in building up research in the
Innov. Appl. Stud., vol. 11, no. 4, p. 894, 2015. security of robotic and autonomous systems and in the security of
[111] A. Mitrokotsa and A. Karygiannis, “Intrusion detection techniques advanced manufacturing systems and active buildings.
in sensor networks,” Wireless Sensor Netw. Secur., vol. 1, no. 1,
pp. 251–272, 2008. Prosanta Gope (Senior Member, IEEE) served
[112] V. Verendel, “Quantified security is a weak hypothesis: A critical as a Research Fellow for the Department of Com-
survey of results and assumptions,” in Proc. New Secur. Paradigms puter Science, National University of Singapore
Workshop (NSPW). New York, NY, USA: Association for Computing (NUS). Primarily driven by tackling challenging
Machinery, 2009, pp. 37–50, doi: 10.1145/1719030.1719036. real-world security problems, he has expertise in
[113] J. Maerien, P. Agten, C. Huygens, and W. Joosen, “FAMoS: lightweight anonymous authentication, authen-
A flexible active monitoring service for wireless sensor networks,” in ticated encryption, access control, security of
Distributed Applications and Interoperable Systems, K. M. Göschka mobile communications, healthcare, the Internet
and S. Haridi, Eds. Berlin, Germany: Springer, 2012, pp. 104–117. of Things, Cloud, RFIDs, WSNs, smart-grids,
[114] L. B. Saad, C. Chauvenet, and B. Tourancheau, “Simulation of the and hardware security of the IoT devices. He is
RPL routing protocol for IPv6 sensor networks: Two cases studies,” in currently working as an Assistant Professor with
Proc. Int. Conf. Sensor Technol. Appl. (SENSORCOMM). Nice, France: the Department of Computer Science, The University of Sheffield, U.K.
IARIA, Sep. 2011, pp. 1–7. [Online]. Available: https://hal.inria.fr/hal- He has authored more than 75 peer-reviewed articles in several rep-
00647869 utable international journals and conferences, and has four filed patents.
He received the Distinguished Ph.D. Scholar Award in 2014 from the
National Cheng Kung University, Taiwan. He has served as a TPC Mem-
ber/Chair for several international conferences, such as IEEE GLOBE-
COM, ARES, and IEEE-Trustcom. He also serves as an Associate Editor
for the IEEE INTERNET OF THINGS JOURNAL, IEEE SYSTEMS JOURNAL,
IEEE SENSORS JOURNAL, and the Security and Communication Networks
Journal.

Abdulmonem Alshahrani received the M.Sc.

(Hons.) degree in information systems from
Aryan Mohammadi Pasikhani received the DePaul University, Chicago, IL, USA. He is cur-
M.Sc. degree in software engineering from the rently pursuing the Ph.D. degree in cybersecurity
National University of Malaysia. He is currently with the Department of Computer Science, The
pursuing the Ph.D. degree in computer Science University of Sheffield. He is also a Lecturer with
from The University of Sheffield. His research the College of Computer Science, King Khalid
interests include intrusion detection and preven- University, Saudi Arabia. His research interests
tion systems, reinforcement learning, machine include applying machine learning (ML) and arti-
learning, optimization, securing embedded sys- ficial intelligence (AI) solutions to optimize intru-
tems, and the Internet of Things. sion detection systems (IDS) for sophisticated
networks of embedded, connected, and low-resourced devices, such as
the Internet of Things (IoT).

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 23,2021 at 12:58:49 UTC from IEEE Xplore. Restrictions apply.