2018 5th IEEE International Conference on Cyber Security and Cloud Computing (CSCloud)/2018 4th IEEE

International Conference on Edge Computing and Scalable Cloud (EdgeCom)

Hatchetman Attack: A Denial of Service Attack

Against Routing in Low Power and Lossy Networks
Cong Pu Tianyi Song
Weisberg Division of Computer Science
Marshall University
Huntington, WV 25755, USA
{puc, songt}@marshall.edu

Abstract—Low power and lossy networks (LLNs) are rapidly as the communication standard for IP smart object networks.
burgeoning as an important part of ubiquitous communication in- With the prevalence of cloud computing and social networking
frastructure, and serving as a major building block for emerging paradigms as well as the recent progress in communication
Internet-of-Things (IoT) applications. A novel routing protocol
for low power and lossy networks, referred to as RPL, has been technologies, embedded devices, and sensor networks, we
standardized to provide efficient and reliable communication envision that wirelessly connected IP smart nodes under IoT
in LLNs, and enable the integration of resources-constrained will enhance information accessibility and availability as well
devices into the Internet. However, due to the lack of resources, as improve our lives further.
physical protection, and security requirements of inherent routing However, due to the shared medium and the lack of
protocol, RPL-based LLNs are admittedly vulnerable to Denial-
of-Service (DoS) attacks that primarily disrupt network protocols resource, physical protection and security requirements of
and interfere with on-going communications. In this paper, we inherent network protocols, LLNs are undoubtedly vulnerable
investigate a new type of DoS attack, called hatchetman attack, to Denial-of-Service (DoS) attacks [5]. For example, a legiti-
in promptly emerging RPL-based LLNs. In hatchetman attack, mate node compromised by an adversary can easily overhear,
the malicious node manipulates the source route header of the duplicate, corrupt, alter, or drop an on-flying packet. Although
received packets, and then generates and sends a large number of
invalid packets with error route to legitimate nodes, which cause the RPL standard includes the optional security mechanisms to
the legitimate nodes to drop the received packets and reply an ensure the confidentiality and integrity of control messages as
excessive number of Error messages back to the DODAG root. well as the availability of routing information, however, current
As a result, a great number of packets are dropped by legitimate RPL implementations choose not to enable these secure opera-
nodes and excessive Error messages exhaust the communication tion modes due to resource consumption, which greatly affects
bandwidth and node energy, which lead to a denial of service in
RPL-based LLNs. We conduct extensive simulation experiments the performance of resource-constrained devices [6], [7]. In
for performance evaluation of hatchetman attack and comparison addition, threat analysis for securing RPL presented in [8]
with jamming attack and original RPL without adversary. The only identify the well-known security issues with fundamental
simulation results indicate that the hatchetman attack is an countermeasures, thus, this leaves RPL open to new attack
extremely severe attack in RPL-based LLNs. wherein a malicious node can manipulate the content of packet
Index Terms—Hatchetman attack, denial-of-service (DoS) at-
tack, RPL, low power and lossy networks. header to disrupt routing protocol or interfere with on-going
communications.
I. I NTRODUCTION In this paper, we present a new type of denial-of-service
A rapidly growing number of physical objects being con- attack, called hatchetman attack, in RPL-based LLNs. In
nected to the Internet are realizing the idea of Internet-of- hatchetman attack, a malicious node manipulates the source
Things (IoT) and its applications, where a myriad of multi- route header of the received packet, and then generates and
scale sensors and devices (later nodes) are seamlessly blended sends the invalid packets with error route to legitimate nodes.
and communicate with each other [1]. It is predicted that When the legitimate node receives the invalid packets with
20.4 billion wirelessly connected devices will be available error route, the packets will be dropped since the receiving
for IoT applications by 2020, nearly triple the number that node cannot forward the packets with the piggybacked error
exists today [2]. As a part of speedily emerging IoT, low route. The receiving node also will reply an Error message
power and lossy networks (LLNs) are playing a remarkable back to the DODAG root to report the error in source route
role in building a ubiquitous computing and communication header. If the malicious node generates and sends a large
infrastructure, where a set of resources-constrained nodes with number of invalid packets with error route to legitimate nodes,
the limited processing power, energy capacity, and memory this will cause the legitimate nodes to drop the received pack-
communicates directly or indirectly via lossy links. With the ets and reply an excessive number of Error messages, which
increasing demand of connecting resources-constrained nodes eventually lead to a denial of service in RPL-based LLNs. Our
to the Internet, the Internet Engineering Task Force (IETF) major contribution is briefly summarized in twofold.
Working Group [3] has proposed a novel routing protocol • We identify and present a new and severe denial-of-
for low power and lossy networks, referred to as RPL [4], service attack, called hatchetman attack, in RPL-based

978-1-5386-5850-5/18/$31.00 ©2018 IEEE 12

DOI 10.1109/CSCloud/EdgeCom.2018.00012
 LLNs. This is the first in-depth work to investigate the in neighborhood area network. In [19], a rank attack that aims
performance impact of hatchetman attack in RPL-based at the rank property in RPL and its impact on the perfor-
LLNs. mance are investigated in wireless sensor networks, where
• We revisit and implement the well-known jamming attack the adversary can compromise the rank rule to downgrade
and the original RPL without adversary for performance the RPL performance. Four adversarial scenarios motivated by
comparison. The original RPL without adversary is used violating rank rule permanently and non-permanently and their
as the upper and lower bound of packet delivery ratio and potential performance impact are analyzed. In the VeRA [20],
packet delivery latency, respectively. a version number and rank authentication security scheme
We develop a customized discrete event-driven simulation based on one-way hash chains are proposed to secure the RPL
framework by using OMNeT++ [9] and evaluate its perfor- in LLN, where the misbehaving nodes illegitimately increase
mance impact through extensive simulation experiments in the version number of DIO message and compromise illegal
terms of packet delivery ratio, throughput, packet delivery rank values. In order to protect against the attackers that send
latency, energy consumption, the number of attack packets, DIO messages with higher version number values or that
and attack energy inefficiency. The simulation results indicate publish a high rank value, the version numbers are binded with
that the hatchetman attack is an extremely severe attack in authentication data and signatures. A security threat analysis of
RPL-based LLNs. RPL has been performed in [8], where potential security issues
The rest of the paper is organized as follows. An overview and fundamental countermeasures are presented. [21] analyzes
of relevant work is provided in Section II. The basic RPL the security capability of the IEEE 802.15.4 MAC protocol as
operations and its potential vulnerabilities are summarized well as the limitations thereof in the context of Internet-of-
and analyzed in Section III. The hatchetman attack and its Things. A more detailed survey of denial-of-service attacks on
performance impact evaluation with extensive simulation ex- IoT can be found in [22], [23]. In [5], the history of research
periments are presented in Sections IV and V, respectively. efforts in RPL and future research directions on which RPL
In Section VI, we analyze the hatchetman attack in terms of should evolve have been reviewed and discussed, respectively.
four criteria. Finally, concluding remarks and future research
III. T HE RPL ROUTING P ROTOCOL
direction are provided in Section VII.
RPL [4] is a novel distance vector and source routing
II. R ELATED W ORK protocol designed for low power and lossy networks operating
While the study of RPL security is relatively new, many on IEEE 802.15.4 PHY and MAC layers. The basic idea
researchers have investigated security issues in similar environ- of RPL is to construct one or more Destination-Oriented
ments. Potential forwarding misbehaviors and its correspond- Directed Acyclic Graphs (DODAGs) to maintain the network
ing countermeasures in energy harvesting motivated networks state information, where DODAGs are differentiated by RPL
are discussed in [10], [11]. In [12], an explore-based active Instance ID, DODAG ID, and DODAG Version Number.
detection scheme (EBAD) running with DSR is proposed to Each DODAG is associated with a set of nodes and one
detect routing attack in MANETs. In the SCAD [13], a light- DODAG root (i.e., base station or gateway node), where nodes
weight countermeasure to selective forwarding attack is pro- can generate and forward data traffic and DODAG root is
posed by deploying a single checkpoint node integrated with responsible for collecting the data measured by other nodes,
timeout and hop-by-hop retransmission techniques. An optimal controlling these nodes, and bridging the DODAG with IPv6
monitoring node selection algorithm is proposed to protect the networks.
network against denial-of-service attacks in wireless sensor RPL relies on four types of control messages to establish
networks in [14]. and manage the network topology and routing information:
In the last few years, a significant amount of research efforts DAG Information Object (DIO), DAG Information Solicitation
have been focusing on security in RPL-based LLNs. The (DIS), Destination Advertisement Object (DAO), and Des-
SVELTE [15] proposes a novel intrusion detection system to tination Advertisement Object Ack (DAO-Ack). In order to
secure Low-Power Wireless Personal Area Network (6LoW- construct a DODAG and build upward routes directed from
PAN) running with RPL from network layer and routing other nodes to the DODAG root, the DODAG root will issue
attacks. The CMD [16] proposes a monitor-based approach to a DIO control message, which includes the DODAG root’s
mitigate the forwarding misbehaviors in LLNs running with ID, the rank of the DODAG root, and an Objective Function
RPL, where each node monitors the forwarding behaviors of which describes the routing metrics and constraints. Any node
the preferred parent node to observe the packet loss rate, that receives the DIO message and is willing to join the
compares the observation result with the collected packet loss DODAG should add the DIO message sender to its parent list,
rate from one-hop neighbor nodes, and detects the forwarding computes its own rank according to the piggybacked Objective
misbehaviors of the preferred parent node. In [17], a dynamic Function, and passes on the DIO message with the updated
threshold mechanism is proposed to mitigate destination ad- rank information. Here, the rank is used to imply the node’s
vertisement object (DAO) inconsistency attack in RPL-based position relative to other nodes with respect to a DODAG
LLNs. [18] designs and implements an intrusion detection root, and the rank of nodes along any upward route to the
system that can be modified to employ RPL routing protocol DODAG root should be monotonically decreasing to avoid

13
 ϭ ϭ ϭ ϭ Error
Error
EĞdžƚ,ĞĂĚĞƌ ,Ěƌ džƚ>ĞŶ ZŽƵƚŝŶŐdLJƉĞ ^ĞŐŵƚ >ĞĨƚ Error
ŵƉƌ/ ŵƉƌ WĂĚ ZĞƐĞƌǀĞĚ Error
pkt[r,a,m,b,c,d,e]
 
 ĚĚƌĞƐƐĞƐ΀ϭ͘͘Ŷ΁  ne nd nc nb nm na nr

pkt[r,a,m,b,f]
Fig. 1. The format of RPL source route header, where the route information pkt[r,a,m,b,c,f]
is piggybacked in Address[1..n] field. Here, the length is shown in byte. pkt[r,a,m,b,c,d,f]

any routing loop. The node that has the lowest rank among all pkt[r,a,m,b,c,d,e,f]

the nodes in the parent list is selected as the preferred parent Fig. 2. A snapshot of the network, where a malicious node nm sends
the manipulated packets piggybacked with invalid source route to legitimate
node. After the DODAG is constructed, each node will be able nodes. Here, f is the fictitious node address that does not exist in the network.
to forward sensory data to the DODAG root by choosing its
of hatchetman attack is that the malicious node manipulates the
most preferred parent node as the next-hop forwarding node.
source route header of the received packets, and then generates
If a new node wants to join the existing network, it can and sends a large number of invalid packets with error route
request topology information from the neighbor nodes in the to legitimate nodes, which cause the legitimate nodes to drop
adjacent DODAGs by broadcasting a DIS control message. the received packets and reply an excessive number of Error
To build downward routes from the DODAG root to other messages back to the DODAG root. As a result, a great number
nodes, the node needs to issue a DAO control message to of packets are dropped by legitimate nodes and excessive
propagate reverse route information and record the nodes vis- Error messages exhaust the communication bandwidth and
ited along the upward routes. After passing the DAO message node energy, which lead to a denial of service in RPL-based
to the DODAG root, a complete downward route between the LLNs. In this paper, we assume that an adversary is able
DODAG root and the node is established. Finally, the DODAG to capture and compromise legitimate node, gain access to
root replies a DAO-Ack message as a unicast packet to the all stored information including public and private keys, and
source of DAO message as a response. reprogram it to behave maliciously [24].
Unlike prior source routing protocols (i.e., DSR), where First, when the DODAG root generates a packet to send,
each intermediate node can quickly learn the routes of other it first searches its downward routing table for the route to
nodes by aggressively overhearing on-flying packets and the destination node, and then piggybacks the cached source
caching the piggybacked route information in its routing table, route into the packet. Any legitimate node that receives the
RPL heavily relies on source routing mechanism to forward packet will forward it to the next-hop node according to
packet and maintain reachability to destinations within the the piggybacked source route. However, when a malicious
LLNs. In particular, nodes do not store any information about node receives the packet, it may manipulate the source route
downward routes to other nodes and only the DODAG root header of the received packet by replacing the post-hops of a
possesses such information. If the DODAG root generates legitimate node with a fictitious destination, and then generates
a packet to send, it first searches its routing table for the and sends the invalid packet with error route to the legitimate
downward route to the destination node and sends the packet node. When the invalid packet reaches the legitimate node that
with the cached source route. If a node has a packet to other is one-hop prior to the fictitious destination, the receiving node
node, the packet must be first sent through the upward route has to drop the packet and reply an Error message back to the
to the DODAG root, which will forward the packet to its source node of the packet, which is the DODAG root. This is
destination node through downward route. If the intermediate because the receiving node cannot forward the packet further
node fails to forward the packet with the piggybacked source to the next-hop node, which is the fictitious destination, based
route, the packet should be dropped. And then the intermediate on the piggybacked source route.
node replies an Error message back to the DODAG root. RPL For example, suppose the DODAG root nr sends a packet
implements a strict source routing policy where each and every with the cached source route ([r, a, m, b, c, d, e]) to destination
hop between the source and destination of the source route is node ne as shown in Fig. 2. When the malicious node nm
specified within the source route header of the packet. Here, receives the packet, pkt[r, a, m, b, c, d, e], it manipulates
the format of RPL source route header is shown in Fig. 1. the source route header by replacing all the post-hops (i.e.,
However, the source routing mechanism can be exploited by [c, d, e]) of the legitimate node (i.e., nb ) with a fictitious
an adversary to attack the network as well. For example, a destination (i.e., nf ), and then sends the invalid packet with
malicious node along the forwarding path can manipulate the error route ([r,a,m,b,f ]) to the next-hop node, nb . Here, f is
source route header of the received packet to disrupt network the fictitious node address that does not exist in the network.
protocols and interfere with on-going communications. When nb receives the packet, pkt[r,a,m,b,f ], it drops the
received packet and replies an Error message back to the
IV. H ATCHETMAN ATTACK
DODAG root. This is because nb cannot forward the packet
In this section, we present our newly discovered attack, to destination node nf specified in the source route.
called hatchetman attack, in RPL-based LLNs. The basic idea Second, if the malicious node generates multiple invalid

14
 100
Notations:
• pkt[seq, sr, type]: A packet with a sequence number, seq, piggybacked 90

Packet Delivery Ratio (%)

source route, sr, and packet type, type. Here, type is Data or Error.
• Satk : The set of intermediate nodes after the malicious node 80 RPL, r cer = 0%
RPL, r cer = 10%
along the source route. E.g., Satk is [b,c,d,e] based on the packet 70 Jamming Attack, r jf = 0.1 pkt/sec
pkt[seq, [r, a, m, b, c, d, e], Data]. Here, ne and nm is the destination node Jamming Attack, r jf = 2.0 pkt/sec
and malicious node, respectively. 60
Hatchetman Attack, r ap = 10%
• nf and f rc: A fictitious node that does not exist in the network and an 50 Hatchetman Attack, r ap = 20%
invalid source route, respectively.
• DRTr [i]: A cached source route to node ni in the downward routing table 40
of DODAG root nr .
 When the DODAG root nr has a data packet to node ne : 30
500 1000 1500 2000 2500 3000 3500 4000 4500 5000
Send out pkt[seq, DRTr [e], Data]; Elapsed Simulation Time (sec)
 When the malicious node nm receives pkt[seq, DRTr [e], Data]:
Fig. 4. The performance of PDR against elapsed simulation time.
Extract Satk from DRTr [e];
for ni ∈ Satk
Replace the post-hop node(s) of ni in DRTr [e] with nf ; rcer = 0% achieves the highest PDR, this is because every node
Send pkt[seq, f rc, Data] to ni ; cooperatively and faithfully forwards the received packets
to the destination node under the ideal channel condition.
Fig. 3. The pseudo code of hatchetman attack. However, the RPL without adversary is very sensitive to bad
packets with error route, and sends them to each post-hop node channel condition and the PDR is fluctuating around 76% with
of itself along the forwarding path, all the receiving nodes will rcer = 10% because the packets could get lost due to bad
drop the received packet and reply an Error message back to channel quality. Under jamming attack, the PDR decreases
the DODAG root. For example in Fig. 2, the malicious node to 69% and 61% with different jamming frequency, rjf =
nm can generate and send multiple invalid packets with error 0.1 pkt/sec and 2.0 pkt/sec, respectively. Since the packets
route to each post-hop node, nb , nc , nd , and ne , respectively. have more chances to be collided with the jamming packets
And all the receiving nodes will drop the received packet which are frequently generated by the malicious nodes, the
and reply an Error message back to the DODAG root, which lower PDR is achieved than that of original RPL without
cause each intermediate node along the forwarding path to adversary. The hatchetman attack with different rap = 10% and
receive and forward a large number of Error messages. As 20% shows the lowest PDR than that of jamming attack and
a result, excessive Error messages can significantly exhaust original RPL without adversary. This is because the malicious
communication bandwidth and node energy, and finally result nodes can frequently manipulate the source route header of
in a denial of service in RPL-based LLNs. The major operation the received packets, and send the invalid packets to multiple
of hatchetman attack is summarized in Fig. 3. legitimate nodes, which cause the legitimate nodes to drop the
V. E VALUATION packets. With more number of malicious nodes rap = 20%,
the hatchetman attack causes the PDR to drop below 45%.
We conduct extensive simulation experiments using the This is because more number of malicious nodes can generate
OMNeT++ [9] to evaluate the performance impact of hatch- more invalid packets and send them to legitimate nodes, more
etman attack in RPL-based LLNs. 50 nodes are uniformly packets will be dropped.
distributed in a 150×150 m2 square network area, where a Second, we measure the throughput of an intermediate node
single DODAG root is deployed. The communication range along the forwarding path by changing rcer , rjf , and rap
of each node is 30 (m). The radio model simulates CC2420 in Fig. 5. The jamming attack shows the lowest throughput
with a normal data rate of 250 Kbps, and 802.15.4 MAC/PHY with different rjf than that of hatchetman attack and RPL
operates with a default configuration in the 2.4 GHz band [25]. without adversary. This is because a large number of packets
To emulate low data rate scenario, packet injection rate is set to collide with the jamming packets, less number of packets
0.1 pkt/sec. A set of malicious nodes are randomly located in are received and forwarded by intermediate node, the lowest
the network. And the total simulation time is 5000 seconds, throughput is achieved. Since more jamming packets are
and each simulation scenario is repeated 5 times to obtain generated with larger jamming frequency rjf = 2.0 pkt/sec,
steady state performance metrics. In this paper, we measure more packets could collide with jamming packets, lower
the performance in terms of packet delivery ratio, throughput, throughput is achieved. RPL without adversary shows higher
packet delivery latency, energy consumption, the number of throughput than that of jamming attack. This is because more
attack packets, and attack energy inefficiency by changing packets are received and forwarded by intermediate nodes,
key simulation parameters, including channel error rate (rcer ), higher throughput is achieved. However, since more number
jamming frequency (rjf ), and the percentage of attackers of packets could get lost due to bad channel quality, RPL with
(rap ). We compare the performance impact of hatchetman rcer = 10% shows lower throughput than that of RPL with rcer
attack with the well-known jamming attack and original RPL = 0%. The hatchetman attack with different rap achieves the
without adversary. highest throughput, this is because a large number of Error
First, the packet delivery ratio (PDR) is measured by messages are generated and forwarded by intermediate nodes
changing channel error rate (rcer ), jamming frequency (rjf ), along the forwarding path, the throughput are significantly
and the percentage of attackers (rap ) in Fig. 4. The RPL with increased. The hatchetman attack with rap = 20% achieves

15
 40 1600 0.4
RPL, r cer = 0% RPL, r cer = 0%
1400 RPL, r cer = 10% 0.35 RPL, r cer = 10%

Packet Delivery Latency (sec)

Energy Consumption (Joule )

35
Jamming Attack, r jf = 0.1 pkt/sec Jamming Attack, r jf = 0.1 pkt/sec
1200 0.3
Throughput (byte/sec)

Jamming Attack, r jf = 2.0 pkt/sec Jamming Attack, r jf = 2.0 pkt/sec

30 RPL, r cer = 0% Hatchetman Attack, r ap = 10% Hatchetman Attack, r ap = 10%
1000 0.25
RPL, r cer = 10% Hatchetman Attack, r ap = 20% Hatchetman Attack, r ap = 20%
25 800 0.2
Jamming Attack, r jf = 0.1 pkt/sec
Jamming Attack, r jf = 2.0 pkt/sec 600 0.15
20
Hatchetman Attack, r ap = 10%
400 0.1
Hatchetman Attack, r ap = 20%
15
200 0.05

10 0 0
500 1000 1500 2000 2500 3000 3500 4000 4500 5000 500 1000 1500 2000 2500 3000 3500 4000 4500 5000
Elapsed Simulation Time (sec) Elapsed Simulation Time (sec)
5
500 1000 1500 2000 2500 3000 3500 4000 4500 5000
(a) Packet Delivery Latency (b) Energy Consumption
Elapsed Simulation Time (sec) Fig. 6. The performance of packet delivery latency and energy consumption
Fig. 5. The performance of throughput against elapsed simulation time. against elapsed simulation time.
104
the higher throughput than that of hatchetman attack with rap 3.5 0.05

Number of Generated Attack Packets

Attack Energy Inefficiency (Joule/pkt)

Hatchetman Attack, r ap = 10% 0.045
= 10%. This is because more invalid packets with error route 3
Hatchetman Attack, r ap = 20% 0.04

can be generated and sent to legitimate nodes, and more Error 2.5 Jamming Attack, r jf = 0.1 pkt/sec
Jamming Attack, r jf = 2.0 pkt/sec
0.035

0.03
messages will be generated and replied back to the DODAG 2
0.025
root. 1.5
0.02 Jamming Attack, r jf = 0.1 pkt/sec

Third, the packet delivery latency is measured by changing 1 0.015 Jamming Attack, r jf = 2.0 pkt/sec
Hatchetman Attack, r ap = 10%
0.01
rcer , rjf , and rap in Subfig. 6(a). In this experiment, if 0.5
0.005
Hatchetman Attack, r ap = 20%

the packet is lost due to bad channel quality or forwarding 0

1000 1500 2000 2500 3000 3500 4000 4500 5000
0
500 1000 1500 2000 2500 3000 3500 4000 4500 5000

misbehavior, the packet delivery latency is calculated by using (a) Number of Generated Attack Packets
Elapsed Simulation Time (sec) Elapsed Simulation Time (sec)
(b) Attack Energy Inefficiency
the currently elapsed simulation time. The RPL with rcer = Fig. 7. The performance of the number of generated attack packets and attack
0% achieves the lowest packet delivery latency (around 0.35 energy inefficiency against elapsed simulation time.
sec in average), this is because all the intermediate nodes
Fifth, we measure the number of generated attack packets,
cooperatively forward the received packets and most of the
which are invalid packet with error route and jamming packet
packets can reach the destination node quickly. However, the
in hatchetman attack and jamming attack, respectively, by
packet delivery latency of RPL with rcer = 10% significantly
changing rcer , rjf , and rap in Subfig. 7(a). The hatchetman
increases as the simulation time elapses, compared to that of
attack generates an invalid packet with error route whenever
RPL with rcer = 0%. This is because some packets could get
the malicious node receives a packet to other node. Since the
lost due to bad channel condition, longer latency is achieved.
low data rate (0.1 pkt/sec) is adopted in the experiments, the
Under jamming attack, since more packets will collide with
less number of attack packets will be generated by hatchetman
frequently generated jamming packets, the lost packets will
attack. However, the jamming attack frequently generates the
experience a longer delivery time, longer latency is achieved
jamming packets to cause the packet collision, thus, excessive
than that of original RPL. The hatchetman attack with rap
number of attack packets are observed.
= 20% achieves the largest packet delivery latency, this is
Finally, the attack energy inefficiency is measured by chang-
because the malicious nodes can generate more number of
ing rjf and rap in Subfig. 7(b). Here, the attack energy
invalid packets with error route to cause the legitimate nodes
inefficiency is calculated as the total energy consumption of
to drop the packets, more packets will experience a longer
sending the attack packets divided by the total number of
delivery latency.
generated attack packets observed in Subfig. 7(a). And the
Fourth, we measure the energy consumption of intermediate
attack energy inefficiency indicates how energy-efficiently the
node along the forwarding path in terms of the number of
malicious nodes can attack the network. The hatchetman attack
received and forwarded packets [26] in Subfig. 6(b). The
shows the lowest attack energy inefficiency, this is because the
hatchetman attack with different rap can achieve the higher
less number of attack packets are generated by the malicious
energy consumption than that of original RPL without ad-
nodes. However, the jamming attack achieves much higher
versary and jamming attack. This is because the malicious
attack energy inefficiency than that of hatchetman attack. This
nodes can generate and send a large number of invalid
is because more number of jamming packets are generated
packets with error route to multiple legitimate nodes, which
and more energy are consumed by the malicious nodes. This
cause the legitimate nodes to reply an excessive amount of
simulation result also indicates that the hatchetman attack can
Error messages back to the DODAG root. As a result, each
severely attack the network with less energy consumption.
intermediate node along the forwarding path has to receive
and forward a high volume of Error messages, thus, the higher VI. D ISCUSSION
energy consumption is achieved. The jamming attack achieves
the lowest energy consumption because the packets could be In this section, we analyze the hatchetman attack in terms
collided with the jamming packets, the number of received and of attack method, stealthiness, attack energy inefficiency, and
forwarded packets is significantly reduced. The RPL without level of denial of service. The basic idea of hatchetman attack
adversary shows higher and lower energy consumption than is that the malicious node manipulates the source route header
that of jamming attack and hatchetman attack, respectively. of the received packet to generate the invalid packets with

16
error route, and then selects the legitimate nodes as target R EFERENCES
nodes and sends the invalid packets to these target nodes. [1] A. Al-Fuqaha, M. Guizani, M. Mohammadi, M. Aledhari, and
According to the RPL standard, the legitimate nodes will drop M. Ayyash, “Internet of Things: A Survey on Enabling Technologies,
the received invalid packets and reply an excessive number of Protocols, and Applications,” IEEE Commun. Surveys Tuts., vol. 17,
no. 4, pp. 2347–2376, 2015.
Error messages back to the source of the packet, which is the [2] Gartner Research, 8.4 Billion Connected ”Things” Will Be in Use in
DODAG root. Based on the above described attack method, 2017, Up 31 Percent From 2016, February 2017.
the hatchetman attack has high stealthiness and more difficult [3] The Internet Engineering Task Force (IETF), https://www.ietf.org.
[4] T. Winter and P. Thubert, “RPL: IPv6 Routing Protocol for Low-Power
to detect. This is because the malicious node acts like a normal and Lossy Networks,” RFC Standard 6550, March 2012.
node, but sends the invalid packets to legitimate nodes to [5] H. Kim, J. Ko, D. Culler, and J. Paek, “Challenging the IPv6 Routing
make them attack network, for example dropping the received Protocol for Low-Power and Lossy Networks (RPL): A Survey,” IEEE
Commun. Surveys Tuts., Sep 2017.
packets and replying a large number of Error messages. In [6] A. Sehgal, V. Perelman, S. Kuryla, and J. Schonwalder, “Management of
addition, the hatchetman attack shows the lower attack energy Resource Constrained Devices in the Internet of Things,” IEEE Commun.
inefficiency compared to that of jamming attack because the Mag., vol. 50, no. 12, p. 144149, 2012.
[7] A. Sehgal, A. Mayzaud, R. Badonnel, I. Chrisment, and J. Schnwlder,
less number of attack packets are generated by the malicious “Addressing DODAG Inconsistency Attacks in RPL Networks,” in Proc.
node as shown in Fig. 7. In terms of the level of denial IEEE GIIS, 2014, pp. 1–8.
of service, since an excessive number of Error messages are [8] T. Tsao, R. Alexander, M. Dohler, V. Daza, A. Lozano, and M. Richard-
son, “A Security Threat Analysis for the Routing Protocol for Low-
generated and forwarded by each intermediate node along the Power and Lossy Networks (RPLs),” RFC Standard 7416, January 2015.
forwarding path, which exhaust the communication bandwidth [9] A. Varga, OMNeT++, 2014, http://www.omnetpp.org/.
and node energy, channel condition will get worse and the [10] C. Pu and S. Lim, “Spy vs. Spy: Camouflage-based Active Detection
in Energy Harvesting Motivated Networks,” in Proc. IEEE MILCOM,
legitimate nodes consume a significant amount of energy. 2015, pp. 903–908.
Eventually, the hatchetman attack can lead to an extremely [11] C. Pu, S. Lim, J. Byungkwan, and M. Manki, “Mitigating Stealthy
severe denial of service in RPL-based LLNs. Collision Attack in Energy Harvesting Motivated Networks,” in Proc.
IEEE MILCOM, 2017, pp. 575–580.
[12] C. Pu, S. Lim, C. Jinseok, and J. Byungkwan, “Active Detection
VII. C ONCLUSION AND F UTURE W ORK in Mitigating Routing Misbehavior for MANETs,” Wireless Network
In this paper, we investigate the hatchetman attack, which (2017), https://doi.org/10.1007/s11276-017-1621-z.
[13] C. Pu and S. Lim, “A Light-Weight Countermeasure to Forwarding
is a new and severe denial-of-service attack in RPL-based low Misbehavior in Wireless Sensor Networks: Design, Analysis, and Eval-
power and lossy networks (LLNs). In hatchetman attack, the uation,” IEEE Systems Journal, pp. 1–9, 2016.
malicious node manipulates the source route header of the [14] Q. Monnet, L. Mokdad, and J. Ben-Othman, “Energy-balancing method
to detect denial of service attacks in wireless sensor networks,” in Proc.
received packets, and then generates and sends the invalid IEEE ICC, 2014, pp. 106–111.
packets with error route to legitimate nodes to cause the [15] S. Raza, L. Wallgren, and T. Voigt, “SVELTE: Real-time intrusion
legitimate nodes to drop the received packets and reply an detection in the Internet of Things,” Ad Hoc Networks, vol. 11, no. 8,
pp. 2661–2674, 2013.
excessive number of Error messages back to the DODAG [16] C. Pu and S. Hajjar, “Mitigating Forwarding Misbehaviors in RPL-based
root, which eventually lead to a denial of service in RPL- Low Power and Lossy Networks,” in Proc. IEEE CCNC, 2018, pp. 1–6.
based LLNs. We analyze the hatchetman attack and compare [17] C. Pu, “Mitigating DAO Inconsistency Attack in RPL-based Low Power
and Lossy Networks,” in Proc. IEEE CCWC, 2018, pp. 570–574.
it with the well-known jamming attack and original RPL [18] N. Beigi-Mohammadi, J. Misic, H. Khazaei, and V. B. Misic, “An In-
without adversary. Extensive simulation results indicate that trusion Detection System for Smart Grid Neighborhood Area Network,”
the hatchetman attack is a severe denial-of-service attack, in Proc. IEEE ICC, 2014, pp. 4125–4130.
[19] A. Le, J. Loo, A. Lasebae, A. Vinel, Y. Chen, and M. Chai, “The Impact
which significantly decreases the PDR and increases the packet of Rank Attack on Network Topology of Routing Protocol for Low-
delivery latency, energy consumption, and throughput. Power and Lossy Networks,” IEEE Sensors J., vol. 11, no. 10, pp. 3685–
As a future work, we plan to propose a light-weight 3692, 2013.
[20] A. Dvir, T. Holczer, and L. Buttyan, “VeRA-Version Number and Rank
countermeasure to mitigate the hatchetman attack in RPL- Authentication in RPL,” in Proc. IEEE MASS, 2011, pp. 709–714.
based LLNs. For example, each intermediate node along the [21] S. M. Sajjad and M. Yousaf, “Security analysis of IEEE 802.15. 4 MAC
forwarding path can maintain a threshold to limit the rate of in the context of Internet of Things (IoT),” in Proc. IEEE CIACS, 2014,
pp. 9–14.
forwarding Error messages within a time period. If the number [22] P. Kasinathan, C. Pastrone, M. A. Spirito, and M. Vinkovits, “Denial-
of forwarded Error messages exceeds the threshold, all further of-Service detection in 6LoWPAN based Internet of Things,” in Proc.
Error messages will be rejected. In order to dynamically react IEEE WiMob, 2013, pp. 600–607.
[23] A. Rghioui, A. Khannous, and M. Bouhorma, “Denial-of-Service attacks
to different attack patterns under varying network conditions, on 6LoWPAN-RPL networks: Threats and an intrusion detection system
the threshold should be adaptively adjusted based on the proposition,” Journal of Advanced Computer Science & Technology,
number of forwarded Error messages as well as the estimated vol. 3, no. 2, pp. 143–152, 2014.
[24] S. Challa, M. Wazid, A. Das, N. Kumar, A. Reddy, E. Yoon, and K. Yoo,
normal Error message rate. To see the full potential of the “Secure Signature-Based Authenticated Key Establishment Scheme for
proposed countermeasure, we plan to develop a small-scale Future IoT Applications,” IEEE Access, vol. 5, pp. 3028–3043, 2017.
testbed for the experimental study and implementation. [25] A. Boulis, Castalia, 2014, http://castalia.forge.nicta.com.au.
[26] K. Zeng, K. Ren, W. Lou, and P. Moran, “Energy aware efficient
geographic routing in lossy wireless sensor networks with environmental
ACKNOWLEDGMENT energy supply,” Wireless Networks, vol. 15, no. 1, pp. 39–51, 2009.
This research was supported by Startup grant in Weisberg
Division of Computer Science at Marshall University.

17