© 2019 JETIR June 2019, Volume 6, Issue 6 www.jetir.

org (ISSN-2349-5162)

IDS TO DETECT AND PREVENT LOW

POWER LOSSY NETWORKS FROM
HATCHETMAN ATTACK
Hanan Hassan Khan1, Manmeen Kaur2
1
Research Scholar, 2Assitant Professor, CSE Department

Swami Vivekanand Institute of Engineering and Technology, Patiala, India.

Abstract: The work was aimed at securing the low routing protocol for low power and lossy networks
power lossy networks against new kind of attack, i.e. is planned to be an easy and inter-operable
Hatchetman attack. In this attack, RPL is exploited and networking protocol for resource-constrained
the malicious node changes the address of the
objects in industrial, home, and urban
piggybacked source route with fictitious destination
environments, intended to support the vision of
address. The attack was simulated in network simulator
the Internet of Things with number of devices
2.35. Also, the detection and prevention scheme was
connected through multi hop mesh networks.
simulated under the same simulation scenario. The
Around five years have passed since the
performance of the network was compared based on
bandwidth consumed, packet delivery ratio and standardization of RPL, and it is assumed that it is
number of packet drops in the network. The time to study and understand its existing state. It is
performance parameters showed an improvement in also envision that wirelessly connected IP smart
network’s performance after successful detection and nodes under internet of things will develop
prevention of the malicious node. information accessibility and availability as well

Keywords: RPL, Hatchetman attack, DODAG, packet as our lives advancement further. But because of
delivery ratio the shared medium and the lack of resource
requirement , physical protection and security
I. INTRODUCTION
requirements of inherent network protocols, LLNs
Highly increasing physical objects being are undoubtedly exposed to Denial-of-Service
connection with the Internet are knowing the attacks [4].The Internet of Things is known as a
concept of Internet-of Things and its applications globally network infrastructure that promotes
also, in which a myriad of multiscale sensors and wireless communication among devices . One
objects are flawlessly blended and communication instant challenge is the management of these
is between them. Internet of Things (IOT) is a objects, knowing that they may have limited
theory shift in networks that actually make computational resources. This management can be
connection nearly among all things Given the performed by using gateways, i.e., devices that
constrained nature of smart devices, energy transition wireless communications, minimizing
efficient routing performs a major role in well resource consumption of the restrained objects.
deployment of such networks. [1] The Internet
A new type of denial-of-service DOS attack,
Engineering Task Force Working Group [2] has
called hatchetman attack, in RPL-based LLNs is
presented a routing protocol for low power and
presented. a nasty node manipulates the source
lossy networks, referred to as RPL [3]. RPL a
JETIR1907I17 Journal of Emerging Technologies and Innovative Research (JETIR) www.jetir.org 111
© 2019 JETIR June 2019, Volume 6, Issue 6 www.jetir.org (ISSN-2349-5162)

route header of the arrived packet, and then seen in the analysis of network topology that
generates and transfers the invalid data with error constitute both static and mobile. This also
route to valid nodes In hatchetman attack. When presented that how version attacks effected the
the legitimate node obtain the invalid packets with power consumption of the nodes.
error route, the dropping of packets will be done
In [7] a rank attack that goals in the property of
since the arriving node cannot transfer the packets
rank in RPL and its effect on the performance are
with the error route. The arrived node will reply
investigation of the wireless sensor networks,
an Error message back to the DODAG root for
where the adversary can settle with the rank rule
reporting the error in source route header. If the
for the downgrade of the performance of RPL.
malicious node arrives and transfers huge amount
Four adversarial areas consulted by violating rank
of invalid packets with error route to legitimate
rule permanently and non-permanently and their
nodes, this will cause the valid nodes to drop the
potential performance impact are studied.
received packets and replying huge Error
messages, which leads to a denial of service in In [8] summarization of the emerging work for
RPL-based LLNs and evaluation of its protection of Internet-of-Things IOT networks
performance impact through broad simulation against Denial-of-Service DOS attacks. The
experiments in terms of packet delivery ratio, attacks that the anomaly-based for error Detection
throughput, packet delivery latency, energy System intruder can be insider or outsider attacks.
consumption, the number of attack packets, and The system presented can be of as an improved
attack energy inefficiency is done . The simulation version of SVELTE IDS which in best case solves
results states that the hatchetman attack is really a the problem of detection system components'
severe attack in RPL-based LLNs [5]. placement within the low power and lossy
network. Also, the monitoring part of the detection
The rest of the paper is organized as follows:
system to the resource constrained objects and the
An overview of related work is provided in detection part to the border router. In addition to
Section II. Section III describes the detection and this, the extended 6LoWPAN networks and
prevention technique for the Hatchetman attack. incorporate the cooperative autonomous detection
Section IV shows the results and finally, paper has model so that multiple IoT networks sharing the
been concluded in last section of the paper. same DODAG ID cooperate get stronger against
coordinated attacks where potential security issues
II. RELATED WORK
and fundamental countermeasures are presented. It
While the paper [4] studies the history of research also analyses the security capability of the IEEE
efforts in RPL and future research directions on 802.15.4 MAC protocol as well as the limitations
which RPL should evolve, the authors in [5] have there of in the area of Internet-of Things.
come up with new kind of attack in RPL known as
In [9], the authors proposed a light-weight counter
Hatchetman attack.
measure to a choosy forwarding attack, called
In [6], the RPL attacks are studied and analyses is SCAD, in which a random single checkpoint node
also done here. The unique performance can be
JETIR1907I17 Journal of Emerging Technologies and Innovative Research (JETIR) www.jetir.org 112
© 2019 JETIR June 2019, Volume 6, Issue 6 www.jetir.org (ISSN-2349-5162)

selected is deployed to find the forwarding CMD presents a monitor-based technique to

misbehaviour of invalid node. The presented moderate the forwarding misbehaviours in LLNs
countermeasure is included with timeout and hop- running with RPL, in which each node follows the
by-hop retransmission models to for fast forwarding behaviours of the selected parent node
recovering of not expected packet losses because to study the packet loss rate PLR, the observation
of the forwarding misbehaviour or awful channel result is compared with the collected packet loss
quality. It is also presented that a simple rate from one-hop neighbour nodes, and detection
analytical approach and its numerical result in of the forwarding misbehaviours of the selected
terms of fake detection rate. The authors perform parent node.
extensive simulation experiments for performance
III. PROPOSED WORK
evaluation and compare it with the existing
CHEMAS and CAD models. The results of In this work, we proposed IDS system for
simulation show that the proposed countermeasure detection of Hatchetman attack in lossy networks.
can advance the detection rate and packet delivery In the proposed IDS system, IDS nodes will be
ratio (PDR) as well as also be helpful in the deployed in the network in such a way that each
energy consumption, false detection rate, and IDS node is in direct connection with other normal
successful drop rate reduction. nodes in the network. These IDS nodes can share
information with each other also such that they
A very lightweight countermeasure to choosy
have complete knowledge of the network.
forwarding attack is presented by deploying a
single checkpoint node included with timeout and When the DODAG root has to forward any data to
hop-by-hop retransmission models. An optimal the sink node, it will broadcast DIO control
monitoring node selection model is presented to message first to build routes to the sink node.
protect the network against denial-of-service DOS When the routes are build, the sink node will send
attacks in wireless sensor networks WSNs in [10]. DAO message to the DODAG root node. To this
DAO message, the DODAG root replies back with
The SVELTE [11] proposes that the IOT
DAO-ACK packet. If there is any attacker node in
resources things are connected to the non-reliable
the route, it will modify the DAO-ACK message
and non-trusted internet through IPv6 and
contents such that the next node could not find
6LoWPAN networking scenario. Also the
route to original destination node.
provided with security with encryption and
authentication, and these things are known to When the next node receives such a packet,
wireless attacks inside the 6LoWPAN networking instead of sending the error message back to the
and from the internet. These attacks may achieve DODAG root node, it will send the received
some success but there is a need of intrusion packet to the immediate IDS node. We refer to
detection system. A novel intrusion detection this node as requesting node. The IDS nodes will
system for the security of Low-Power Wireless coordinate with each other to find if the
Personal Area Network (6LoWPAN) running with destination address (which is in the packet)
RPL from network layer and routing attacks. The actually exists in the network. For this, each IDS
JETIR1907I17 Journal of Emerging Technologies and Innovative Research (JETIR) www.jetir.org 113
© 2019 JETIR June 2019, Volume 6, Issue 6 www.jetir.org (ISSN-2349-5162)

node will mutually exchange the information

regarding the ID of the nodes which are in their
communication range.

If the required address is not found, the IDS node

will mark the nodes as malicious (which sent
packet to the requesting node). IDS node will also
inform DODAG root node and the immediate
neighbors of the malicious node about it so that
they do not receive any packet from it. DODAG
root will now send data to the sink node via
another path.

IV. RESULTS

The simulation of the low power lossy network Fig 4.1: Bandwidth consumed comparison
under the Hatchetman attack and the proposed This graph shows the comparison of bandwidth
detection as well as prevention scheme were consumed in the network under the effect of the
implemented in network simulator 2.35. This is attack and the after the detection of the attack. The
open source simulator and works in UNIX value of bandwidth consumed is 357 Kbps under
environment. The network simulator makes use of the effect of the attack whereas when the attack
tool command language in the front end and in the gets detected using the proposed scheme, the
back end the simulator uses C++ language. The bandwidth consumed is 329 Kbps.
various simulation parameters that were used to
simulate the network are listed in the table below:

Parameter Value

Channel Wireless

Propagation Two Ray Ground

Antenna Omni Directional

Number of nodes 100

Number of IDS nodes 9

Network area 1100*1100 sq meters

Initial Energy 100 Joules

Number of attackers 1 Fig 4.2: Number of packet drops comparison

Table 4.1 Simulation Parameters This graph shows the comparison between the
numbers of packet drops in the network. The value
rises gradually in the network till 25 seconds. The
JETIR1907I17 Journal of Emerging Technologies and Innovative Research (JETIR) www.jetir.org 114
© 2019 JETIR June 2019, Volume 6, Issue 6 www.jetir.org (ISSN-2349-5162)

packets are dropped during this time due to the consumed, packet delivery ratio and number of
congestion experienced due to the broadcasting of packet drops in the network. The proposed scheme
DIO packets in the network. After 25 seconds, the successfully detects the malicious nodes which
value rises suddenly indicating the attack. The reduces the consumption of bandwidth of the
network experiences 639 packet drops under the network. The more value of packet delivery ratio
attack and 355 packet drops under the detection indicates the less packets get dropped in the
technique. network and the malicious node is successfully
detected in the network. This also leads to better
values for the third parameter, i.e. number of
packet drops. Therefore, the improved network
performance helps us to conclude that the
proposed scheme successfully secures the network
from the Hatchetman attack.

This study analyzes three parameters only. In

future, other parameters such as the energy
consumption and throughput of the network can
also be analyzed. Also, the use of cryptographic
techniques can be made to make the network more
secure from the attacks.
Fig 4.3: PDR comparison
REFERENCES
This graph shows the value of packet delivery
ratio of the network. The value of PDR obtained [1] A. Al-Fuqaha, M. Guizani, M. Mohammadi,
under the attack is 88.61 % and the after the M. Aledhari, and M. Ayyash, “Internet of Things:
detection of the malicious node using the proposed A Survey on Enabling Technologies, Protocols,
scheme, the value obtained is 93.25 %. and Applications,” IEEE Commun. Surveys Tuts.,
vol. 17, no. 4, pp. 2347–2376, 2015.
V. CONCLUSION
[2] The Internet Engineering Task Force (IETF),
The work was aimed at securing the low power
https://www.ietf.org.
lossy networks against new kind of attack, i.e.
Hatchetman attack. In this attack, RPL is exploited [3] T. Winter and P. Thubert, “RPL: IPv6 Routing
and the malicious node changes the address of the Protocol for Low-Power and Lossy Networks,”
piggybacked source route with fictitious RFC Standard 6550, March 2012.
destination address. The attack was simulated in
[4] H. Kim, J. Ko, D. Culler, and J. Paek,
network simulator 2.35. Also, the detection and
“Challenging the IPv6 Routing Protocol for Low-
prevention scheme was simulated under the same
Power and Lossy Networks (RPL): A Survey,”
simulation scenario. The performance of the
IEEE Commun. Surveys Tuts., Sep 2017.
network was compared based on bandwidth

JETIR1907I17 Journal of Emerging Technologies and Innovative Research (JETIR) www.jetir.org 115
© 2019 JETIR June 2019, Volume 6, Issue 6 www.jetir.org (ISSN-2349-5162)

[5] Cong Pu ,Tianyi Song , “Hatchetman Attack:

A Denial of Service Attack Against Routing in
Low Power and Lossy Networks”, 5th IEEE
International Conference,2018

[6] A. Le, J. Loo, A. Lasebae, A. Vinel, Y. Chen,

and M. Chai, “The Impact of Rank Attack on
Network Topology of Routing Protocol for
LowPower and Lossy Networks,” IEEE Sensors
J., vol. 11, no. 10, pp. 3685– 3692, 2013.

[7] A. Dvir, T. Holczer, and L. Buttyan, “VeRA-

Version Number and Rank Authentication in
RPL,” in Proc. IEEE MASS, 2011, pp. 709–714.

[8] P. Kasinathan, C. Pastrone, M. A. Spirito, and

M. Vinkovits, “Denialof-Service detection in
6LoWPAN based Internet of Things,” in Proc.
IEEE WiMob, 2013, pp. 600–607.

[9] S. Challa, M. Wazid, A. Das, N. Kumar, A.

Reddy, E. Yoon, and K. Yoo, “Secure Signature-
Based Authenticated Key Establishment Scheme
for Future IoT Applications,” IEEE Access, vol. 5,
pp. 3028–3043, 2017.

[10] C. Pu and S. Lim, “A Light-Weight

Countermeasure to Forwarding Misbehavior in
Wireless Sensor Networks: Design, Analysis, and
Evaluation,” IEEE Systems Journal, pp. 1–9,
2016.

[11] S. Raza, L. Wallgren, and T. Voigt,

“SVELTE: Real-time intrusion detection in the
Internet of Things,” Ad Hoc Networks, vol. 11,
no. 8, pp. 2661–2674, 2013.

JETIR1907I17 Journal of Emerging Technologies and Innovative Research (JETIR) www.jetir.org 116