Detecting Sinkhole Attack in RPL-based Internet of Things Routing Protocol

The Internet of Things (IoT) is a novel paradigm in computer networks is capable of connecting things to the internet via a wide range of technologies. Due to the features of the sensors used in the IoT networks and the unsecured nature of the internet, IoT is vulnerable to many internal routing attacks. Using the traditional IDS in these networks has its own challenges due to the resource constraint of the nodes and the characteristics of the IoT network. A sinkhole attacker node in this network attempts to attract traffic through an incorrect information advertisement. In this research work, a distributed IDS architecture is proposed in order to detect the sinkhole routing attack in the RPL-based IoT networks, and this is aimed to improve a true detection rate and reduce the false alarms. For the latter, we used one type of post-processing mechanism in which a threshold is defined for separating suspicious alarms for further verifications. Also the implemented IDS modules are distributed via the client and router border nodes that make it energy efficient. The required data for interpretation of the network’s behavior is gathered from the scenarios implemented in the Cooja environment with the aim of Rapidminer for mining the produced patterns. The produced dataset is optimized using the genetic algorithm by selecting appropriate features. We investigate three different classification algorithms, and in its best case, Decision Tree could reach a 99.35 rate of accuracy.