RPLAD3: anomaly detection of blackhole, grayhole, and selective forwarding attacks in wireless sensor network-based Internet of Things

Zainab Alansari; Nor Badrul Anuar; Amirrudin Kamsin; Mohammad Riyaz Belgaum

doi:10.7717/peerj-cs.1309

RPLAD3: anomaly detection of blackhole, grayhole, and selective forwarding attacks in wireless sensor network-based Internet of Things

PeerJ Comput Sci. 2023 Mar 27:9:e1309. doi: 10.7717/peerj-cs.1309. eCollection 2023.

Authors

Zainab Alansari^{1

2}, Nor Badrul Anuar¹, Amirrudin Kamsin¹, Mohammad Riyaz Belgaum^{3

4}

Affiliations

¹ Faculty of Computer Science and Information Technology, University of Malaya, Kuala Lumpur, Malaysia.
² College of Computing and Information Sciences, University of Technology and Applied Sciences, Muscat, Sultanate of Oman.
³ Computer Science and Engineering, G. Pullaiah College of Engineering and Technology, Kurnool, India.
⁴ Faculty of Computing and Informatics, Multimedia University, Cyberjaya, Malaysia.

Abstract

Routing protocols transmit vast amounts of sensor data between the Wireless Sensor Network (WSN) and the Internet of Things (IoT) gateway. One of these routing protocols is Routing Protocol for Low Power and Lossy Networks (RPL). The Internet Engineering Task Force (IETF) defined RPL in March 2012 as a de facto distance-vector routing protocol for wireless communications with lower energy. Although RPL messages use a cryptographic algorithm for security protection, it does not help prevent internal attacks. These attacks drop some or all packets, such as blackhole or selective forwarding attacks, or change data packets, like grayhole attacks. The RPL protocol needs to be strengthened to address such an issue, as only a limited number of studies have been conducted on detecting internal attacks. Moreover, earlier research should have considered the mobility framework, a vital feature of the IoT. This article presents a novel lightweight system for anomaly detection of grayhole, blackhole, and selective forwarding attacks. The study aims to use a trust model in the RPL protocol, considering attack detection under mobility frameworks. The proposed system, anomaly detection of three RPL attacks (RPLAD3), is designed in four layers and starts operating immediately after the initial state of the network. The experiments demonstrated that RPLAD3 outperforms the RPL protocol when defeating attacks with high accuracy and a true positive ratio while lowering power and energy consumption. In addition, it significantly improves the packet delivery ratio and decreases the false positive ratio to zero.

Keywords: Anomaly detection; Blackhole attack; Grayhole attack; Internal attacks; Internet of Things; Network layer attacks; RPL protocol; Routing attacks; Selective forwarding attack; Wireless sensor network.

Grants and funding

This research work was supported by the Konsortium Kecemerlangan Penyelidikan (JPT(BKPI)1000/016/018/25 (49)) provided by the Ministry of Higher Education of Malaysia. The funders had no role in study design, data collection and analysis, decision to publish, or preparation of the manuscript.