{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,26]],"date-time":"2026-03-26T11:44:36Z","timestamp":1774525476764,"version":"3.50.1"},"reference-count":38,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2022,3,9]],"date-time":"2022-03-09T00:00:00Z","timestamp":1646784000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["JCP"],"abstract":"<jats:p>Routing attacks are a major security issue for Internet of Things (IoT) networks utilising routing protocols, as malicious actors can overwhelm resource-constrained devices with denial-of-service (DoS) attacks, notably rank and blackhole attacks. In this work, we study the impact of the combination of rank and blackhole attacks in the IPv6 routing protocol for low-power and lossy (RPL) networks, and we propose a new security framework for RPL-based IoT networks (SRF-IoT). The framework includes a trust-based mechanism that detects and isolates malicious attackers with the help of an external intrusion detection system (IDS). Both SRF-IoT and IDS are implemented in the Contiki-NG operating system. Evaluation of the proposed framework is based on simulations using the Whitefield framework that combines both the Contiki-NG and the NS-3 simulator. Analysis of the simulations of the scenarios under active attacks showed the effectiveness of deploying SRF-IoT with 92.8% packet delivery ratio (PDR), a five-fold reduction in the number of packets dropped, and a three-fold decrease in the number of parent switches in comparison with the scenario without SRF-IoT. Moreover, the packet overhead introduced by SRF-IoT in attack scenarios is minimal at less than 2%. Obtained results suggest that the SRF-IoT framework is an efficient and promising solution that combines trust-based and IDS-based approaches to protect IoT networks against routing attacks. In addition, our solution works by deploying a watchdog mechanism on detector nodes only, leaving unaffected the operation of existing smart devices.<\/jats:p>","DOI":"10.3390\/jcp2010009","type":"journal-article","created":{"date-parts":[[2022,3,9]],"date-time":"2022-03-09T11:30:38Z","timestamp":1646825438000},"page":"124-153","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":35,"title":["A Trust-Based Intrusion Detection System for RPL Networks: Detecting a Combination of Rank and Blackhole Attacks"],"prefix":"10.3390","volume":"2","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7436-4470","authenticated-orcid":false,"given":"Philokypros P.","family":"Ioulianou","sequence":"first","affiliation":[{"name":"Department of Computer Science, University of York, York YO10 5GH, UK"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4902-8226","authenticated-orcid":false,"given":"Vassilios G.","family":"Vassilakis","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of York, York YO10 5GH, UK"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5284-6847","authenticated-orcid":false,"given":"Siamak F.","family":"Shahandashti","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of York, York YO10 5GH, UK"}]}],"member":"1968","published-online":{"date-parts":[[2022,3,9]]},"reference":[{"key":"ref_1","unstructured":"Holst, A. (2021, December 26). IoT Connected Devices Worldwide 2019\u20132030 | Statista. Available online: https:\/\/www.statista.com\/statistics\/1183457\/iot-connected-devices-worldwide\/."},{"key":"ref_2","unstructured":"Gemalto (2021, February 01). The State of IoT Security. Available online: http:\/\/www2.gemalto.com\/iot\/index.html."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Nawir, M., Amir, A., Yaakob, N., and Lynn, O.B. (2016, January 11\u201312). Internet of Things (IoT): Taxonomy of security attacks. Proceedings of the 3rd International Conference on Electronic Design (ICED), Phuket, Thailand.","DOI":"10.1109\/ICED.2016.7804660"},{"key":"ref_4","unstructured":"Lindsey, O. (2021, December 26). \u2018Amnesia: 33\u2019 TCP\/IP Flaws Affect Millions of IoT Devices. Available online: https:\/\/threatpost.com\/amnesia33-tcp-ip-flaws-iot-devices\/161928\/."},{"key":"ref_5","unstructured":"egnite GmbH (2021, December 26). Nut\/OS. Available online: http:\/\/www.ethernut.de\/en\/firmware\/index.html."},{"key":"ref_6","first-page":"1","article-title":"RPL: IPv6 Routing Protocol for Low-Power and Lossy Networks","volume":"6550","author":"Winter","year":"2012","journal-title":"rfc"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"96","DOI":"10.1109\/MCOM.2011.5741163","article-title":"Connecting low-power and lossy networks to the internet","volume":"49","author":"Ko","year":"2011","journal-title":"IEEE Commun. Mag."},{"key":"ref_8","first-page":"131","article-title":"A security threat analysis for the routing protocol for low-power and lossy networks (RPLs)","volume":"7416","author":"Tsao","year":"2015","journal-title":"RFC"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Medjek, F., Tandjaoui, D., Romdhani, I., and Djedjig, N. (2018). Security Threats in the Internet of Things: RPL\u2019s Attacks and Countermeasures. Security and Privacy in Smart Sensor Networks, IGI Global.","DOI":"10.4018\/978-1-5225-5736-4.ch008"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Pongle, P., and Chavan, G. (2015, January 8\u201310). A survey: Attacks on RPL and 6LoWPAN in IoT. Proceedings of the 2015 International Conference on Pervasive Computing (ICPC), Pune, India.","DOI":"10.1109\/PERVASIVE.2015.7087034"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Kumar, A., Matam, R., and Shukla, S. (2016, January 22\u201324). Impact of packet dropping attacks on RPL. Proceedings of the 2016 Fourth International Conference on Parallel, Distributed and Grid Computing (PDGC), Waknaghat, India.","DOI":"10.1109\/PDGC.2016.7913211"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Ioulianou, P.P., and Vassilakis, V.G. (2019, January 26). Denial-of-Service Attacks and Countermeasures in the RPL-Based Internet of Things. Proceedings of the 2nd International Workshop on Attacks and Defenses for Internet-of-Things (ADIoT) in Conjunction with ESORICS, Luxembourg.","DOI":"10.1007\/978-3-030-42048-2_24"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Kamble, A., Malemath, V.S., and Patil, D. (2017, January 3\u20135). Security attacks and secure routing protocols in RPL-based Internet of Things: Survey. Proceedings of the 2017 International Conference on Emerging Trends & Innovation in ICT (ICEI), Pune, India.","DOI":"10.1109\/ETIICT.2017.7977006"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"133","DOI":"10.1109\/MNET.011.1900651","article-title":"Security Against Rank Attack in RPL Protocol","volume":"34","author":"Boudouaia","year":"2020","journal-title":"IEEE Netw."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"5666","DOI":"10.1109\/JSEN.2020.2973677","article-title":"Security of RPL based 6LoWPAN Networks in the Internet of Things: A Review","volume":"20","author":"Verma","year":"2020","journal-title":"IEEE Sens. J."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"1582","DOI":"10.1109\/COMST.2018.2885894","article-title":"Routing Attacks and Mitigation Methods for RPL-Based Internet of Things","volume":"21","author":"Raoof","year":"2019","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"794326","DOI":"10.1155\/2013\/794326","article-title":"Routing attacks and countermeasures in the RPL-based internet of things","volume":"9","author":"Wallgren","year":"2013","journal-title":"Int. J. Distrib. Sens. Netw."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Ribera, E.G., Alvarez, B.M., Samuel, C., Ioulianou, P.P., and Vassilakis, V.G. (2020, January 20\u201322). Heartbeat-based detection of blackhole and greyhole attacks in RPL networks. Proceedings of the 2020 12th International Symposium on Communication Systems, Networks and Digital Signal Processing (CSNDSP), Porto, Portugal.","DOI":"10.1109\/CSNDSP49049.2020.9249519"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"25","DOI":"10.1016\/j.jnca.2017.02.009","article-title":"A survey of intrusion detection in Internet of Things","volume":"84","author":"Miani","year":"2017","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Patel, H.B., and Jinwala, D.C. (2019, January 17\u201320). Blackhole detection in 6LoWPAN based internet of things: An anomaly based approach. Proceedings of the TENCON 2019-2019 IEEE Region 10 Conference (TENCON), Kochi, India.","DOI":"10.1109\/TENCON.2019.8929491"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"429","DOI":"10.1007\/s12243-018-0645-4","article-title":"Detection of rank attack in routing protocol for Low Power and Lossy Networks","volume":"73","author":"Shafique","year":"2018","journal-title":"Ann. Telecommun."},{"key":"ref_22","first-page":"467","article-title":"Multiple intrusion detection in RPL based networks","volume":"10","author":"Belavagi","year":"2020","journal-title":"Int. J. Electr. Comput. Eng."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"2661","DOI":"10.1016\/j.adhoc.2013.04.014","article-title":"SVELTE: Real-time intrusion detection in the Internet of Things","volume":"11","author":"Raza","year":"2013","journal-title":"Ad Hoc Netw."},{"key":"ref_24","first-page":"102467","article-title":"Trust-aware and cooperative routing protocol for IoT security","volume":"52","author":"Djedjig","year":"2020","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Glissa, G., Rachedi, A., and Meddeb, A. (2016, January 4\u20138). A secure routing protocol based on RPL for Internet of Things. Proceedings of the 2016 IEEE Global Communications Conference (GLOBECOM), Washington, DC, USA.","DOI":"10.1109\/GLOCOM.2016.7841543"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"A Almusaylim, Z., Jhanjhi, N., and Alhumam, A. (2020). Detection and Mitigation of RPL Rank and Version Number Attacks in the Internet of Things: SRPL-RP. Sensors, 20.","DOI":"10.20944\/preprints202007.0476.v1"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"81","DOI":"10.1016\/j.adhoc.2018.10.022","article-title":"New lightweight mitigation techniques for RPL version number attacks","volume":"85","year":"2019","journal-title":"Ad Hoc Netw."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"860","DOI":"10.1016\/j.future.2018.03.021","article-title":"SecTrust-RPL: A secure trust-aware RPL routing protocol for Internet of Things","volume":"93","author":"Airehrour","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Iuchi, K., Matsunaga, T., Toyoda, K., and Sasase, I. (2015, January 14\u201316). Secure parent node selection scheme in route construction to exclude attacking nodes from RPL network. Proceedings of the 2015 21st Asia-Pacific Conference on Communications (APCC), Kyoto, Japan.","DOI":"10.1109\/APCC.2015.7412530"},{"key":"ref_30","unstructured":"Ioulianou, P.P., Vassilakis, V.G., Moscholios, I.D., and Logothetis, M.D. (2018, January 11\u201313). A signature-based intrusion detection system for the Internet of things. Proceedings of the IEICE Information and Communication Technology Forum (ICTF), Graz, Austria."},{"key":"ref_31","first-page":"37","article-title":"Battery Drain Denial-of-Service Attacks and Defenses in the Internet of Things","volume":"2","author":"Ioulianou","year":"2019","journal-title":"J. Telecommun. Inf. Technol."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"198","DOI":"10.1016\/j.jnca.2016.03.006","article-title":"Secure routing for internet of things: A survey","volume":"66","author":"Airehrour","year":"2016","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"232","DOI":"10.1016\/j.knosys.2009.12.004","article-title":"Improved trust-aware recommender system using small-worldness of trust networks","volume":"23","author":"Yuan","year":"2010","journal-title":"Knowl.-Based Syst."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Perrey, H., Landsmann, M., Ugus, O., Schmidt, T.C., and W\u00e4hlisch, M. (2013). TRAIL: Topology authentication in RPL. arXiv.","DOI":"10.1109\/INFCOMW.2013.6970745"},{"key":"ref_35","first-page":"1","article-title":"The trickle algorithm","volume":"6206","author":"Levis","year":"2011","journal-title":"Internet Eng. Task Force RFC"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Tsiftes, N., Eriksson, J., and Dunkels, A. (2010, January 12\u201316). Low-power wireless IPv6 routing with ContikiRPL. Proceedings of the 9th ACM\/IEEE International Conference on Information Processing in Sensor Networks, Stockholm, Sweden.","DOI":"10.1145\/1791212.1791277"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Osterlind, F., Dunkels, A., Eriksson, J., Finne, N., and Voigt, T. (2006, January 14\u201316). Cross-level sensor network simulation with Cooja. Proceedings of the 31st IEEE International Conference on Local Computer Networks, Tampa, FL, USA.","DOI":"10.1109\/LCN.2006.322172"},{"key":"ref_38","unstructured":"Jadhav, R. (2021, December 26). Whitefield Framework. Available online: https:\/\/github.com\/whitefield-framework\/whitefield."}],"container-title":["Journal of Cybersecurity and Privacy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2624-800X\/2\/1\/9\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T22:33:51Z","timestamp":1760135631000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2624-800X\/2\/1\/9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,3,9]]},"references-count":38,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2022,3]]}},"alternative-id":["jcp2010009"],"URL":"https:\/\/doi.org\/10.3390\/jcp2010009","relation":{},"ISSN":["2624-800X"],"issn-type":[{"value":"2624-800X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,3,9]]}}}