# Detection and Mitigation of RPL Rank and Version Number Attacks in the Internet of Things: SRPL-RP
## The Proposed Protocol
### SRPL-RP Description
However, if the NCR is lower than the NPVR, then the system checks whether the nodes are siblings. If the node does not have siblings, then the system checks whether they are child nodes. If the node is not a child, then it is a leaf node. In addition, if the nodes are children, then the minimum rank and Parent Switching Threshold (PST) is compared with the NPVR. If the (minimum rank + PST) is equal to the NPVR, then the node is legitimate and valid. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Work/Feature** & **Verification of Nodes** & **Comparison of Rank Strategy** & **Updating Version Number (Mitigation)** & **Monitoring Table (Mitigation)** & **Blacklist Table (Isolation)** \\ \hline Our work & Yes & Yes & Yes & Yes & Yes \\ \hline Work [13] & No & Yes & No & No & No \\ \hline Work [14] & No & No & Yes & No & No \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of our Work and the Work of [13; 14]. If (minimum rank + PST) is not equal to the NPVR, then it is considered a malicious node. The monitoring table will be updated to add the malicious node to the blacklist table. On the other hand, if the node has siblings, then the NCR is compared with the minimum rank and PST. If the NCR is lower than the (minimum rank\(-\)PST), then it is considered and detected as a malicious node. The monitoring table will be updated to add the malicious node to the blacklist table. However, if the NCR is greater than the (minimum rank\(-\)PST), then it is considered a mobile node in the RPL network. Phase Five: Figure 2 shows the conditions for the version number attack detection, mitigation, and isolation, which is added to the research [14]. If the DIO message of the sender node has a greater version number than the version number in the root node, then the rank rule of the parent node is compared with the rank rule of the current node. If the NPR is greater than the NCR, then it is considered as a mobile node in the RPL network. However, if the NPR is lower than the NCR, then the rank rule of the previous node is compared with the rank rule of the current node. If the NPVR is greater than the NCR, then it is considered a mobile node in the RPL network. However, if the NPVR is lower than the NCR, then the version field of the sender node is updated in the neighbor list table. The neighbor table list is formulated during DODAG construction, and it stores the information of the neighbor nodes and their version field. Then, the system checks whether half of the nodes have the same information of the version number in the neighbor list table. If half of the neighbor nodes in the neighbor list table have the same version number, then the version number of the sender node is updated and changed to the same majority version number in the table. This also clears the previous version number field. However, if half of the nodes do not share the same information of the version number field in the table, then it is considered a malicious node. The monitoring table will be updated to add the malicious node to the blacklist table. Figure 1: Protocol Model Flowchart, Phase Four.