# Securing IoT: Mitigating Sybil Flood Attacks with Bloom Filters and Hash Chains
## 3 Related Work  
Ensuring secure authentication and defending against sybil and flooding attacks in resource-constrained IoT networks has been an active area of research in recent years. Researchers have explored various techniques and approaches to address these challenges while accounting for the computational and energy limitations of IoT devices. For instance, ref. [21] proposed liteSAD, a novel and secure mechanism for addressing sybil attacks in RPL-based IoT systems. liteSAD leverages Physical Unclonable Functions (PUFs) and a lightweight Bloom filter to enable distributed sybil attack detection, aiming to enhance security while maintaining efficiency compared to traditional methods that store complete node identities. The core of liteSAD involves the DODAG root generating a Bloom filter populated by hashing each legitimate node's identifier along with its unique PUF response. This Bloom filter is then distributed to all legitimate nodes through a new packet type called BF-DAO. Each node uses the filter to verify other nodes' PUF responses, enabling distributed sybil attack detection. While liteSAD demonstrates promise, the paper lacks a comprehensive analysis of its scalability in large IoT networks. Specifically, the impact of network growth on the size and performance of the Bloom filter needs further exploration. Additionally, the trade-off between false positive rates and communication overhead as the network expands requires investigation. Finally, a detailed analysis of how the Bloom filter and PUF integration affects processing power, memory, and battery life of IoT devices is crucial for assessing the feasibility of liteSAD in resource-constrained environments. The authors of [15] introduced a novel Bloom filter variant called enhanced Bloom filter (eBF) specifically designed to address intrusion detection challenges in resource-constrained IoT environments. Their proposed filter tackles the limitations of traditional Bloom filters regarding memory efficiency, processing speed, and accuracy in detecting malicious activities. A key innovation of the eBF lies in its two-dimensional structure. It utilizes two separate Bloom filters: the intrusion Bloom filter (iBF) stores intrusion data packet information, while the benign Bloom filter (bBF) stores benign data packet information. This design distinction helps to reduce false positives by ensuring that the same data packet is not present in both filters simultaneously. The system categorizes a packet as potentially benign, intrusion, or a false positive based on the responses from iBF and bBF. In cases where both Bloom filters return true for the same packet, indicating a potential false positive, the system employs a deep learning model for accurate classification. This model analyses the packet's features and determines whether it is an intrusion or benign. After classification by the deep learning model, the data packet is either stored in the iBF for future reference and blocking (if classified as an intrusion) or in the bBF for further processing (if classified as benign). This combined approach employing Bloom filters and deep learning intervention enables the system to effectively differentiate between malicious intrusion attempts and harmless activities in IoT devices, enhancing overall security and intrusion detection capabilities. While eBF presents a novel approach to enhancing intrusion detection in IoT through improved memory efficiency and accuracy, careful consideration of implementation issues and potential challenges is essential for successful integration into real-world IoT environments. The study presented in [22] proposed a lightweight protocol for secure communication in smart homes. This protocol leverages a technique called a cumulative keyed-hash chain to achieve multiple security goals. One key feature is mutual authentication. The hash chain establishes a challenge-response mechanism that verifies the identity of both the device and the user attempting to communicate.