# A Review of Performance, Energy and Privacy of Intrusion Detection Systems for IoT
## 3 Security Threats for IoT Systems
### Routing-Specific Threats  
Routing information in an IoT system can be modified or spoofed in order to route the traffic in a malicious manner or to launch a further attack on the IoT network. These attacks are the most common in resource-constrained IoT networks. The most relevant routing attacks in IoT include the following:  
_Rank attack:_ A defining characteristic of 6 LoWPAN networks is the use of ranking to establish an optimal routing path. Within this context, _Node Rank_ indicates the quality of the path from a node to the sink node. Every time a node updates its rank or preferred parent, it is required to inform other nodes by sending the updated information in the next Directed Acyclic Graph (DAG) Information Object (DIO). RPL uses the Rank rule i.e., _a node in the parent should always have lower rank than its children to prevent the loop creation_. In this way, the rank enables creating optimal topology, preventing loop creation and managing control overhead [27]. As identified by [27; 28; 29] the rank information can be maliciously tampered with by an attacker such that it chooses the node with worst rank to be its parent. This will therefore result in disturbing the topology of the network, thereby causing delays in normal transmission. _Wormhole attack:_A wormhole can be considered as a tunnel between two nodes using wired or wireless links and can be used to achieve faster transmission rates or dedicated connection between such nodes. As such, the wormhole has legitimate applications, such as the connection between the local and global IDS modules within our architecture. However, the wormhole can be used by an attacker to create a dedicated tunnel with a node on the Internet as identified by [30]. Wormhole attack is not novel to the IoT systems and has been historically identified as a potential threat for wireless sensor networks by [31; 32; 33]. _Sinkhole attack:_ The objective of a sinkhole attack is to attract traffic through a designated node using illegitimate information making the node a lucrative routing sink (base station within a wireless network). As with the wormhole attack, literature around the sinkhole attack is well established with [34] being an initial effort to identify and mitigate against such attack. Creating a sinkhole does not necessarily disrupt legitimate transmission within a 6 LoWPAN, however, by diverting the traffic through a specific route creates opportunities to launch other attacks, such as wormhole and selective forwarding attack described below. Figure 1: A taxonomy of attacks for IoT systems. _Selective forwarding attack:_ With a selective forwarding attack, a malicious node attempts to disrupt legitimate transmission and routing path. The malicious node in this case attempts to block certain packets and forward selected packets, thereby affecting the routing to fulfil malicious objectives. For instance, an attacker can forward all RPL control messages but block the remaining messages [30]. As can be inferred, this attack can cause more damage when used in conjunction with the sinkhole attack. Consequently, such dependencies among different attack types has motivated us to explore the impact of multi-stage attacks within IoT infrastructures with our initial efforts in this respect presented in [35]. _Fragment duplication attack:_ The fragment duplication attack leverages a weakness within the 6 LoWPAN layer with respect to how fragmented packets are received and assembled by an IoT node. Due to the integration of 6 LoWPAN with IPv6 networks, larger packets supported by IPv6 have to be fragmented into smaller packets so as to be effectively processed by the resource-constrained nodes within an IoT system. However, as identified by [36], a recipient node cannot verify if two fragments of a packet were sent by the same source, therefore the recipient node is unable to distinguish between legitimate and spoofed fragments. A malicious node can exploit this vulnerability to block reassembly of targeted packets, such as connection establishment packets.