## 3 Countermeasure to Suppression Attack
### HED: Heuristic-Based Detection Scheme  
**System and Adversary Models:** A low power and lossy network running with MPL is considered, where a set of resource-constrained nodes including single source node communicates among themselves directly or indirectly through lossy links. Each node is uniquely identified by an identifier, e.g., an IPv6 address. Due to the shared wireless medium, lack of tamper resistance, and inherent resource constraints, we assume that an adversary is able to capture and compromise a legitimate node, gain access to all stored information (e.g., public and private keys), and reprogram it to behave maliciously [8]. However, we do not consider node capture attack [38], where an adversary can capture a legitimate node from the network as the first step to further conduct different types of  
Figure 3: The packet reception rate against suppression attack rate and number of spoof data messages (\(N_{\text{spbl}}\)). Here, we consider a network area (150 \(\times\) 150 (m\({}^{2}\))), where 51 nodes including one source node and five malicious nodes are uniformly distributed. Figure 2: An example of multicasting a data message: (**a**) no adversary; and (**b**) one adversary launching the suppression attack. attacks. The primary goal of the adversary is to disrupt the MPL and interfere with any on-going communication. A malicious node will not intentionally drop all received multicast messages (i.e., blackhole attack) because the legitimate nodes could still receive the messages from other multicasting nodes. The malicious node may inject bogus messages into the network to consume the scarce network resource (i.e., bogus data injection attack), but this attack can be easily prevented by using the technique proposed in [39]. In this paper, we primarily focus on the multicasting misbehavior and its corresponding adversarial scenario, where the malicious node multicasts a series of spoof data messages with continuous sequence numbers to suppress normal nodes to accept valid data messages and cause them to delete their cached data messages. We only deal with the scenario that the malicious node acts alone, and the problem of colluding malicious nodes is out of the scope of this paper. Note that we do not consider suppression attack combined with other general attacks, such as sybil, collision or jamming, wormhole, or vampire attacks. **Major Operations:** The basic idea of HED is that each node maintains an increment rate of the minimum sequence number in the Seed Set, and compares the recent increment of sequence numbers within a time period with the heuristically calculated increment threshold of sequence numbers to detect the potential malicious node in MPL-based LLNs. The HED has three major operations. First, each node records a trace of multicast operations of neighbor nodes executed during an observation window (\(\omega\)), and maintains a multicast trace table (\(MT\)) to monitor their multicast operations. We deploy an observation window (\(\omega\)) to detect anomalous increment of sequence numbers within a time period, and \(\omega\) is adaptively adjusted based on the number of detected multicasting misbehaviors of suspected malicious node. Here, \(\omega\) is a system parameter and its impacts on the performance are observed in Section 5. The multicast trace table consists of five components: neighbor node's id (\(nid\)), sequence number of the first received data message within observation window (\(f\)s), timestamp of the first received data message within observation window (\(t_{fp}\)), sequence number of the last received data message within observation window (\(ls\)), and timestamp of the last received data message within observation window (\(t_{lp}\)). Here, each entry in multicast trace table brings only an extra 12 bytes of overhead in the memory, where 4 bytes are for node's id and 2 bytes are for every other four components.