# A Specification-Based IDS for Detecting Attacks on RPL-Based Network Topology
## 3 A specification-Based IDS for RPL to Detect the Topology Attacks
### Profiling RPL  
To profile the RPL protocol, we used the traces of legitimate protocol behaviors generated from the Contiki-Cooja simulation platform [13]. We only consider behaviors that related to the optimal and stable topology, in particular the route establishment and the route maintenance processes. We develop two simple algorithms to extract the states, transitions, and their statistics as below. Algorithm 1 is to analyze the potential states, transitions and statistics in each node while Algorithm 2 \begin{table}
\begin{tabular}{c c c} \hline \hline
**Type of Attacks** & **Attack Descriptions** & **Misuse Goal** \\ \hline Rank attack & An attacker does not send packets to preferred parent & Route disruption—redirect traffic \\ \hline Sinkhole attack & The attacker propagates the sink’s rank as its rank & Redirect traffic \\ \hline Local repair & An attacker sends local repair periodically & Route disruption, resource consumption \\ \hline Neighbor attack & An attacker forward the DIO messages to other neighbors without changing & False route, route disruption, resource consumption \\ \hline DIS attack & The attackers send DIS messages with a fake IP address so let the other node have to generate the DIO messages so increase the overhead & Resource consumption \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summary of potential internal threats towards RPL topology performance. is to merge all the different operations found in each node, which are generated from Algorithm 1, to form an abstract of RPL node operations. ```
0: Trace file from simulation with marking relevant states
1:for\(k=1\) to \(n\)do
2:for\(i=1\) to \(N_{k}-1\)do
3:\(PState=StateExtract(N_{i})//Get previous state from \(N_{i}\)
4:\(CState=StateExtract(N_{i+1})//Get current state from \(N_{i+1}\)
5:\(CTran=NewTan(PState,CState)//Get current transition
6:if\(CTran\
otin AllTrans[k]\)do
7:\(AllTrans[k]=Add(AllTrans[k],CTran)//Add transition to list
8:\(AllTransStatistic[k]=AddStatistic(AllTrans[k],CTran)//Add statistic
9:else
10:\(AllTransStatistic[k]=AddStatistic(AllTrans[k],CTran)//Add statistic
11:endif
12:endfor
13:endfor
```  
**Algorithm 1** Extracting states and transitions  
At the end of Algorithm 1, we generate a set of concrete states, transitions, and corresponding statistic data for each node. For example, we extract the relevant trace to node 3 and observe the following messages: [Node 3 broadcasts DIS--Node 3 receives DIO from node 5--Node 3 receives DIO from node 7--Node 3 receives DIO from node 9--Node 3 calculates the preferred parent and send a new DIO]. This trace then will be recorded as [Node 3 broadcast DIS--Node 3 receives DIOs (3 times)--Node 3 process received DIO--Node 3 send a new DIO]. Figure 1 illustrates an example of the results recorded from Algorithm 1 for node 3. As can be seen from the figure, the flow of the in and out control messages to node 3 is represented in CM [3] on the left, while the transition merge and relevant statistics are represented in AllTrans [3] on the right. The results of the Algorithm 1 are sets of states, transitions and corresponding statistic for each node. Algorithm 2 will merge those sets one by one to form an abstract of RPL operation. The results of the Algorithm 1 are sets of states, transitions and corresponding statistic for each node. Algorithm 2 will merge those sets one by one to form an abstract of RPL operation. Figure 1: Example of the results of Algorithm 1. ```
1:Input: \(\textbf{AllTrans}[k]\), \(\textbf{AllTrans}\textbf{Statistic}[k]\), \(k\) = 1,..., \(n\)
2:\(\textbf{FinalSpe}\) = \(\textbf{AllTrans}[1]\)
3:\(\textbf{FinalSpe}\) = \(\textbf{AllTrans}\textbf{Statistic}[1]\)
4:\(\textbf{for}\) = \(\textbf{1}\) to \(n\)do
5:\(\textbf{FinalSpe}\) = \(\textbf{Merge}\)(FinalSpe, \(\textbf{AllTrans}[k]\))
6:\(\textbf{FinalSpe}\) = \(\textbf{Merge}\)(FinalSpeStatistic, \(\textbf{AllTrans}\textbf{Statistic}[k]\))
7:endfor
```  
**Algorithm 2**Form the specification-based IDS for RPL  
The Merge function first compares the states that two Transitions have.