## 1 Introduction  
A rapidly growing number of wireless sensors and devices (later nodes), and hybrid networks are leading the emergence of Internet-of-Things (IoT) and its applications, where a myriad of multiscale nodes are seamlessly blended and communicate with each other [1]. It has been predicted that 11 billion wirelessly connected nodes will be available for IoT applications in 2018, a 33% increase from 2017, and will reach 20.4 billion by 2020 [2]. Economic growth of IoT-based services and applications is also said to be considerable for businesses. It is probable that the whole annual economic impact caused by IoT will be in the range of $2.7-6.2 trillion by 2025 [3]. With the prevalence of WiFi and 4G LTE, cloud computing, social networking, and the recent technological advances in embedded devices and sensor networks, we envision a future in which wireless IP-enabled smart nodes under IoT will enhance data accessibility and availability, and lead to the further improvement of our lives. As a major part of IoT, low power and lossy networks (LLNs) play an essential role in the realization of ubiquitous computing and communication, where a set of resource-constrained nodes in terms of communication, computation, memory, and energy communicates among themselves directly or indirectly via lossy links. With the increasing demand of sharing information and knowledge and coordinating decisions, the Internet Engineering Task Force (IETF) Working Group has proposed a multicast protocol for LLNs, also referred to as MPL [4], as the multicast communication standard. However, MPL-based LLNs are unquestionably vulnerable to various Denial-of-Service attacks [5] because of the inherent shared wireless medium and the lack of physical protection and security requirements of network protocol. It has been noted that DoS attacks primarily target service availability to diminish the network capability by disrupting network protocol or interfering with any on-the-fly communication, rather than subverting the service itself. To address these issues, the MPL standard [4] makes the recommendation to employ the use of link-layer security mechanisms (e.g., IEEE 802.15.4 AES-128 [6] and Cisco's CG-Mesh [7]) to prevent an outside attacker who has no access to cryptographic materials from injecting spoof messages. However, the link-layer security mechanisms are incapable of countering an inside attacker who can capture and compromise a legitimate node, gain access to all stored information (e.g., public and private keys), and reprogram it to behave maliciously [8]. The current MPL implementations often do not deploy extra security operations that can significantly consume computing power and affect the performance of resource-constrained nodes [5; 9; 10]. In addition, a security threat analysis of LLNs presented in [11] is limited to discussing only well-known attacks with fundamental countermeasures. Thus, MPL-based LLNs are open to new attack wherein a malicious node can easily multicast a series of spoof data messages to disrupt routing protocol and interfere with on-going communications. In light of the above, we investigate a suppression attack and propose a heuristic-based detection scheme, called HED, to efficiently mitigate the suppression attack in MPL-based LLNs. In the suppression attack, a malicious node multicasts a series of spoof data messages with continuous sequence numbers to prevent legitimate nodes from accepting valid data messages, and cause them to delete their cached data messages as well. Although the countering of jamming attacks and its variants have been extensively studied [12], the suppression attack and its countermeasure in MPL-based LLNs are under-explored and remain in their infancy. Our major contributions are summarized in the following:  
* We significantly extend our previous work [13], and analyze the suppression attack with a preliminary result in MPL-based LLNs. This is the first in-depth work that investigates the performance impact of suppression attack in MPL-based LLNs.