# Detection and Mitigation of RPL Rank and Version Number Attacks in the Internet of Things: SRPL-RP
## 2 Literature Review
### RPL Rank Attack  
A rank attack in the RPL network topology exposes the child nodes that have a deeper rank in the network. Then, the malicious nodes can change the method, in which the neighbor nodes can process their DODAG Information Object (DIO) messages. The rank attack can disrupt the data packet's delivery path in the network topology. In a rank attack, the location of the parent node and neighbor nodes always attract the child nodes. Therefore, the malicious node advertises a fake rank node's location in the RPL control messages or a fake route across the root node to deceive close nodes and attract them to forward their packets through it. For example, the child node's deeper rank is reduced to be selected by the neighbor nodes as the parent node, to send data packets to the root node. Once the child node receives the data packets, then the child node drops the data packets. Hence, the child node is treated as a malicious node. The rank attack has several effects, such as (1) un-optimized route formulation, (2) un-recognized formulated loop, (3) the RPL network topology never utilized the optimized routing, (4) when the malicious nodes increase, there will be a decrease in the PDR and small modification of the end-to-end delay, and (5) there will be an increase in the DIO messages due to the rapid changes in the network topology. Consequently, the network constrained merits are influenced, such as the energy consumption, delay, packet delivery ratio, and control overhead [15]. Unauthorized access by attackers or third parties to data routing in the RPL networks can make the RPL security a severe problem that shall be considered [16]. The sub-sections will give details and classify the RPL rank attack countermeasures. RPL Rank Attack Countermeasures Classification  
Classification-Based RPL Rank Attack Modification Techniques  
The authors in [17] proposed and developed the Secure-RPL (SRPL) protocol. The malicious node(s) in the proposed protocol is blocked from better self-repositioning in the DODAG tree of the RPL network. The proposed protocol scans the number of times that the nodes' rank values increase by enabling a threshold function to reduce the impact of the attack in the network. The evaluation results of the network performance indicated that the proposed protocol was efficient in protecting the RPL network. To overcome the overhead that existed in [18], [PERSON] et al. [19] developed and proposed a Time-Based Trust-Aware RPL (SecTrust-RPL) to provide secure protection against rank attacks and Sybil attacks. This provides detection and isolation of the attacks with network performance optimization. Each node in the RPL network, in which its neighbor nodes have direct trust values and recommended trust values, computes a trustworthiness. Based on the evaluation results, the proposed protocol has better protection against rank attacks. Classification-Based IDS  
The authors in [20] designed a Specification-Based IDS. To detect attacks, this system uses Finite State Machine (FSM) transitions, and Monitoring Nodes (MN) are formed in the monitoring architecture. To detect a rank attack, the malicious nodes with lower ranks are scanned by the MN. The MN will suspect action changes of the valid rank and the fake rank of the malicious nodes. The information cross-checking of the MN will be started to detect the valid ranks. The study in [21] proposed a secure parent node selection scheme, in which, based on a threshold value, a legitimate node will be selected by the child nodes as their parent node. Every node in the RPL network decides the rank value that is advertised by the neighbor nodes based on the threshold between the maximum and average rank. If the rank value is too low, it will be selected as a parent node. The evaluation results of the scheme show that it is effective in decreasing the linking of the child nodes with the malicious nodes. [PERSON] et al. [22] designed an Authentication Rank and Routing Metric (ARM), which is a hybrid specification-based ID.