## 2 Characteristics of Low-Power and Lossy Networks (LLNs)  
The term LLN was first introduced by the Internet Engineering Task Force (IETF) group. LLNs typically consist of many sensor nodes interconnected by low-cost and low-data-rate wireless links designed explicitly for it, such as IEEE 802.15.4 [6] and low-power Wi-Fi [7]. Small sensor nodes often have limited central processing unit (CPU), memory, and power resources. These resource limitations create constraints on the (i) maximum code complexity in read-only memory (ROM) and flash, (ii) size of state and buffers in random access memory (RAM), (iii) amount of computation feasible in a period of time, i.e., processing capabilities, and (iv) available energy [8]. The IETF classifies constrained nodes into three classes based on their capabilities: Class 0 (C0), Class 1 (C1), and Class 2 (C2) [9]. C0 nodes are very constrained in memory and processing capabilities. They generally do not have the resources required to be secured against security attacks or to connect directly to the internet. Therefore, C0 nodes often participate in internet communication through gateways or servers. C1 nodes are constrained in code space and processing capabilities but are less constrained than C0 nodes. They have the resources required to communicate without the help of gateways or servers using a protocol stack specifically designed for constrained nodes, such as the Constrained Application Protocol (CoAP) [10] over the User Datagram Protocol (UDP) [11; 12]. C1 nodes can be fully integrated into an Internet Protocol (IP) network and support the security functions required on a network. However, memory, code space, and energy resources must be used wisely and efficiently. C2 nodes are the least constrained in terms of memory and processing capabilities. Unlike other classes, C2 nodes can consume less bandwidth and support lightweight and energy-efficient protocols. Table 1 shows the different classes of the constrained nodes, their data and code size capabilities, and some examples. Using constrained nodes to form a network often leads to constraints on the network itself. These constraints on the network can affect (i) routing reliability and (ii) network security. The reliability of routing is often compromised by constraints resulting in high packet loss and low delivery rates owing to Lossy channels and link fragmentation. It may also cause limitations on reaching some nodes over time owing to a lack of energy and topology fragmentation, as nodes may power off at any time. Therefore, LLNs usually exhibit unreliable and unstable links with high packet loss rates and short network lifetimes. Moreover, constraints on the nodes usually affect network security, making it challenging to secure LLNs using security measures available for wired and unlimited power networks [13]. This makes the task of protecting LLNs against security attacks very challenging, as nodes often do not possess the resources required to implement complex security techniques such as cryptography. The most relevant constraints that may directly limit the ability to secure LLNs are (i) low memory size, which requires a small code size and low code complexity, (ii) low power operation, (iii) low processing capabilities, and (iv) small bandwidth requirements. Given these constraints, security threats impose huge risks as they not only affect network security but may also drain the node resources that are trying to defend against them. Therefore, a security solution for LLNs should balance the trade-off between security and the available resources for the network to perform efficiently. One of the most common attacks in LLNs is the Packet Dropping Attack (PDA) [14; 15; 16; 17], in which a malicious node joins a network and intentionally drops packets instead of forwarding them. PDAs can be classified into two categories: (i) black-hole and (ii) grey-hole attacks.