# Securing IoT: Mitigating Sybil Flood Attacks with Bloom Filters and Hash Chains
## 5 Performance Evaluation  
To evaluate the effectiveness of our proposed mechanism against flooding attacks, A multistage simulation scenario replicating a Denial-of-Service (DoS) attack was designed. In the first stage, a single controlled attacker node launches a flooding attack against a designated target node. In the second stage, the attack is further escalated by introducing two attacker nodes,. In both scenarios, the message transmission frequency is progressively increased. Our defence mechanism leverages the hash chain root to populate a Bloom filter implemented on the target node. The root hash is then included within the legitimate message payload (see Figure 4). This approach enables efficient message filtering at the target node, allowing only messages with a valid hash (indicating pre-authenticated sources) or potential false positives to pass through the filter. To model the possibility of false positives in the Bloom filter, random numbers were injected into the attacker node's message payload prior to implementation of post-filter verification, as shown in Figure 5.  
This simulation serves two primary objectives. First, it assesses the target node's resilience against a DoS attack under increasing message loads. Second, it demonstrates the efficacy of the Bloom filter in blocking messages that do not originate from authenticated sources, thereby mitigating the impact of flood attacks. The Contiki operating system, a popular choice for resource-constrained wireless sensor networks (WSNs) programmed in C, served as the development platform for our proposed mechanism [26]. A 32-bit Bloom  
Figure 4: Example of note output showing legitimate traffic. Figure 3: Note output showing that more than three packets have failed mitigation. filter was implemented and integrated with the SHA-256 hashing library directly on the target node. This approach facilitated efficient execution of the proposed mechanism within the resource-constrained environment of the sensor network. To simulate the resource limitations and communication characteristics of a low-power sensor network, the Cooja simulator was employed. The Cooja simulator was chosen due to its extensive support for various hardware platforms commonly used in WSN deployments, including TelosB, Z1, and Tmote Sky nodes. Additionally, Cooja offers a visual representation of the simulated network, which aids in understanding network behavior. Furthermore, it allows node output to be displayed, facilitating analysis of sensor data and communication patterns. Figures 6 and 7 depict the simulated network topology; Node 1 represents the Link Border Router (LBR), which is responsible for routing traffic between the sensor network and the external network, Node 2 serves as the target node under attack, and Nodes 3 and 4 represent malicious attacker nodes attempting to disrupt network operations through a flood attack. The impact of the proposed solution was evaluated using the Contiki operating system's energest module [27]. This module provides detailed power consumption data by tracking the active running time (in Contiki ticks) of the four key components through hardware timers: CPU active time (CPU), CPU idle time (LPM), radio transmission time (TX), and radio listening time (RX). By monitoring the duration of these states throughout the simulation, the power consumption for each component can be calculated using the formula presented in Equation (6). This allowed us to assess the overall power consumption of the target node under varying network conditions, such as the when the attack intensities in frequency both with and without the proposed mitigation techniques in place. \[EnergyConsumed=\frac{Runtime\times Amps\times Volts}{Tickpersecond} \tag{6}\]  
Figure 5: Example of note output showing false positive. Figure 6: Scenario 1 DODAG visualisation: One attacker. Table 1 presents the current and voltage readings for the Tmote Sky nodes, along with the Rtimer counter values and various other simulation parameters.