# Detection and Mitigation of RPL Rank and Version Number Attacks in the Internet of Things: SRPL-RP
## The Proposed Protocol
### SRPL-RP Description  
This section depicts the details of the proposed protocol that detects, mitigates, and isolates the malicious nodes of both rank attacks and version number attacks. When a normal node receives a DIO control message, the protocol starts, and it consists of five phases:  
Phase One: A timestamp is used to monitor and track the time that the DIO control messages are exchanged using the RPL trickle timer for synchronization. The difference in time between each DIO message has to not exceed a threshold value (which is calculated based on certain equations [31; 35]). The time difference is registered as a timestamp and transmitted with the DIO message; thus, this helpsin preventing malicious nodes. This timestamp is also used to determine the freshness of the DIO message throughout the process. If the time of the DIO message is above the threshold value, the DIO message will be discarded because it is indicated as malicious activity. In addition, if the time of the DIO message is less than the threshold value, then phase two is started. Phase Two: If the DIO message has a lower value than the threshold value, the legitimacy of the sender node is verified by the receiver node by checking its ID. If it is invalid, the sender node will be discarded. If it is valid, the sender node will be added to a monitoring table (that is formulated during the DODAG construction), which captures information about the node, like the node ID, node rank, DIO message information, version number, etc. Hence, by using the monitoring table, the legitimacy of the nodes is verified, during which every valid node will be added to the monitoring table. Thus, when the receiver node checks the sender's node ID, it will refer to this table to check if the sender's ID exists in the monitoring table or not. Phase Three: We combine the research work [13; 14] and add new features to them, which are a monitoring table, blacklist table, and an alert function to detect, mitigate, and isolate both types of attack. Table 1 compares our work and the changes added to the work of [13; 14]. If the DIO message of the sender node does not have a greater version number than the version number of the root node (assuming that the root node cannot be compromised), then it will be a case of rank attack detection and mitigation. If the DIO message of the sender node has a version number greater than the version number of the root node, then it will be the case of version number attack detection and mitigation. Phase Four: Figure 1 shows the conditions for rank attack detection, mitigation, and isolation, which are added to the research [13]. If the Node Current Rank (NCR) is greater than the Node Parent Rank (NPR), then it is considered to be a malicious node. If the DIO control message of the malicious node is not discarded and is falsely verified as a legitimate node in the monitoring table for any reason, then the monitoring table will be updated to remove all information of the malicious node to restrict it from being a parent node. The malicious node will be added to the blacklist table (which is formulated during the DODAG construction), which captures all information of the malicious nodes to mitigate the effect of the malicious node from the network. The blacklist table contains the IDs of all malicious nodes that should not join the RPL network topology again because they were previously detected as malicious nodes. Then, an alert message will be sent to all the nodes in the network to notify them not to join this node in the future; thus, the malicious node is isolated from the network. On the other hand, if the NCR is lower than the NPR, then the rank rule of the current node is compared with the rank rule of the previous rank. If the NCR is greater than the Node Previous Rank (NPVR), then it is considered a mobile node in the RPL network. When a node reaches its final destination, it does not change its rank, but it is stabilized concerning its neighboring nodes.