# Detection and Mitigation of RPL Rank and Version Number Attacks in the Internet of Things: SRPL-RP
## 2 Literature Review
### RPL Version Number Attack  
The version number attack in the RPL network topology can illegitimately increment the root node's DODAG version number by the malicious node when the DIO message is forwarded to its neighbor nodes to damage the network performance. When the neighbor nodes receive the DIO message that contains the incremented version number, the DODAG tree begins a new formulation, and the trickle timer is reset [23]. After that, the neighbor nodes will transmit the frequently updated version of the DIO messages to all nodes [24]. The version number attack has significant impacts, such as (1) the operation of the network is damaged; (2) the network control overhead is increased 18 times, which is unnecessary; (3) there will be routing loops in the data routing; (4) the network energy consumption is increased; and (5) the communication channels of the nodes have availability issues. In addition, packet delivery is lost, and the network delay is doubled [25]. RPL Version Number Attack Countermeasures Classification  
The rank attacks countermeasures are classified into two categories, which are (1) modification techniques that can adjust or add the RPL standards, and can detect a limited number of attacks, and (2) Intrusion Detection Systems (IDS) that require nodes collaboration, and can detect multiple types of attacks [17]. Classification Based RPL Version Number Attack Modification Techniques  
The study in [26] proposed and implemented a rank and version number authentication security measure scheme based on one-way hash chains called Version Number and Rank Authentication (VeRA). This provides security against internal attacks that broadcast an incremented version number or a higher rank in the DIO messages. The version number is checked for whether it was updated by the root node or not and whether the rank value of the parent node is illegitimately increasing or not. The evaluation results show the overhead time of the scheme. [PERSON] et al. [27] proposed and designed a Trust Anchor Interconnection Loop (TRAIL) scheme to overcome the obstacles in the former study [26] by analyzing the incompleteness of the rank authentication message. The sink node works as a trust anchor, and every node in the RPL network validates each rank value and drops invalid rank values. The studies above that are used to detect the version number attacks can suffer from increased overheads. Therefore, to safeguard against the version number attacks, the authors in [28] proposed and developed a cooperative, distributed verification mechanism. The mechanism depends on checking the step phase and verification phase. The cooperative verification procedure works by allowing the receiving nodes to verify the neighbor node's identity to determine whether the neighbor nodes have malicious behavior or not. The evaluation results showed that the control overhead was decreased and the mechanism was reliable. To mitigate the effects of the version number attacks, the researchers in [29] proposed and designed a lightweight approach. Every node in the RPL network executes independent algorithms, in which the state of the nodes is not stored. The evaluation results indicated that the proposed scheme was lightweight and compatible with constrained devices. The research in [14] proposed and implemented lightweight techniques for version number attacks to consider the version number legitimate update. The elimination technique eliminates the malicious update influences of the version number. A trust mechanism is used by the shield technique, in which a change to the version number is required if the majority of the neighbor nodes that are close to the root node have a better rank. The evaluation results indicate that it is possible to mitigate the version number attack using these techniques. Classification-Based IDS  
[PERSON] et al. [30] proposed and developed a mechanism to detect and identify the malicious nodes that have illegitimately incremented version numbers based on the distributed monitoring architecture.