###### Abstract
The Whitefield simulator is a new framework that is used for SRF-IoT evaluation. Additionally, it provides more realistic results than the Cooja simulator, Contiki-NG's embedded simulator, and allows deploying large scale scenarios with minimum effort. One of the novelties of our approach is that a successful combination of trust-based and IDS-based methods is achieved. Most studies propose mitigation schemes for RPL routing attacks using either the former or the latter method. Combining the two approaches enhances the detection performance and allows easier detection of attackers. Furthermore, it is straightforward to add mitigation methods for additional RPL attacks. Another benefit is that nodes' energy consumption is minimised. This is because nodes operate normally without any watchdog mechanism as in other trust-based solutions. SRF-IDS, made of an external set of detectors, monitors the network and provides the nodes with trust metrics. Another novelty of our approach is the deployment of SRF-IDS along with the normal network. In order to monitor the neighbouring network without interruptions, SRF-IDS is deployed in a different RPL instance than the normal network. SRF-IDS is an improved version of the prototype proposed in our earlier work [12]. It consists of a centralised router that hosts detection module and acts as a firewall, whereas decentralised detectors are responsible for traffic monitoring, and local detection. Alerting monitored nodes with trust metrics is also the task of SRF-IDS detectors. RPL protocol was altered to allow communication between SRF-IDS detectors and monitored devices. The specification of the RPL protocol should be modified to allow the operation of SRF-IDS with other systems. The key contributions of this paper are as follows:  
* In our previous work [12], an initial IDS prototype was presented. SRF-IDS, an enhanced threshold-based IDS, is developed and deployed in this paper. It uses an overlay approach to provide a separate mechanism to monitor devices and help neighbouring nodes isolate malicious actors. * A novel security framework for RPL-based IoT networks (SRF-IoT) has been designed and proposed to avoid routing attacks, including a combination of rank and blackhole attacks. The framework consists of the threshold-based IDS, called SRF-IDS, and a trust-based OF, called SRF-OF. It has been implemented in the RPL protocol and evaluated in various scenarios under routing attacks. * Experimental results demonstrate that the SRF-IoT framework can effectively detect and help nodes to avoid malicious nodes. Our proposed framework showed 92.8% PDR, an almost five times reduction in the number of packets dropped, and a threefold decrease in the number of parent switches in scenarios with active blackhole and rank attacks. A new simulator, called Whitefield framework, which combines the NS-3 simulator with the Contiki-NG operating system, is used for evaluating the SRF-IoT framework. To our knowledge, this is the first work in the literature in which the Whitefield framework is used as the main simulation tool. The rest of the paper is organized as follows. In Section 2, we provide the required background information, including an overview of the RPL protocol, attacks against it, and IDS-based, trust-based, and protocol-based mitigation methods suggested for various RPL attacks. In Section 3, we describe our proposed SRF-IoT framework, including the general operation and the network topology of the system. In Section 4, the various processes and the design of the SRF-IoT framework is described in detail, including the improved external IDS, the procedure of gathering, calculating, monitoring, and updating trust metrics from the IDS, and the detection mechanism. In Section 5, we describe the algorithms and implementation details of the SRF-IoT framework, including the communication module and the development of SRF-OF and trust in RPL-lite, as well as the studied attacks in Contiki-NG, namely the rank and blackhole attacks.