###### Abstract  
Routing attacks are a major security issue for Internet of Things (IoT) networks utilising routing protocols, as malicious actors can overwhelm resource-constrained devices with denial-of-service (DoS) attacks, notably rank and blackhole attacks. In this work, we study the impact of the combination of rank and blackhole attacks in the IPv6 routing protocol for low-power and lossy (RPL) networks, and we propose a new security framework for RPL-based IoT networks (SRF-IoT). The framework includes a trust-based mechanism that detects and isolates malicious attackers with the help of an external intrusion detection system (IDS). Both SRF-IoT and IDS are implemented in the Contiki-NG operating system. Evaluation of the proposed framework is based on simulations using the Whitefield framework that combines both the Contiki-NG and the NS-3 simulator. Analysis of the simulations of the scenarios under active attacks showed the effectiveness of deploying SRF-IoT with 92.8% packet delivery ratio (PDR), a five-fold reduction in the number of packets dropped, and a three-fold decrease in the number of parent switches in comparison with the scenario without SRF-IoT. Moreover, the packet overhead introduced by SRF-IoT in attack scenarios is minimal at less than 2%. Obtained results suggest that the SRF-IoT framework is an efficient and promising solution that combines trust-based and IDS-based approaches to protect IoT networks against routing attacks. In addition, our solution works by deploying a watchdog mechanism on detector nodes only, leaving unaffected the operation of existing smart devices. RPL-lite security; RPL; SRF-IoT; SRF-OF; trust; intrusion detection system; blackhole attack; rank attack  
20222022022022022022022022022022022022022022022202220  
The routing protocol for low-power and lossy networks (RPL) [6] is a protocol designed for resource-constrained devices. It was proposed by the Internet Engineering Task Force (IETF) ROLL (routing over low power and lossy networks) working group [7]. Existing works show that RPL is vulnerable to many attacks, and countermeasures are proposed by several researchers [8, 9]. The RPL-based attacks focus on exploiting the limitations of power and the lossy environment in which IoT devices operate. Some examples are selective forwarding, blackhole, rank, and version attacks [10, 11]. Usually, an IDS is deployed as a detection mechanism in the network. In this paper, the impact of combined rank and blackhole attacks is studied by implementing them in Contiki-NG and simulating them in the Whitefield framework. Malicious devices attack the RPL-based network by advertising false rank and dropping packets of child nodes. As a result, the network has poor performance and devices exhaust their energy. A novel security framework for RPL-based IoT networks (SRF-IoT) is also designed and proposed to mitigate RPL-based routing attacks. IoT devices that utilise RPL protocol use an objective function (OF) to help them choose the best parent that provides a route to sink/border router (BR). SRF-IoT provides a trust-based OF, called SRF-OF, so that nodes choose the most trusted parent and avoid malicious actors in a network. Moreover, an external IDS, called SRF-IDS, aims to provide smart devices with trust metrics. It consists of an SRF-IDS root that plays the role of BR and SRF-IDS detectors that have promiscuous mode enabled for capturing network packets. Trust metrics are essential for the operation of the trust-based mechanism during parent selection. We combine the trust-based OF and IDS methods to detect attackers with the help of nodes. Specifically, each node computes the trust value of its direct neighbours based on the information collected from an SRF-IDS detector. In this way, do not waste power for network monitoring. The best parent of each node is selected based on the calculated trust value. Devices with high trust value are chosen as parents, whereas those with lower trust values are avoided.