## 2 Background and Literature Review
### Trust and Protocol-Based Mitigation Methods  
Several studies exist in the literature implementing trust-based IDS or RPL protocol-based mitigation techniques. The most important of these studies are reviewed below. A metric-based RPL trustworthiness scheme (MRTS) for addressing RPL attacks was introduced in [24]. In this scheme, every node evaluated the behaviour of its neighbouring nodes based on indirect suggestions and direct observations. Nodes then needed to calculate the extended RPL node trustworthiness (ERNT) for their neighbours. The node with higher trust value, more energy, and better link quality was selected as the preferred parent. MRTS used the ERNT as a routing metric to form the network. Results showed that it helped nodes to avoid malicious nodes. In addition, it had low energy consumption and high packet delivery ratio. However, nodes need to be in promiscuous mode to observe neighbour's behaviour. A secure-RPL (SRPL) protocol was presented in [25]. The aim of the proposed solution was to prevent malicious nodes from changing their rank multiple times, creating fake topologies. SRPL introduced a threshold to limit the number of rank changes. A hash chain authentication technique was also utilised to authenticate nodes when moving in the DODAG and modifying rank values. The authors suggested that SRPL can be used to detect other RPL attacks such as sinkhole, blackhole, selective forwarding attacks, etc. For these attacks, they recommended deploying anomaly-based algorithms to improve detection rate. Simulation results showed that SRPL successfully protected the network from rank attacks. However, there was an increase in RPL control messages. A secure RPL routing protocol (SRPL-RP) for identifying and isolating rank and version attacks was proposed in [26]. The authors extended the work in [21; 27] in which mitigation methods identified both rank and version attacks. For rank detection, if a node's rank was greater than node's parent rank, it was considered malicious. It was then removed from the monitoring table as a legitimate node and added in the blacklist table. For version attack, a similar threshold-based approach was followed. SRPL-RP was implemented and simulated in Cooja with ContikiOS using various topologies. SRPL-RP showed better detection and mitigation accuracy in comparison with other solutions. [PERSON] et al. [28] implemented the SecTrust-RPL protocol to overcome RPL routing attacks such as rank and sybil attacks. The suggested secure framework enhanced RPL protocol by using a trust-based system to detect attackers. The concept was to have each node in the RPL network to be in promiscuous mode and sniff neighbour packets. They then computed direct and recommended trust values for each of its neighbours. Direct trust was calculated based on the packet forwarding behaviour of the neighbour of the node. Recommended trust was given by another node, and it was an estimation of how reliable and trustful a node is that was located at 2-hops or more. Evaluation results showed that their solution protected against rank and sybil attacks, and it was more reliable and consumed less energy than standard RPL protocol. [PERSON] et al. proposed a secure parent node selection scheme in [29]. It aimed to allow nodes to choose legitimate nodes only as parents and avoid attackers. In this scheme, every node could decide if a node's rank is legitimate or not based on the average obtained ranks from neighbouring nodes. Therefore, nodes select parents that do not have too low rank and avoid malicious nodes. Simulation results showed that the proposed scheme avoided attackers, and the network operated better than standard RPL protocol. Generally, many studies proposed enhancements to secure RPL protocol and detect attackers. Yet, most trust-based methods require devices to be in promiscuous mode and monitor the network. This results in a waste of energy, as devices are always active and sniff network traffic.