## 3 Proposed Security Framework for RPL-Based IoT Networks (SRF-IoT)
### General Concept  
In IoT networks, smart devices provide services to their peer connected devices. Evaluating the reliability of a device would enhance networks' security and performance. Bearing this in mind, trust is used in our proposed solution to form a secure network by avoiding malicious actors. According to [33], trust in wireless networks may be defined as a degree of belief to forecast a node's forthcoming actions, which depend on its previous experience and information gained from a device's behaviour. SRF-IoT uses the trust concept to evaluate the reliability of deployed nodes. Trust is utilised in this work to enhance the RPL routing protocol. Although some security mechanisms exist in RPL, attacks such as blackhole and rank attacks may occur in a real-world IoT network. Embedding trust in RPL will enable devices to learn their neighbours and choose the best parent based on this value. This knowledge is gained through IDS, which processes sniffed packets and sends various metrics to monitored smart devices. In the monitored network, IoT devices get the data from SRF-IDS, and based on some algorithms they calculate the trust value. More weight is applied on the current behaviour of a node than its history. This is to avoid cases where a malicious node has a high trust value initially, and then starts to attack others. Ranking and selecting neighbouring nodes based on their latest trust value helps to avoid malicious actors. Therefore, trust and IDS concepts are utilised as a method of defence to detect and avoid these attacks. A detailed description of the framework is discussed in Section 4. Trust value is calculated as the number of successfully forwarded packets between the node and its neighbours for a specific time period. As discussed in other trust systems [24, 28, 34], there are two types of trusts: direct and recommended trust. Direct trust is calculated by the node after monitoring its direct neighbour's packet forwarding behaviour [28]. In contrast, recommended trust can be seen as a recommendation from a third party node. Basically, recommended trust is the trust value given by a third node that is 2-hops away, and it recommends its direct neighbour to other nodes. However, recommended values cannot always be trusted, and a third-party node might provide wrong information. Therefore, only selected nodes can be used to provide nodes with trust recommendations. In our work, we use direct trust for securing RPL protocol. Each node computes the trust value of its direct neighbours based on the information received from an SRF-IDS detector. Thus, nodes do not waste energy on neighbour monitoring. The SRF-IDS is used as an information collector entity. The resulting trust value is used by each node to select the best parent. Devices with high trust value are selected as parents, and those with lower trust values are avoided. Nodes that fall below a trust threshold are blacklisted. The main goal is to secure the network by (i) routing packets through nodes with high trust scores, and (ii) avoiding malicious nodes or nodes with low trust scores. The proposed framework consists of four procedures: gathering information from SRF-IDS, calculating trust, monitoring trust, and identifying malicious nodes. Figure 1 presents a high-level architecture of the SRF-IoT scheme. On the left side, the external IDS, called SRF-IDS, is shown along with the internal components. SRF-IDS is responsible for packet sniffing, monitoring nodes' behaviour, and updating monitored nodes with trust metrics. The transfer of trust metrics from SRF-IDS to monitored nodes is done by transmitting special control packets. These three procedures belong to the Trust Monitoring (TM) module that is embedded into SRF-IDS detectors. Moreover, the SRF-IDS root has an embedded detection module for detecting attacks such as DIS flooding. A traditional firewall is also used to block external attackers. On the right side, the basic functionality of SRF-OF, which is embedded into monitored nodes, is represented.