## 1 Introduction  
The Internet of Things (IoT) encompasses a diverse range of devices, including sensors, controllers, and actuators, that positively affect almost every aspect of life. The primary focus of traditional IoT is enabling connectivity and data exchange between devices to enhance efficiency, automation, and convenience in various applications. Although estimates for the number of connected devices vary, there is a consensus that the quantity and impact of these devices will be significant. Ericsson predicts that by the end of 2025, the number of connected devices will exceed 50 billion [1, 2]. Recent years have experienced a paradigm shift from traditional IoT to Green IoT systems [3]. The key goal of Green IoT is to reduce energy consumption, minimize waste, and optimize the use of resources to have a lower impact on environment. However, implementing Green IoT solutions may be challenging due to limitations in resources and infrastructure. Security has become a major concern in Green IoT systems due to the lack of standardization and centralized control [4]. This deficiency in security could lead to a global security threat through continuous interaction and communication among compromised devices [5]. Green IoT systems are often categorized as Low Power and Lossy Networks (LLNs). These networks consist of devices with limited storage and battery resources, making communication among them highly susceptible to disruption [6]. Despite the implementation and improvement of various routing protocols, such as Routing Information Protocol (RIP), Open Shortest Path First (OSPF), and Interior Gateway Routing Protocol (IGRP), current protocols prove insufficient in tackling the crucial routing and security challenges encountered by LLNs. These challenges include packet loss, optimal path selection, and the need to concurrently address security vulnerabilities arising from compromised routing paths. Consequently, the existing protocols are not suitable routing options for most LLNs. To overcome this challenge, the Internet Engineering Task Force (IETF) recommends the Routing Protocol for Low-Power and Lossy Networks (RPL) routing protocol for LLNs, which efficiently integrates with resource-constrained devices [7]. Unlike other routing protocols, RPL searches for routes when needed rather than maintaining routing tables [6]. RPL is a proactive protocol based on a distance vector, utilizing a Destination-Oriented Directed Acyclic Graph (DODAG) topology, where all nodes connect to a single root node, known as a sink [8]. During DODAG construction, each node selects a preferred parent node based on performance metrics, ultimately serving as a gateway for leaf nodes. While RPL offers improved efficiency in terms of energy consumption and optimized data transmission, the security of LLNs is a major concern due to resource-constrained devices and the open nature of the protocol. Despite having Quality of Service (QoS) features, a secure operation mode is not enabled in RPL by default, making it vulnerable to various routing attacks [5], such as black hole, rank, wormhole, sybil, and hello flooding. These attacks have been discussed comprehensively in the literature [9]. Among these attacks, the black hole attack is one of the most harmful attacks in RPL, potentially leading to catastrophic consequences for any LLN network, such as unauthorized data access or illicit network manipulation. The black hole attack involves a malicious node falsely claiming the shortest path to all other network nodes, leading to the misdirection or dropping of transmitted data. Consequently, the impact of this attack may become more severe when all subsequent messages are barred from reaching the intended destination, resulting in an increased packet loss ratio and end-to-end delay in the network, thereby degrading the overall performance of the network. Furthermore, when multiple malicious nodes collaborate, the severity level increases significantly, a phenomenon known as a colluding black hole attack [6].