## 5 Routing Attack Model  
This section provides a brief discussion of the basic network characteristics and assumptions upon which this study is based. It is assumed that an RPL network always has a single sink node and multiple non-sink RPL nodes. All the nodes run an RPL implementation as specified by the RPL standard in RFC 6550 [10]. The sink node is the node that initiates the DODAG in a storing mode. It is also assumed that the sink node has no exposure to any form of routing attack.  
One or more of the non-sink nodes act as attacking nodes to perform certain attacks during RPL attack scenarios. An attack can be initiated by a single node in the network joining as a legitimate one and establishing direct communications with the legitimate neighbor nodes. In addition, multiple differently positioned nodes can initiate the same attack either independently or in a cooperative manner. It is also possible that these attacking nodes simultaneously perform different types of routing attacks such as the VN and rank attacks.  
The assumption was made that each node is a stationary small-sized device that is resource-limited and powered by batteries. Varying-scale deployment of the devices is considered following different positioning strategies such as uniform and random positioning. Wireless connectivity among the nodes is assumed in multihop topological setups. Different types of real IoT devices exist in the market that incorporate an RPL implementation in  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Ref.** & \begin{tabular}{c} **Large-** \\ **Scale** \\ **Setups** \\ \end{tabular} & \begin{tabular}{c} **Composite-** \\ **Attack** \\ **Scenarios** \\ \end{tabular} & \begin{tabular}{c} **Hybrid-** \\ **Attack** \\ **Scenarios** \\ \end{tabular} & \begin{tabular}{c} **Multiple** \\ **Types of** \\ **Attacks** \\ **Attacks** \\ \end{tabular} & \
\begin{tabular}{c} **Varying** \\ **Attack** \\ **Positions** \\ \end{tabular} &
\begin{tabular}{c} **Extensive** \\ **Evaluation** \\ **Metrics** \\ \end{tabular} \\ \hline  
ur\) & \(\sur\) & \(\times\) & \(\sur\) & \(\times\) & \(\times\) \\ \hline This Study & \(\sur\) & \(\sur\) & \(\sur\) & \(\sur\) & \(\sur\) & \(\sur\) \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison of related work and the current study.  
their networking stacks. Among these are Tmote [52], Zolertia Z1 [53], TelosB [54], and MicaZ [55].  
The deployment of the nodes is assumed to address a specific IoT application. The application-specific IoT data are frequently collected in a periodical manner. The transmission of the IoT data is performed at a predefined time interval over UDP data packets. This is carried out using the established upward routing paths in RPL networks. The sink node acts as an Internet gateway and serves as a central point via which data forwarding to/from the Internet is carried out.  
RPL networks initially run under no attack and reach a certain level of topological stability. The initiation of the attacks is assumed after a certain time by which the RPL network topology comes to convergence. The target of the attacker is to cause critical disruption to network stability by establishing unnecessary communications and flooding the network with a high volume of control traffic. The main objective is to incur a considerable degradation of the overall network performance and a noticeable drop in network lifetime.