# Multi-Mobile Agent Trust Framework for Mitigating Internal Attacks and Augmenting RPL Security
###### Abstract  
Recently, the Internet of Things (IoT) has emerged as an important way to connect diverse physical devices to the internet. The IoT paves the way for a slew of new cutting-edge applications. Despite the prospective benefits and many security solutions offered in the literature, the security of IoT networks remains a critical concern, considering the massive amount of data generated and transmitted. The resource-constrained, mobile, and heterogeneous nature of the IoT makes it increasingly challenging to preserve security in routing protocols, such as the routing protocol for low-power and lossy networks (RPL). RPL does not offer good protection against routing attacks, such as rank, Sybil, and sinkhole attacks. Therefore, to augment the security of RPL, this article proposes the energy-efficient multi-mobile agent-based trust framework for RPL (MMTM-RPL). The goal of MMTM-RPL is to mitigate internal attacks in IoT-based wireless sensor networks using fog layer capabilities. MMTM-RPL mitigates rank, Sybil, and sinkhole attacks while minimizing energy and message overheads by 25-30% due to the use of mobile agents and dynamic itineraries. MMTM-RPL enhances the security of RPL and improves network lifetime (by 25-30% or more) and the detection rate (by 10% or more) compared to state-of-the-art approaches, namely, DCTM-RPL, RBAM-IoT, RPL-MRC, and DSH-RPL. Internet of Things; RPL; rank attack; Sybil attack; sinkhole attack; trust; mobile agent 20  
resource-scarce IoT devices. They help sense the surroundings, process the data sensed, and communicate wirelessly, offering a significant factor in PRESTO-emergent IoT applications. Conventionally, LLNs use a standard routing protocol known as the routing protocol for LLNs (RPL). However, this protocol was not initially intended to safeguard systems against cyberattacks. Its security features are optional to deploy, since they can significantly reduce the effectiveness of resource-constrained devices. Hence, the constrained resources, openness, and distributed nature of such networks makes them vulnerable to many cyber- and routing attacks [5; 6]. Normally, in a routing attack, such as rank, Sybil, blackhole, or sinkhole, a node exhibits abnormal behavior, such as selective forwarding or message tampering [7; 8]. Sinkhole and Sybil attacks are the most damaging, since they can impede and prevent connections between network devices. In a sinkhole attack, a malicious node (i.e., an IoT device) will claim to be the perfect node for routing data to a target node. Thus, it presents false knowledge [9]. The node will illegitimately modify or drop traffic after it has obtained it. For instance, an attacker in RPL can exploit the ranking method by using misleading advertisements to advertise itself as a chosen routing node. The adversary promotes itself as being part of the best path and deceives other nodes into sending data via it. In this way, the adversary can initiate other network attacks and compromise network performance and lifetime. Similarly, a Sybil attack can reduce network lifetime by creating multiple identities and overwhelming the network with unwanted traffic. Therefore, this study assesses key internal attacks, particularly sinkhole and Sybil attacks, to create stable routing for IoT-based LLNs. Furthermore, the latest security regulations (spam detection, data encryption, identity-authenticated key agreement, and digital signing) are inadequate for fixing IoT security problems [10; 11]. These methods use considerable IoT resources and coercely impact device performance. Moreover, the cryptographic systems used to defend against external threats are ineffective when nodes are authenticated internally. Given these problems with RPL, trust-based security is highly recommended for mitigating internal attacks. Trust-based security can be pivotal in monitoring the forwarding behavior of nodes [12]. It can help in detecting malicious entities in a network to ensure secure and uninterrupted communications.