# Rank and Wormhole Attack Detection Model for RPL-Based Internet of Things Using Machine Learning
## 3 Methodology
### Network Model Setup, Simulation, and Network Scenarios for Data Collection  
To collect the required data, the RPL-based IoT network is simulated depending on the type and amount of data needed. In this research study, we need benign network traffic data, protocol-specific attack data, and SN-inherited attack data. To experiment with generating and acquiring these types of data, we have used the Cooja network simulator which runs on the Contiki 3.0 operating system. This simulator supports RPL-based IoT network simulation inherently and allows the emulation of actual sensor node hardware with a variety of node types represented as motes during the simulation. The simulator is Java-based with foundations in C language [25]. For our network model simulation, we have used the latest stable release, Contiki 3.0 on an Oracle virtual machine called VirtualBox [26] with 8 GB of RAM and 60 GB of hard disk for raw data collection from different network models and scenarios. Each node emulates a sky mote and the benign network was simulated as soon as initiated. The two attack scenarios were simulated after the network achieves a certain level of stability. This step was performed to observe the maximum effect of the attack on the network and its resources. Table 2 presents the data generated from different network models and simulation scenarios. In the next sub-section, the various network models are discussed which were implemented for gathering the desired data.  
Simulation of Benign Network Models, Protocol-Specific Attack Models, and SN-Inherited Attack Models  
In this paper, we have proposed to address protocol-specific and SN-inherited attack types. Therefore, three network models are developed inclusive of the benign model to collect the normal network traffic as a benchmark followed by attack traffic generation and collection. The algorithms for protocol-specific (RA) attacks and SN-inherited (WHA) attacks are presented in Algorithm 1 and Algorithm 2, respectively. The attack scenarios are illustrated in Figures 2 and 3.  
Figure 1: Conceptual design and architecture of the proposed model.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multicolumn{1}{c}{**Network Models for**} & \multicolumn{2}{c}{**Scenarios**} & \multicolumn{1}{c}{**Dataset**} & **Total** \\ \cline{2-5}
**Simulation** & **No. of Nodes** & **Node State** & & \\ \hline \multirow{4}{*}{**Benign network model**} & 1 st case: 20 nodes; 1 sink node, & \multirow{4}{*}{1 st case: static 2 nd case: 50 nodes; 1 sink node, 49 sender nodes, all benign} & 1 st case: static 2 nd case: 7512 & 13,762 \\  & 2 nd case: 50 nodes; 1 sink node, 49 sender nodes, all benign} & & \\ \hline \multirow{4}{*}{**Protocol-specific attack**} & 1 st case: 20 nodes; 1 attacker node, & \multirow{4}{*}{1 st case: static 1 st case: 7732} & \multirow{4}{*}{11,189} \\  & 19 benign nodes with 1 sink node & & \\
**network model (rank attack)** & 2 nd case: 50 nodes; 2 attacker nodes, & \multirow{4}{*}{2 nd case: mobile} & 2 nd case: 3457 & \\  & 48 benign nodes with 1 sink node & & \\ \hline \multirow{4}{*}{**SN-inherited attack network**} & 1 st case: 20 nodes; 2 attacker nodes, & \multirow{4}{*}{1 st case: static 2 nd case: 50 nodes; 2 nd case: mobile} & 6111 \\  & 18 benign nodes with 1 sink node & & \\
**model (wormhole attack)** & 2 nd case: 50 nodes; 2 attacker nodes, & \multirow{4}{*}{2 nd case: mobile} & 2 nd case: 3457 & Total static: 13,326 \\ \cline{1-1} \cline{3-3} \cline{5-6}  & 48 benign nodes with 1 sink node & & \\ \hline \hline \end{tabular}
\end{table}
Table 2: The datasets from different network models and scenarios.  
Figure 3: SN-inherited attack simulation in RPL-based IoT network simulated in Cooja.  
Figure 2: Protocol-specific attack simulation in RPL-based IoT networks simulated in Cooja. The attacker is located at position 10 in the left-hand side network, while two attackers are located at positions 19 and 20 in the right-hand side network.