# Identifying Misbehaving Greedy Nodes in IoT Networks
## 1 Introduction  
The Internet of Things is considered as an industrial revolution in the world of computing. Indeed, this technology interconnects a huge number of intelligent physical devices [1]. The intelligence of these devices lies in the fact that they are endowed with the capacity for learning and reasoning. In addition, they operate autonomously, since they do not require any human intervention [2]. The emergence of the Internet of Things has greatly contributed to the development of several fields. Its application extends from a simple smartphone, to smartphones, and smartcities [1]. The use of WSN (Wireless Sensor Network) is also widely used in the context of IoT, since the sensors share data that they have previously detected, collected, and processed. For this purpose, the IoT uses the IEEE 802.15.4 communication infrastructure specifying the PHYsical (PHY) and Medium Access Control (MAC) layers in LR-WPAN (Law Rate Personal Area Network) [3]. Despite the many advantages offered by IoT, which have allowed to record progress in various fields, this technology remains vulnerable to cyber attacks. The IoT devices constraints in terms of resource restrictions (low memory, battery, computing and storage capacity, etc.) make them particularly vulnerable [4], and constitute another challenge when it comes to the development of optimized security tools and methods. The availability of network resources, andthat the network will be saturated, and the sensors cannot transmit their collected data to the server. This can lead to a disaster, because this collected information is important for managing the water dam and it will not tolerate any delay in transmission. The DoS attack is considered the ultimate goal of the attackers. In order to achieve this goal, hackers use various methods. In IoT networks, there are several ways to carry out this type of attack. We cite, as an example, the sleep deprivation attack [4] and the jamming [7], flooding [4], or greedy behaviour attacks [8]. The first method is performed by an attacker who targets a specific sensor, which is the PAN coordinator most of time, because he has the most important role in the network. This attacker will deprive his target of sleep mode and force him to remain in reception mode, since he will send him a large number of messages [4], or ask him to perform an important calculation. This attack requires a powerful machine that has no resource constraints, which is not the case of sensors. The second type of attack is the jamming attack, which is an indoor attack performed by a sensor on the network. There are four types of jammer nodes. The first one is the constant jammer which continuously emits a radio signal on the transmit channel. The second is the deceptive jammer, which constantly injects packets into the channel. The third is the random jammer, which sends out packets in random time intervals [7]. Finally, the fourth is the reactive jammer which listens to the channel continuously and sends packets when the channel is detected busy, in other words, when another node is sending its packets [9]. The flooding attack uses one or various nodes to saturate the network, by sending regular messages to the target [4]. These attacks are interesting, but require a powerful battery, which is not the case of sensors. Finally, the last type of attack is the greedy behaviour attack, which uses a sensor called a greedy node or selfish node. This attack is both an aggressive and a smart DoS attack [8]. Its intelligence lies in the fact that the greedy node will saturate the network without being detectable, because it will impersonate a legitimate node. It will therefore not send packets to a specific target, nor randomly over the network. The greedy node will try to monopolize the transmission channel, while depriving other legitimate nodes of access to it [8]. To do this, the greedy node deliberately falsifies its CSMA-CA parameters in order to increase its chances of permanently accessing the transmission channel.