# Rank and Wormhole Attack Detection Model for RPL-Based Internet of Things Using Machine Learning  
[PERSON]  
1 School of Computer Science (SCS), Taylor's University, Subang Jaya 47500, Malaysia 1, NZ Jhanjhi  
communication through the internet that will not necessarily require human intervention [7; 8]. However, this would lead to various challenges at various levels in the complete IoT-enabled infrastructure. Primarily, the huge amounts of sensitive data communicated over the internet would fall victim to security attacks from various dimensions leading to compromised IoT-enabled infrastructures. Therefore, cybersecurity is one of the major challenges in IoT networks and systems. The majority of the IoT devices are developed without considering security as a fundamental factor due to several reasons. Some of them include the small size of the device that cannot support complex mechanisms and resource constraints that do not allow computational overheads. Therefore, to address these gaps, the researchers are actively participating in proposing alternative solutions to improve the security of IoT-enabled smart systems. In particular, the network layer of these systems is studied and researched due to its high vulnerability to network and routing attacks. The routing protocol for low-power and lossy networks (RPL) is a de facto protocol used in IoT networks. The Internet Engineering Task Force (IETF) [9] developed this protocol to address the unavailability of a routing standard that can fulfill the routing requirements and be implemented in resource-constrained, low-power, and lossy IoT networks. It works using the distance vector routing principle and forms a directed acyclic graph (DAG) or destination-oriented DAG (DODAG) to perform the routing functions. Five main control messages are responsible for developing a communication array. They are DODAG information solicitation (DIS), DODAG information object (DIO), destination advertisement object (DAO), DAO acknowledgement (DAO-Ack), and consistency check (CC) messages [10]. It also has local and global repair mechanisms responsible for repairing any inconsistencies, link outages, and other protocol-related problems. However, the lightweight core of the protocol and optional as well as specification-dependent security mechanisms lead to an increased potential for security attacks. These attacks are categorized into RPL-specific or protocol-specific attacks and sensor network (SN)-inherited attacks. Rank attacks (RA) from the protocol-specific category and wormhole attacks (WHA) from the SN-inherited attack category are among the most threatening attacks targeting the security triad of the RPL network, which encompasses the confidentiality, availability, and integrity of the network and system. In a decreased rank attack, an attacker illegitimately broadcasts a smaller rank value to attract child nodes and becomes a preferred parent to launch the attack, while in a wormhole attack, two nodes form a tunnel and attract victim nodes to send their traffic to the sink node through their path. They then replay or selectively drop the packets, which in turn results in deterioration of the network topology, life, as well as resources. Therefore, it is crucial to address these attacks to improve the security in RPL-based IoT networks. Machine-learning (ML) is an emerging paradigm for data analytics, automation, pattern recognition, anomaly detection, and prediction-related tasks. The techniques used in this discipline include statistical algorithms and models which have exhibited their effectiveness in different fields including cybersecurity. Moreover, ML is compatible with IoT systems in working principles and concerning data requirements because they generate a large amount of data that ML can utilize to build robust models. Therefore, this study proposes an ML-based model for addressing RA and WHA attacks in RPL-based IoT networks.