Intrusion Detection in the RPL-connected 6LoWPANNetworks

Dharmini ShreenivasEricsson AB

Kista, Stockholm, Swedendharmini.shreenivas@

ericsson.com

Shahid RazaRISE SICS AB

Stockholm, Swedenshahid@sics.se

Thiemo VoigtRISE SICS AB

Stockholm, SwedenUppsala University, Sweden

thiemo@sics.se

ABSTRACTThe interconnectivity of 6LoWPAN networks with the Inter-net raises serious security concerns, as constrained 6LoW-PAN devices are accessible anywhere from the untrustedglobal Internet. Also, 6LoWPAN devices are mostly de-ployed in unattended environments, hence easy to captureand clone. Despite that state of the art crypto solutions pro-vide information security, IPv6 enabled smart objects arevulnerable to attacks from outside and inside 6LoWPANnetworks that are aimed to disrupt networks.

This paper attempts to identify intrusions aimed to dis-rupt the Routing Protocol for Low-Power and Lossy Net-works (RPL). In order to improve the security within 6LoW-PAN networks, we extend SVELTE, an intrusion detectionsystem for the Internet of Things, with an intrusion detec-tion module that uses the ETX (Expected Transmissions)metric. In RPL, ETX is a link reliability metric and moni-toring the ETX value can prevent an intruder from activelyengaging 6LoWPAN nodes in malicious activities. We alsopropose geographic hints to identify malicious nodes thatconduct attacks against ETX-based networks. We imple-ment these extensions in the Contiki OS and evaluate themusing the Cooja simulator.

KeywordsRPL, ETX, Internet of Things, 6LoWPAN, Intrusion De-tection, Cyber Security, IPv6

1. INTRODUCTIONThe Internet Protocol (IP) connects standard computers

and similar devices with the Internet since some decades. Ithas also been realized that the IP capabilities should be ex-tended to the less traditional everyday resource-constrainedcomputing devices. The interconnection of billions of every-day objects and the Internet forms the Internet of Things.IPv6, with potentially unlimited address space, is a favor-able candidate for the IoT, as IPv4 addresses are not evenenough to handle the current load of traditional Internet

Permission to make digital or hard copies of all or part of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor profit or commercial advantage and that copies bear this notice and the full cita-tion on the first page. Copyrights for components of this work owned by others thanACM must be honored. Abstracting with credit is permitted. To copy otherwise, or re-publish, to post on servers or to redistribute to lists, requires prior specific permissionand/or a fee. Request permissions from permissions@acm.org.

IoTPTS’17, April 02 2017, Abu Dhabi, United Arab Emiratesc© 2017 ACM. ISBN 978-1-4503-4969-7/17/04. . . $15.00

DOI: http://dx.doi.org/10.1145/3055245.3055252

hosts. However, things (resource-constrained devices in theIoT) have limited storage, processing, and energy resourcesand it is not feasible to use full-fledged IPv6 for these con-strained devices. Therefore, IPv6 over Low-powered Wire-less Personal Area Networks (6LoWPAN) has been stan-dardized to route IPv6 packets in low-power and lossy IEEE802.15.4-based networks [Kushalnagar et al. 2007, Montene-gro et al. 2007], called 6LoWPAN networks.

Due to the connectivity with the untrusted Internet, se-curity is necessary in 6LoWPAN deployments. We havedeveloped a number of security solutions for the IoT in-cluding lightweight end-to-end communication security pro-tocols [Raza et al. 2013a][Raza et al. 2014], a scalable keymanagement solution by using only symmetric keys [Razaet al. 2016], and an efficient data-at-rest security mecha-nism [Bagci et al. 2015].

Due to the low-power and lossy nature of 6LoWPAN net-works, traditional Internet routing protocols are not feasiblefor such networks. Therefore, the Routing Protocol for Low-Power and Lossy Networks (RPL) [Winter et al. 2012] hasbeen standardized. For RPL too, it is important that therouting protocol should work as intended and hence must berobust against attacks aimed to disrupt the network. Pre-viously, we have conducted different attacks against RPL-connected 6LoWPAN networks [Wallgren et al. 2013], anddemonstrated that RPL is vulnerable to multiple attacks. Leet al. [Le et al. 2012] have also presented different attacksagainst 6LoWPAN networks. In order to mitigate these at-tacks we have devised SVELTE [Raza et al. 2013b], an intru-sion detection system for RPL-based networked. Zarpelaoet al. [Zarpelao et al. 2017] provide a comprehensive surveyof intrusion detection mechanisms designed for IoT, whichalso covers SVELTE.

SVELTE is primarily based on the RPL rank parameterand defends against attacks that are based on the illegal ma-nipulation of ranks. The RPL rank determines the positionof individual nodes with respect to the root and relative toother nodes in the networks. RPL also uses the ExpectedTransmission Count (ETX) to estimate the link quality toa node’s neighbors. The ETX path metric is an importantpath quality metric in RPL-connected 6LoWPAN networks,which could be exploited to launch different attacks.

In this paper, we propose an extension to the SVELTE in-trusion detection system using the ETX metric. We also pro-pose intrusion detection based on geographical hints, whichcan be used in situations when both rank-based and ETX-based solutions are not able to detect the majority of theattackers. We implement our intrusion detection systems in

31

Mapping queues

attacker

- 6LoWPAN Border router with centralized IDS network Mapper

-Defense against spoofing ,rank and ETX attacks

Mapping queues

External attackers

6LoWPAN

IEEE 8B2fy5f4 MACIEEE 8B2fy5f4 PHY

IPv6hIPSec

RPL

TCPhTLS UDPhDTLS ICMP

Network Stack

Internet cloud

Mapping queues

Mapping queues

Protected 6LoWPAN Environment

IP enabled Internet of Things

6LoWPAN Border Router

Device with TCPhIP Stack

Attacker trying to disrupt the network

COAP/COAPs

Intrusion Detection System -IDS with Rank -IDS with ETXDefense against root spoofing attack

Figure 1: An IoT setup showing the interconnection of 6LoWPAN networks with the Internet through a 6BR. It also showsthe placement of IDS modules in things and in 6BR.

the Contiki OS [Dunkels 2003] and evaluate them using theCooja simulator [Eriksson et al. 2009]. In our experimentswe use a realistic IoT setup, shown in Figure 1. We intro-duce the relevant IoT technologies, depicted in Figure 1, inSection 2.

The main contributions of this paper are:

• We propose an extension to SVELTE and include anIDS module for the RPL ETX metric.

• To improve the detection rate, we propose the use ofgeographical hints.

• Last but not least, we implement and evaluate ourextensions in a simulated RPL network that uses ac-tual IoT protocols: IPv6, 6LoWPAN, UDP, RPL, andIEEE 802.15.4.

The rest of the paper is organized as follows. The nextsection briefly discusses RPL and related technologies nec-essary to understand this paper. Section 3 presents our in-trusion detection extensions for RPL-connected networks.In Section 4 we describe the implementation and evaluationdetails and present our results. Finally, Section 5 concludesthe paper.

2. THE RPL PROTOCOLThe Routing Protocol for Low-Power and Lossy Networks

(RPL) is a new standard for resource-constrained environ-ments. RPL is a distance vector protocol that builds thedestination oriented directed acyclic graph (DODAG). Inthe DODAG topology traffic from all the edges convergestowards a single destination called the DODAG root. In thecase of 6LoWPAN networks the DODAG root is the 6LoW-PAN border router (6BR), which is shown in Figure 1. TheDODAG also consists of routers and leaf nodes.

RPL defines the following ICMPv6 control messages: DODAGInformation Object (DIO), Destination Advertisement Ob-ject (DAO), and DODAG Information Solicitation (DIS) to

construct the DODAG. Each DODAG is identified by itstopological information such as RPLInstanceID, DODAGIDand DODAGVersionNumber. These identifiers are periodi-cally advertised by the DODAG nodes to build the DODAGtree.

In order to define the routing path for datagrams in theDODAG, RPL uses the Objective function (OF). The OFcould be determined by either one or many RPL metricsdefined in the DAG metric container [Vasseur et al. 2011].All the nodes along with the DIO advertisements advertisethe DAG metric container. Based on these advertisements,the routing path is built from the leaf nodes to the 6BR toform a DODAG tree like structure. Figure 2 depicts a RPLDODAG and shows the rank and ETX metrics, which wediscuss in Section 2.2. A trickle timer is used to synchronizecommunications between the ICMPv6 messages for node-to-node communications [Winter et al. 2012].

2.1 RPL DODAG building processWhen all the nodes boot up, the system administrator

configures the 6BR. This means that the objective func-tion would also be configured for a 6LoWPAN network. AllICMP messages are managed by the trickle timer to avoidambiguity in the network. The participating nodes adver-tise their presence and their positions and related routingmetrics through the DIO messages to all neighboring RPLnodes.

Initially after neighbor discovery, the DIO messages aresent upon the expiration of the trickle timer [Levis et al.2011]. All DIO messages are advertised via link local mul-ticast advertisements. Then every node starts advertisingtheir DIO messages. Upon every single received DIO mes-sages, all nodes first verify the authenticity of the DIO andalso whether they do adhere to local policies, routing met-rics, etc. Primarily each and every node which receivesDIO messages checks the incoming DIO messages for twopurposes, first to adhere to the DODAG policy, i.e., therank of the sending node should be lower than that of thereceiving node; the DIO should have a rank greater than

32

Figure 2: The RPL DODAG

MinHopRankIncrease (Section 2.2.1) and not greater thanDAGMaxRankIncrease. Second, for the Mode of Operation(MOP) flag in the DIO, which is responsible for recordingthe type of route the node is going to follow in the DODAG(upward or downward). In case the downward routes arepreferred, the child nodes would trigger the DAO messagesadvertising its reachability in the DODAG towards its par-ents along with DAO lifetime and other parameters. TheDIO message could also be configured according to the OFand the nodes can discard DIO messages based on those OFconstraints [Winter et al. 2012].

2.2 RPL Routing metricsThe RPL routing metrics determine the routing path dic-

tated by the OF in any DODAG, advertised by the 6BR[Winter et al. 2012]. RPL being a distance vector protocol,paths with low cost are chosen by the routing protocol forbetter efficiency [Vasseur et al. 2011]. Routing metrics areeither aggregated or recorded. An aggregated metric is mod-ified along the path that it traverses with the DIO. Routingmetrics are encoded in a DAG metric container that is inturn carried by the DIO messages. On receiving the DIOmessage from a set of parents, the child node decides itsown parent set according to the OF. RPL is a lossy net-work; hence a group of metrics is necessary to evaluate thecondition of every node. Depending upon the implementa-tion environment even a single metric could be chosen todetermine the state of RPL nodes.

There are various routing metrics that RPL utilizes forbuilding the DAG, which are standardized by the IETF [Vasseuret al. 2011]. SVELTE has used rank and for this paper wealso utilize the ETX metric to detect malicious nodes.

2.2.1 Rank MetricThe rank is a 16-bit integer that is present in the DAG

metric container. The rank determines the relative positionof a node with respect to the Border router. The rank valueis a monotonically increasing value from top to bottom. Thenodes that are closer to the 6BR will have a lower rank valueand farther nodes will have a higher rank value. All nodesshould advertise a rank value to the least of MinHopRank-Increase. The nodes should not advertise any value greaterthan the total sum of the least rank in a DAG and DAG-

MaxRankIncrease. MinHopRankIncrease is the minimumincrement of a rank value in each hop between any nodeand any of its DODAG parents. DAGMaxRankIncrease isthe configured upper limit value of all nodes. The DAG-MaxRankIncrease is provisioned by the Border Router andis present to avoid loop formation in a DODAG.

2.2.2 ETX MetricExpected Transmission (ETX) metric is a path reliability

metric for lossy networks [De Couto et al. 2005]. The ETXis defined as the number of transmissions necessary for apacket to reach the DODAG root. The ETX is measured bysending periodical probe packets between the participatingneighbors. Hence, the ETX indicates the communicationquality of the neighbors. In ContikiRPL, ETX is a scalarvalue, a multiple of 128 that is encoded as 16-bits in theDAG metric container. When RPL uses the ETX metricas an OCP1, the OF builds routes with nodes having min-imum ETX values [Gnawali and Levis 2011]. Thus ETXis referred to as the link quality of the node along with itsneighbors. The Collection Tree Protocol (CTP) is an ex-ample of a popular protocol [Levis et al. 2005] that utilizesETX for network formation.

The ETX path metric is a cumulative sum of a node’s ownETX value to a neighbor and the ETX value advertised byits neighbor, which indicates the distance of that neighborfrom the root. The ETX path metric is calculated wheneverthe ETX link values are updated on a node’s link and bythe neighbor. All nodes in a DODAG compute the ETXpath metric for each candidate neighbor reachable on allthe interfaces. If any node cannot compute the ETX valueof its neighboring nodes then the failed node should not beincluded in the candidate neighbor and parent sets. Theformula used to calculate ETX is:

1

Df ∗Dr= ETX

Where Df is the measured probability of the received pack-ets and Dr is the measured probability of the received ac-knowledgments for the sent packets.

With this background we are now going to propose ourSVELTE extensions.

3. INTRUSION DETECTION IN RPL-CONNECTED NETWORKS

SVELTE is a state of the art IDS designed primarily forRPL-based 6LoWPAN networks [Raza et al. 2013b]. SVELTEmostly relies on the RPL rank metric to defend against dif-ferent attacks. In this paper we include the ETX metric inthe SVELTE design. We also introduce an IDS mechanismwith geographic hints, in an attempt to locate maliciousnodes that cause instability inside 6LoWPAN networks.

Before presenting these two extensions we discuss the changesin SVELTE to support our new extensions. An importantpart of SVELTE is the 6LoWPAN Mapper (6Mapper) thatconstructs the RPL DODAG in the 6BR and adds eachnode’s neighbor and parent information in the DODAG. Toreconstruct the DODAG, the 6Mapper collects necessary in-formation from each node at regular intervals. SVELTE de-fines a request packet that contains the information needed

1The Objective Code Point (OCP) indicates which routingmetrics are in use in a DAG.

33

to identify an RPL DODAG. We complement the 6Mapperpacket with the ETX value and send it with each receivedrequest.

Effects of inconsistent ETX values in 6Mapper:.Timing consistencies are important for a mapping author-

ity to receive the latest information about the participatingnodes in 6LoWPAN networks. In RPL, the quality of a pathis described by the ETX value [Gnawali and Levis 2010]. Ifthe 6Mapper has incorrect ETX values of the nodes, it wouldindicate misplaced logical coordinates of the node, which isintolerable in RPL as many DAGs build their routing pathbased on the ETX values.

In RPL, the ETX value of a parent should be lower thanthat of the children. The root node has the lowest ETX. Fig-ure 3 shows a simple RPL DODAG with ETX values, whichshows that with a simple manipulation of ETX values, arouting loop can be created. A malicious node can launchdifferent attacks by illegally modifying the ETX value. Forexample an attacker can modify the ETX value and get abetter position in a DODAG, which helps the attacker tolaunch further attacks such as sinkhole or selective forward-ing attacks [Raza et al. 2013b].

Figure 3: Loop formation with ETX Attack

3.1 Our IDS with ETX MetricBy advertising a false ETX value an attacker can make

neighboring nodes believe that the compromised node hasa stronger or a weaker link. Also if the attacker’s node ispresent on the routing path, it can advertise a low ETXvalue to attract traffic and conduct a selective forwardingattack. Attackers can also launch other attacks, for exam-ple, by placing the attacker’s node(s) in the routing path toattract traffic and create loops (Figure 3) to exhaust the en-ergy of authorized nodes. While link level encryption couldhelp to prevent these attacks it is still possible to compro-mise a legitimate node. In the best case, we could use anasymmetric cryptography with a Public Key Infrastructure(PKI) but this is too resource hungry and often not feasiblein constrained environments.

In this paper we attempt to detect an intruder in 6LoW-PAN networks by calculating the ETX values [De Coutoet al. 2005]. In order to do so, the 6Mapper traverses throughthe entire DAG and records metrics for all the nodes par-ticipating in the DAG. In Algorithm 1, we detect intruderswho advertise false ETX values to gain more strength or toperform DoS attacks. We also defend against root spoofingattacks by verifying the rank values against the ETX val-

Algorithm 1 Intrusion detection by verifying the propaga-tion of ETX inside 6LoWPAN networks

Require: N - Set of nodesRequire: P - Parent set of the nodeRequire: Neighbors - Neighbor set of Node N

for Node in N dofor all Neighbor in Node.Neighbors do

if Node.etx == 0 thenif Parent.etx == 0 then

if Node.Rank == Root.Rank thenNode.fault = Node.fault+1 {The node is trying toadvertise a root etx value}

end ifend if

end ifif Node.etx > 0 then

if Node.etx < Parent.etx thenif Node.Rank > Parent.Rank +MinHopRankIncrease then

Node.fault = Node.fault+1 {The node is trying toadvertise an invalid etx value}

end ifend if

end ifend for

end forfor Node in N do

if Node.fault > FaultThreshold thenA new parent is chosen

end ifend for

ues. The ETX values are calculated for every single nodeand their neighbors. The thumb rule for ETX verificationis that the parent’s ETX value should be lower than that ofits children. An intruder is determined if any of the node(s)ETX values are abnormal. Lower ETX values depict a betterpath to the 6BR and hence falsified values could indicate theadversary node is closer to 6BR. The adversary node thatmanages to attract traffic by advertising a low ETX valueis capable of disrupting the entire 6LoWPAN network. Onthe other hand, a adversary node can distract the nodes inits sub DODAG that the adversary node is far away from6BR, by advertising a higher ETX value than the calculatedactual ETX value.

To include fault tolerance, we also check the node and theparent’s rank value. Recall that the least increase in rankshould be that of MinHopRankIncrease and not exceedingDAGMaxRankIncrease values. Network administrators candecide these values based on the implementation specifica-tions. In our implementation we set the MinHopRankIn-crease to 256 and DAGMaxRankIncrease is set to 2048. Wemark a fault threshold to not tolerate too many fraudulentattempts and we demarcate the routing path when it exceedsthe fraudulent threshold.

3.2 Our IDS with Geographic HintsThough ETX and ranked based solutions can detect some

attacks, an attacker can compromise a node plus some of itsneighbors. In that case it is difficult for the 6Mapper to dis-tinguish the inconsistencies in the rank and ETX using ouralgorithms. In those situations, geographical hints can help

34

Algorithm 2 Intrusion Detection with geographical infor-mation inside 6LoWPAN networks

Require: N - Set of nodes participating in the 6LoWPANnetworks

Require: Tx - Nodes within the receiving vicinityRequire: NT - Neighbor table listing a collection of nodesRequire: Neighbor - Neighbor of the Node N

for all Node in N doNT = nodeswithin|Node.Tx|if NodeinNT then

Node.ETX < Node.Neighbor.ETXend if

end for

to mitigate the rank and ETX attacks. The requirement is,however, that the nodes’ locations are known.

In Algorithm 2 we attempt to cluster the nodes with limi-tations of their transmission power to deduce their immedi-ate neighbors. The goal of this technique is to determine theintruders who fake identities to conduct various attacks inan IoT environment. Firstly, we calculate the transmissionlimits for every node in the network and maintain a neighbortable listing the identities of the nodes within their trans-mission range. This would be effective for RPL 6LoWPANnetworks because if any intruder attempts to fake the iden-tity we could determine that from the respective neighbortable. Also, the neighbor table would consist of group ofnodes with similar transmission ranges, so they would con-sist of similar nodes with small differences in rank and ETXvalues. If a node from a much lower cluster attempts to fakethe identity of a node from a much higher cluster the IDScan identify the node as intruder. For example, the 6Map-per could detect an intruder claiming it has an ETX of 128for a link while its neighbors are of 768 since it is practicallyimpossible for nodes at level 6 to have a neighbor at level 1.Recall that ETX is a scalar value, a multiple of 128.

4. IMPLEMENTATION AND EVALUATIONWe extend the SVELTE implementation with the new

ETX and geographical parameters. We implement it inContiki, an operating system for the IoT [Dunkels et al.2004] . We perform our evaluations using Contiki 2.6 andCooja [Eriksson et al. 2009] simulations.

4.1 IoT Demo EnvironmentOur IoT environment consists of a 6LoWPAN Border Router

(6BR) as DODAG that connects a 6LoWPAN network tothe Internet. The nodes that forward packets on behalf ofother nodes are called routers. Devices at the edge of thetree are leaf nodes [Winter et al. 2012]. The 6BR could beattached to a large processing system as it the convergingpoint for network traffic to enter or leave the 6LoWPAN en-vironment. In this paper the 6BR is assumed to be trusted.For our simulations we use Tmote sky as things in 6LoW-PAN networks. A Tmote sky has a CCC2420 transceiver[Moteiv 2006] and 48kB of ROM.

4.2 Experimental SetupThe experiments are run on an emulated 6LoWPAN net-

work with RPL as the routing protocol and ContikiMAC asthe MAC protocol. We use the same seed for all measure-ments. For intrusion detection analysis we evaluate the true

positive rate and also measure the energy and ROM/RAMusage. To achieve this we use the base values of the Tmotesky (Table 1) [Moteiv 2006]. We evaluate the energy/powerconsumption and true positive rate of a network that con-sists of 4,6 and 8 legitimate nodes. Due to the simulationlimitations, we show results for up to eight legitimate nodes.Our simulations also consist of two attacker nodes. We doc-ument the results when the first malicious node is detected.We do this every five minutes. At the first 2 minutes thenode starts to map the information, and from the next roundonwards the 6Mapper runs the detection modules.

In this paper, we use 3V as standard voltage for our cal-culations. All participating node are on either of the twostates: Idle or listening. A node is in low power mode (LPM)when the radio is off and the micro controller unit (MCU) isidle. We calculate the CPU time when the micro controllerunit (MCU) is on.

4.3 Power UsageEnergy/Power is one of the most important resources in

constrained IoT devices, as most of them run on batter-ies. Therefore the communication and security protocolsshould be energy efficient and meet the constrained energyresources of IoT devices. We measure the power consump-tion with duty cycling and without duty cycling.

4.3.1 With Duty cyclingWe measure the energy usage of a node using the energest

module [Dunkels et al. 2007]. We record the CPU, LPM,Rx and Tx values respectively. We calculate the energy ofa node using the formula

Energy(mWs) =

transmit * 19.5 + listen * 21.8 + LPM *

0.0545 + CPU 1.8

where transmit and listen are tx and rx values respectively.We calculate the average energy consumption of a node atthe time when it detects an intruder node. We calculatethe average power consumption of a single node when theintrusion is detected by the 6Mapper, using the followingformula.

Power(mW ) =Energy(mWs)

T ime(s)

For the power consumption in Figure 4, we compare ourresults with the power estimation of SVELTE [Raza et al.2013b]. Our IDS with ETX module computes almost thesame power when compared with the IDS with rank mod-ule. This is because the energy consumed by sending theadditional ETX value is negligible when compared with theoverall energy usage by the network.

For our setup where the 6Mapper requests mapping infor-mation every two minutes, we calculate the average batterylife with average supply voltage as 3V and average powerconsumption as 1.3 mW .

3000mAh ∗ 3V

avgpower(mW )

3000mAh ∗ 3V

1.3(mW )= 6, 923.07(h)

We can thus except the node to stay for 6, 923.07/24 = 288days.

35

Typical Operating Conditions MIN NOM MAX UNITSupply voltage 2.1 3.6 VSupply voltage during flash memory programming 2.7 3.6 VCurrent Consumption: MCU on, Radio RX 21.8 23 mACurrent Consumption: MCU on, Radio TX 19.5 21 mACurrent Consumption: MCU on, Radio off 1800 2400 µACurrent Consumption: MCU idle, Radio off 54.5 1200 µACurrent Consumption: MCU standby 5.1 21.0 µA

Table 1: Base measurement units for Tmote-Sky nodes

0

0.2

0.4

0.6

0.8

1

1.2

1.4

1.6

4 8

IDS With Rank Module IDS With ETX Module

6No of nodes

Aver

age

Pow

er p

er n

ode

(mW

)

Figure 4: Power estimation for the two IDS modules whenexperiments are conducted with duty cycling.

4.3.2 Without Duty cyclingWe evaluate the energy and power consumption when the

radio is always on and nodes never sleep. As expected theresults are same for both the IDS with rank and the IDSwith ETX, as the CPU consumes negligible energy whencompared with the energy consumed by the radio. As theradio is always turned on, we cannot really see the differencein energy consumption by the two different techniques. Infact, there is a 0.02% increase in power consumption between4 and 8 nodes. For completeness, the results are anyhowshown in Figure 5.

We also compute the CPU power consumption in Figure 6in order to compare the two IDS modules. Our results showthat the ETX module consumes less CPU power than theRank module.

4.4 IDS True Positive RateWe also evaluate the true positive rate of the IDS with

the ETX metric. True positive rate is the number of alarmssuccessfully detected out of the total number of alarms. Forthis experiment, the information in the 6Mapper is processedevery 2 minutes. This means that for the first round of 2minutes we analyze the mapped information and during thenext round of 2 minutes we display the fake nodes in the6Mapper. Recall that we use a set of 4, 6, and 8 nodesrespectively with 2 malicious nodes.

Figure 7 displays the true positive rate for the three setsof nodes. We cannot directly map these results with theSVELTE because the experiments in SVELTE are conducted

0

5

10

15

20

25

30

35

40

45

50

4 6 8Av

erag

e Po

wer

per

nod

e (m

W)

No of nodes

IDS With Rank Module

IDS With ETX Module

Figure 5: Power estimation for the two IDS modules whenexperiments are conducted without duty cycling.

with different sets of nodes, and our IDS with ETX parame-ter does not support more nodes in the simulated/emulatedCooja environment due to its limited resources of the Tmotesky. However, we learn that as the number of nodes increasesthe true positive rate decreases. Interestingly, we have alsorealized that on a combined analysis with the rank and theETX module, the overall true positive rate increases. Thisis inline with the motivation to use the ETX in addition tousing the rank for intrusion detection.

4.5 RAM and ROM usageIoT devices have limited ROM and RAM resources. There-

fore it is important that security and other protocols shouldbe optimized for these environments. Table 2 shows theRAM and ROM overhead of our IDS with the ETX module.ROM usage in Contiki differs according to its implementa-tion. Our implementation utilizes 48620 Bytes for the fullContiki with an overhead of 5,570 Bytes for the IDS withETX module. Also, it consumes an additional 6 Bytes ofRAM.

5. CONCLUSIONIn this paper we have extended SVELTE, an intrusion

Overhead ROM (Bytes) RAM (Bytes)Additional storage 5,570 6

Table 2: Additional RAM and ROM required by our IDSwith ETX module.

36

0

0,01

0,02

0,03

0,04

0,05

0,06

0,07

0,08

0,09

0,1

4 86No of nodes

IDS With Rank Module

IDS With ETX Module

Pow

er (m

W)

Figure 6: Comparison of power consumed by CPU whileperforming the intrusion detection using the rank metric andthe ETX metric.

0

20

40

60

80

100

4 8

True Positive rate

6No of nodes

True

Pos

itive

Rat

e (%

)

Figure 7: True positive rate with our IDS with ETX modulefor a set of 4, 6, and 6 nodes.

detection system for the IoT, and complemented it withthe ETX metric and geographical hints. In RPL, an at-tacker can exploit the ETX metric and can launch differentattacks by getting a better position in the RPL DAG. Toovercome these attacks and also to find the malicious nodes,we have developed ETX-based and geographical detectionalgorithms. While our IDS module with ETX parametercan defend against ETX and rank attacks, the geographi-cal detection algorithms can locate the proximity of a nodeto the 6Mapper and test its authenticity. Our results showthat compared with rank-only mechanisms the overall truepositive rate increases when we combine the EXT and rankbased detection mechanisms.

6. ACKNOWLEDGEMENTSThis work was financed partially by VINNOVA and par-

tially by the EU project NobelGrid under the grant no.646184.

7. REFERENCES[Bagci et al. 2015] Ibrahim Ethem Bagci, Shahid Raza, Utz

Roedig, and Thiemo Voigt. 2015. Fusion: coalescedconfidential storage and communication framework forthe IoT. Security and Communication Networks(2015). DOI:http://dx.doi.org/10.1002/sec.1260

[De Couto et al. 2005] Douglas SJ De Couto, DanielAguayo, John Bicket, and Robert Morris. 2005. Ahigh-throughput path metric for multi-hop wirelessrouting. Wireless Networks 11, 4 (2005), 419–434.

[Dunkels 2003] Adam Dunkels. 2003. Full TCP/IP for 8Bit Architectures. In Proceedings of the FirstACM/Usenix International Conference on MobileSystems, Applications and Services (MobiSys 2003).San Francisco.http://dunkels.com/adam/mobisys2003.pdf

[Dunkels et al. 2004] Adam Dunkels, Bjorn Gronvall, andThiemo Voigt. 2004. Contiki - a Lightweight andFlexible Operating System for Tiny NetworkedSensors. In Proceedings of the First IEEE Workshopon Embedded Networked Sensors (Emnets-I). Tampa,Florida, USA.http://dunkels.com/adam/dunkels04contiki.pdf

[Dunkels et al. 2007] Adam Dunkels, Fredrik Osterlind,Nicolas Tsiftes, and Zhitao He. 2007. Software-basedon-line energy estimation for sensor nodes. InProceedings of the 4th workshop on Embeddednetworked sensors. ACM, 28–32.

[Eriksson et al. 2009] Joakim Eriksson, Fredrik Osterlind,Niclas Finne, Nicolas Tsiftes, Adam Dunkels, ThiemoVoigt, Robert Sauter, and Pedro Jose Marron. 2009.COOJA/MSPSim: interoperability testing for wirelesssensor networks. In Proceedings of the 2ndInternational Conference on Simulation Tools andTechniques. 27.

[Gnawali and Levis 2010] Omprakash Gnawali and PLevis. 2010. The ETX Objective Function for RPL.draft-gnawali-roll-etxof-01 (2010).

[Gnawali and Levis 2011] O Gnawali and P Levis. 2011.The minimum rank objective function with hysteresis.draft-ietf-roll-minrank-hysteresis-of-04 (work inprogress) (2011).

[Kushalnagar et al. 2007] N Kushalnagar, G Montenegro,C Schumacher, and others. 2007. IPv6 over low-powerwireless personal area networks (6LoWPANs):overview, assumptions, problem statement, and goals.RFC4919, August 10 (2007).

[Le et al. 2012] Anhtuan Le, Jonathan Loo, AboubakerLasebae, Mahdi Aiash, and Yuan Luo. 2012.6LoWPAN: a study on QoS security threats andcountermeasures using intrusion detection systemapproach. International Journal of CommunicationSystems 25, 9 (2012), 1189–1212.

[Levis et al. 2011] Philip Levis, T Clausen, J Hui, OGnawali, and J Ko. 2011. The trickle algorithm.Internet Engineering Task Force, RFC6206 (2011).

[Levis et al. 2005] Philip Levis, Sam Madden, JosephPolastre, Robert Szewczyk, Kamin Whitehouse, AlecWoo, David Gay, Jason Hill, Matt Welsh, Eric Brewer,and others. 2005. TinyOS: An operating system forsensor networks. In Ambient intelligence. Springer,115–148.

37

[Montenegro et al. 2007] Gabriel Montenegro,Nandakishore Kushalnagar, J Hui, and D Culler. 2007.Transmission of IPv6 packets over IEEE 802.15. 4networks. Internet proposed standard RFC 4944(2007).

[Moteiv 2006] Moteiv. 2006. Tmote Sky Datasheethttp://www.sentilla.com/pdf/eol/tmote-sky-datasheet.pdf.

[Raza et al. 2014] Shahid Raza, Simon Duquennoy, JoelHoglund, Utz Roedig, and Thiemo Voigt. 2014. SecureCommunication for the Internet of Things - AComparison of Link-Layer Security and IPsec for6LoWPAN. Security and Communication Networks,Wiley 7, 12 (Dec. 2014), 2654–2668. DOI:http://dx.doi.org/10.1002/sec.406

[Raza et al. 2016] Shahid Raza, Ludwig Seitz, DenisSitenkov, and Goran Selander. 2016. S3K: ScalableSecurity with Symmetric Keys - DTLS KeyEstablishment for the Internet of Things. IEEETransactions on Automation Science and Engineering13, 3 (July 2016), 1270–1280. DOI:http://dx.doi.org/10.1109/TASE.2015.2511301

[Raza et al. 2013a] Shahid Raza, Hossein Shafagh, KasunHewage, Rene Hummen, and Thiemo Voigt. 2013a.Lithe: Lightweight secure CoAP for the internet ofthings. Sensors Journal, IEEE 13, 10 (2013),3711–3720.

[Raza et al. 2013b] Shahid Raza, Linus Wallgren, andThiemo Voigt. 2013b. SVELTE: Real-time IntrusionDetection in the Internet of Things . Ad HocNetworks, Elsevier (2013). DOI:http://dx.doi.org/10.1016/j.adhoc.2013.04.014

[Vasseur et al. 2011] J. Vasseur, M. Kim, K. Pister, N.Dejean, and D. Barthel. 2011. Routing metrics usedfor path calculation in low power and lossy networks.draft-ietf-roll-routing-metrics-19 (work in progress)(2011).

[Wallgren et al. 2013] Linus Wallgren, Shahid Raza, andThiemo Voigt. 2013. Routing Attacks andCountermeasures in the RPL-Based Internet ofThings. International Journal of Distributed SensorNetworks 13, 794326 (2013). DOI:http://dx.doi.org/doi:10.1155/2013/794326

[Winter et al. 2012] T. Winter, P. Thubert, A. Brandt, J.Hui, R. Kelsey, P. Levis, K. Pister, R. Struik, J.Vasseur, and R. Alexander. 2012. RPL: IPv6 RoutingProtocol for Low-Power and Lossy Networks. RFC6550 (Proposed Standard). (March 2012).http://www.ietf.org/rfc/rfc6550.txt

[Zarpelao et al. 2017] Bruno Bogaz Zarpelao,Rodrigo Sanches Miani, Claudio Toshio Kawakani,and Sean Carlisto de Alvarenga. 2017. A Survey ofIntrusion Detection in I nternet of Things. Journal ofNetwork and Computer Applications (2017).

38