Detecting and Preventing Sinkhole and Wormhole Attacks in RPL Network Layer of IoT Networks Using Hybrid Machine Learning

Abstract

This study proposes a hybrid machine learning and trust-based framework to identify and prevent sinkhole and wormhole attacks in the Routing Protocol for Low-Power and Lossy Networks (RPL) at the network layer of Internet of Things (IoT) deployments. With the increasing number of IoT devices in Low Power and Lossy Networks (LLNs), RPL will be subjected to attacks that compromise network reliability, integrity, and its performance. The research challenge is to develop a lightweight, scalable security mechanism capable of identifying multiple attack types while minimizing energy consumption and computational overload. To address this challenge, this paper proposed an anomaly detection that combines network traffic patterns and node behavior to identify sinkhole and wormhole attacks in the network. While existing works performed single attack detection either by using Machine Learning (ML) or Trust model (TM), this work integrates both ML to analyze traffic patterns and TM to analyze node behavioral patterns for multiple attack detection. This hybrid approach outperforms existing detection techniques by achieving (>98%) accuracy in five hundred node RPL networks with minimal energy consumption of (≤0.59 mJ per node). The combined approach minimizes the false positive rate and thereby enhances the packet delivery ratio; it also paved the way for future extension of multiple attack detection schemes in RPL networks.