Distributed-Collaborative Intrusion Detection Approach for DIS Flooding Attack in RPL-Based IoT Networks

Abstract

The immense extension of the Internet of Things (IoT) has made it necessary for the provision of robust defenses against routing layer threats. Among such threats are DIS (DODAG Information Solicitation) flooding attacks that are one of the most formidable problems for networks that have few resources. Many existing intrusion detection solutions utilize individual nodes or centralized entities in responding too late or in a limitedly efficient manner. As a solution to this, we propose: a distributed consensus-based intrusion detection and mitigation system design that is capable for RPL (IPv6 Routing Protocol for Low-Power and Lossy Networks)-based IoT deployments. Culminating in the entailment of each node monitoring the local DIS message rate which it periodically exchanges with neighborsless that in the end malicious sources can be collectively flagged. Average power consumption is observed to rise when the most afflicted nodes are brought up closer to real DIS flooding conditions rates of roughly 30 mW, compared to the normal 3 mW. It detects the scalar culprit in just a few seconds and brings energy back to near-normal levels. Furthermore, testing accuracy exceeds 95%, kept false positives low (under 5%) by making entire data sharing a collaborative event. The system is showed to be more resilient and dependable than systems without collaboration, as it rapidly isolates bad actors utilizing the highest advantage of overhead against malicious nodes. This project illustrates the importance of quick action in isolating ill-intent nodes with very minimal costs to provide improved strength and reliability more than non-collaborative solutions. More critically, it raises awareness of the centrality of lightweight form collective intelligence among nodes used in effectively defending evolving DIS flooding attacks against IoT networks.