A Lightweight Solution for Detecting the Worst Parent Attack in RPL-based IoT Networks

The IPv6 Routing Protocol for Low-power and Lossy Networks (RPL) is specifically designed to meet the requirements of Low-Power and Lossy networks. RPL operates within a hierarchical topology, where each node relies upon its preferred parent to route sensed data, often employing the Minimum Rank Hysteresis Objective Function to select the optimal routing path. The worst parent attack exploits this process by maliciously selecting the least suitable parent to route messages. Despite the detrimental consequences of this attack, it has received limited attention. This paper proposes a novel and lightweight detection method that monitors nodes behaviour against the worst parent attackers. Experimental results demonstrate that our solution achieves high detection ratio and accuracy in identifying malicious nodes, with minimal false positives. Moreover, the approach imposes low overhead, enhancing its feasibility for resource-constrained IoT devices. Besides, our approach shows promising results also in detecting increased and decreased rank attacks.