Performance Evaluation of Mobile RPL-Based IoT Networks under Sinkhole Attacks

Contributions

The main contributions of this study are summarized as follows:

• A comprehensive performance evaluation of RPL-based IoT networks under sinkhole attack scenarios, explicitly incorporating node mobility.

• Comparative analysis across static, hybrid, and fully mobile network configurations to understand the combined effects of mobility and attacks.

• Quantitative assessment using key performance metrics, including PDR, IPT, power consumption, and number of isolated nodes.

• An extensive simulation study using the Contiki Cooja environment with up to 50 nodes and varying attacker densities, providing realistic insights into network behavior.

• Identification of mobility as a critical factor that significantly influences attack impact, highlighting the need for mobility-aware security solutions in RPL-based IoT systems.

The structure of the paper is outlined in the following sections. Section 2 provides a background of pertinent research, offering insights into the scope of this study. Section 3 describes the related work of this study. In Section 4, the paper explores performance metrics and evaluation parameters. Section 5 presents the result analysis in terms of number of isolated nodes, PDR, IPT and power consumption. Section 6 discusses implementation overhead, limitation and outlines directions for future research. Lastly, Section 7 presents the final observations.

2.1. Overview of RPL Protocol

RPL refers to an IPv6 routing protocol defined by the IETF for IoT systems with constrained resources [8]. RPL forms the network nodes in the form of a Destination-Oriented Directed Acyclic Graph (DODAG). This kind of topology uses an Objective Function (OF) and routing metrics, which include the hop count, ETX, or energy levels, to facilitate route selection. The rank value for each node specifies its position within the DODAG, thus avoiding any routing loop. The DIO, DIS, and DAO are the control messages used for forming connectivity in the network. Since RPL uses routing information from neighboring nodes, it becomes susceptible to routing attacks such as sinkholes.

RPL is created specifically for constrained environments like IoT networks, where devices operate with constrained energy resources, memory, and processing capabilities [9]. RPL enables efficient routing in such networks by providing a lightweight, energy-efficient, and adaptable routing solution [10]. Figure 1 illustrates the integration of RPL, an algorithm that utilizes distance vector routing, coupled with the 6LoWPAN adaptation layer.

Figure 1.

RPL uses OF to identify the optimal route for packet transmission within the network. The OF evaluates various metrics such as energy consumption, latency, and link quality to select the most suitable route [11]. RPL supports both proactive and reactive routing strategies, allowing nodes to maintain a dynamic routing topology while conserving energy. It organizes nodes into a Directed Acyclic Graph (DAG), with nodes acting as routers and maintaining parent-child relationships to efficiently forward packets [12].

The fundamental structure in RPL is the DODAG, which depicts the routing topology of the network as shown in Figure 2. It is rooted at a designated destination node and expands outward when nodes connect to the network [13]. The DODAG evolves dynamically as a reaction to alterations in network conditions. An RPL instance is a logical partition within a network, identified by a unique Instance ID. Each instance operates independently, allowing multiple RPL instances to coexist within the same network infrastructure. Nodes in the RPL network use DAO messages to inform their parent nodes in the DODAG about their presence and capabilities. DAO messages provide details about a node's rank, its preferred parent, and supported data traffic. When a DAO message is received, the parent node responds to it with an acknowledgement, confirming the establishment of the parent-child relationship. DAO acknowledgements serve as a mechanism for maintaining route stability and reliability.

Figure 2.

RPL constructs the DODAG in a bottom-up manner, starting from the root node and expanding outward as nodes join the network [14]. Every node chooses its parent according to the OF to reduce energy usage and packet loss. Nodes in the DODAG are assigned ranks based on their position relative to the root node. Ranks determine the order in which nodes forward packets and influence the path selection process. RPL constantly observes the network topology and modifies the routing paths as needed in response to changes such as node failures, mobility, or environmental conditions. Route maintenance mechanisms maintain the robustness and adaptability of the routing infrastructure.

In the realm of IPv6-based networks, the RPL introduces a set of ICMPv6 control messages tailored to its operation within LLNs. These messages serve crucial roles in managing and maintaining the routing topology, ensuring efficient communication in resource-constrained environments. Below, we explore the key ICMPv6 control messages associated with RPL:

• DIS: A node that wants to join the DODAG sends out DIS messages [2]. When a node desires to join a DODAG but lacks information about potential parent nodes or the DODAG's configuration, it broadcasts a DIS message. Upon receiving a DIS, suitable DODAG parents respond with a DIO.

• DIO: This type of message carries crucial details regarding the DODAG, including its configuration parameters, such as OF, DODAGID, and various metrics. Upon receiving a DIS or as part of periodic DIO transmissions, DIO messages are disseminated by DODAG parents to provide comprehensive routing information to neighbouring nodes. This enables nodes to make informed decisions about joining or optimizing their participation in the DODAG.

• DAO: Nodes use DAO messages to communicate their accessibility and the resources they have available to upstream nodes in the DODAG. When a node intends to send data to destinations outside the DODAG, it sends DAO messages towards the root of the DODAG. These messages inform upstream nodes about the node's presence and resource availability, enabling efficient routing path establishment.

• DAO-ACK: This type of message serves as acknowledgements for received DAO messages, confirming successful DAO propagation. When a DAO message is received, intermediate and root nodes generate DAO-ACK messages to acknowledge successful receipt and deal with the DAO. DAO-ACK messages help ensure reliability in DAO message delivery.

2.2. Sinkhole Attack

In the context of the RPL, a sinkhole attack represents a significant security threat. This attack diverts data flow directed towards an attacking node, known as the sinkhole, instead of the intended destination [15]. The sinkhole node, appearing legitimate, deceitfully asserts itself as having the fastest or most dependable route to a specific destination. This manipulation can occur through a decreased rank attack, wherein the attacking node deliberately reduces its rank to entice neighbouring nodes into selecting it as their preferred parent. Once traffic is rerouted to the sinkhole node, the attacker can intercept, manipulate, or launch further attacks on the communication. This may result in unauthorized entry, data leaks, or interference with essential network operations. Sinkhole attacks target the security gaps in routing protocols to compromise network operations or compromise nodes to gain control over the network's routing information. The attacker may falsify routing messages or utilize compromised genuine nodes to propagate false routing updates, tricking other nodes into routing traffic through the sinkhole. So, in short, it intercepts all signals from a wireless network and reroutes some information. Consequently, if a packet is intercepted, the intended recipient does not receive the message [16].

This paper implements sinkhole attacks using a combination of decreased rank and blackhole attacks. Blackhole attacks typically involve the malicious node intentionally dropping all packets it is meant to forward, effectively disrupting communication similar to a DoS attack. Blackhole attacks are classified as topology attacks as shown in Figure 3, which aim to disrupt the network's topology-building processes. This interruption may result in the isolation of one or more nodes within the network. The Sinkhole attack model illustrated in Figure 4 is implemented according to Algorithm 1.

Figure 3.

Figure 4.

Performance evaluation parameters

This simulation evaluates the performance of mobile RPL-based IoT networks under a sinkhole attack by using metrics such as number of isolated nodes, PDR, IPT, and power consumption. The definitions, formulas, use cases, and scope for these metrics are explained below.

• Number of isolated nodes: It refers to the count of nodes that are unable to communicate with any other nodes in the IoT network. This isolation can occur due to various reasons such as hardware failures, network congestion, interference, or malicious attacks (e.g., sinkhole attacks).

  The Number of isolated nodes is calculated using the following formula (Equation (1)):

  1

  $$I=N-C$$
  where I is the number of isolated nodes, N is the total number of nodes in the network and C is the number of connected nodes that have sent at least one packet to the sink node.

  Use Case:

  1) An increased number of isolated nodes might indicate a potential attack, such as a sinkhole attack, where certain nodes are deliberately isolated to disrupt the network.

  2) Regularly checking for isolated nodes helps in identifying and addressing connectivity issues promptly, ensuring the network’s robustness and reliability.

  3) Understanding isolation patterns can help in optimizing the placement and configuration of nodes to enhance network performance and resource utilization.

  Scope: Vital for real-time monitoring systems to ensure ongoing network reliability and security.

• Packet delivery ratio (PDR): It represents the proportion of packets that reach their destination compared to the total number of packets sent by the source in a network. It indicates how dependable something is and the efficiency of the network in delivering data.

  The PDR is calculated using the following formula (Equation (2)):

  2

  $$PDR =\frac{ Number of Packets Received at Sink }{{\displaystyle {\sum }_{i=1}^{N}PacketsSentByNod{e}_i}}$$

  Use Case:

  1) Assessing the performance and reliability of different types of networks, such as IoT networks, wireless sensor networks, mobile ad hoc networks, and traditional wired networks.

  2) PDR is a key metric to ensure QoS.

  3) Evaluating the effectiveness of different routing protocols in delivering data packets.

  Scope: In IoT networks, a high PDR ensures that data from sensors and devices is reliably transmitted to central systems for processing and action.

• Inter-packet time (IPT): The time interval between the arrival times of consecutive packets at a particular point in the network.

  The Inter-packet time is calculated using the following formula (Equation (3)):

  3

  $$IPT=\left(t_{i+1}-t_i\right)sec$$
  where t_i+1 is the arrival time of packet i + 1, t_i is the arrival time of packet i.

  Use Case:

  1) Monitoring traffic patterns and burstiness.

  2) Detecting anomalies or changes in network traffic.

  3) Analyzing network load and congestion.

  Scope: Usually measured at a single point in the network, such as at a gateway node in the RPL-based IoT network.

• Power consumption: In the context of networked systems, particularly IoT devices, it refers to the amount of electrical energy consumed by a device or system while performing its functions. It is an important metric for assessing the efficiency and sustainability of devices, especially in environments where battery life and energy efficiency are critical.

  Power consumption can be calculated using the formula (Equation (4)):

  4

  $$PowerConsumption=\left(\frac{E_t}{T_t}\right)mW$$
  where E_t = (E_Transmit + E_Listen + E_CPU + E_LPM) mJ

  Power consumption is calculated by considering the energy spent in different operational states of an IoT node, including transmission energy (E_Transmit), listen energy (E_Listen), CPU processing energy (E_CPU), and low-power mode energy (E_LPM). Transmission Energy refers to the amount of energy spent on transmitting data, while listen energy refers to the energy needed for listening to received packets. The CPU processing energy refers to the energy needed in performing routing and attack detections. The low-power mode energy refers to the energy needed in sleeping or idling the node in order to save battery life.

  Total energy consumption is achieved by adding up all the above energies for the period that they operate. The time variable (T_t) denotes the observation period during which node activities are monitored and measured. It represents the cumulative duration over which transmission, reception, processing, and idle-state operations contribute to the overall energy expenditure of the network.

  Use Case:

  1) Analyzing the power consumption of each sensor node during data collection, processing, and transmission phases.

  2) Identifying power-hungry processes and optimizing them.

  3) Implementing energy-efficient communication protocols.

  Scope: Power consumption is a critical factor across various domains and applications, particularly in IoT devices, ensuring long battery life for remote and portable devices.

5.1. Number of Isolated Nodes

As previously discussed, the primary objective of a sinkhole attack is to isolate sensor nodes within an RPL-based IoT network. The "Number of isolated nodes" metric is particularly important in assessing the impact of such attacks, as it directly reflects how effectively the network is compromised. Figure 5 illustrates the effect of a sinkhole attack on different types of IoT networks: static, hybrid, and mobile. The entries marked as N/A do not indicate missing data or excluded scenarios. Instead, they represent simulation cases in which the corresponding metric recorded a value of zero.

Figure 5.

In the static network, where all nodes remain fixed, the number of isolated nodes rises as the number of attacker nodes increases. This is because the static nature of the network makes it easier for attackers to consistently target and isolate specific nodes, leading to a significant disruption in network communication. Similarly, in the mobile network, where all nodes are mobile, the sinkhole attack also has a profound effect. The mobility of the nodes creates dynamic topology changes, which, when combined with the presence of attacker nodes, results in an increased number of isolated nodes. The attackers can exploit the movement patterns to isolate nodes more effectively, further weakening the network.

In contrast, the hybrid network, which comprises both static and mobile nodes, shows a comparatively lower increase in the number of isolated nodes. The mixed nature of the network, where half the number of nodes is mobile and half are static, makes it more challenging for attackers to isolate a significant number of nodes. The diverse movement and positioning of the nodes provide a level of resilience against the sinkhole attack.

In scenarios where there is no attack, the static network exhibits zero isolated nodes, indicating a fully connected and functional network. However, in hybrid and mobile networks, even in the absence of an attack, the number of isolated nodes increases slightly due to the inherent challenges posed by node mobility, such as temporary disconnections or changes in network topology. Overall, this analysis demonstrates that while static and mobile networks are highly vulnerable to sinkhole attacks, hybrid networks offer a more robust defense, reducing the impact of such attacks on the IoT network.

5.2. Packet Delivery Ratio

Figure 6 illustrates the impact of a sinkhole attack on an RPL-based IoT network as the number of nodes increases, alongside the percentage of attacker nodes, in static, hybrid, and mobile networks. The effect of the attack is visible as the average PDR steadily declines with an increasing number of attackers.

Figure 6.

In the static network, there is a dramatic drop in PDR when transitioning from a no-attack scenario to an attack scenario. However, as the number of attacker nodes continues to increase, the rate of decline in PDR slows down. This suggests that even a small number of attackers can initially isolate a significant portion of nodes, severely disrupting the network. When the number of nodes increases, the drop in PDR is less pronounced due to network congestion. Interestingly, when the network has between 20-30 nodes, the PDR improves, likely because the increased number of neighbours allows packets to be forwarded via shorter paths.

In the hybrid network, even in the no-attack scenario, the average PDR is already reduced by 37% due to mobility, which introduces instability in the network. As the percentage of attacker nodes rises, the average PDR continues to drop, indicating that as more nodes are isolated, the PDR decreases. Nodes 20 to 30, PDR improves because additional neighbours provide shorter paths for packet forwarding. However, further increases in nodes lead to a decrease in PDR due to congestion.

In the mobile network, the no-attack scenario already shows a significant 70% drop in PDR, largely due to the mobility of the nodes, which causes frequent disconnections and route changes. As the number of attackers increases, the PDR drops further but eventually shows a slight improvement. This indicates that congestion is reduced as the attacker nodes increase, possibly because the network becomes less dense, making it easier for packets to find a clear path. When the number of nodes increases, PDR initially improves due to the availability of more neighbours, enabling packets to be forwarded via shorter paths. However, as the network becomes more congested, the PDR drops again, showing that congestion eventually outweighs the benefits of having more neighbours. In conclusion, this analysis shows that in a mobile network, two factors significantly impact PDR as the number of nodes increases: congestion and the availability of shorter paths. As congestion increases, PDR decreases, but when more neighbours are available to forward packets via shorter paths, PDR improves.

5.3. Inter-Packet Time

The IPT metric is minimally affected by the presence of attackers but is highly sensitive to mobility, as shown in Figure 7.

Figure 7.

In a static network, increasing the percentage of attacker nodes results in little to no change in the average IPT. This indicates that when attacker nodes isolate sensor nodes, IPT remains largely unaffected. Interestingly, in some cases, IPT decreases with a higher percentage of attackers due to the reduced congestion in the network caused by the isolation of nodes. When the number of nodes in the static network increases, there is also no significant change in IPT. Since the positions of the nodes are fixed, packets reach the gateway without delay, leading to a stable IPT. Occasionally, IPT decreases as the number of attacker nodes increases, again due to less congestion as more nodes become isolated.

In the hybrid network, IPT increases by approximately 90 seconds due to mobility as compared to the static network. As attacker nodes increase, IPT generally decreases, which can be attributed to reduced congestion from the isolation of more nodes. When the number of nodes in the hybrid network are 30, IPT first rises and then falls, reflecting the network's instability caused by mobility. The initial increase in IPT indicates that mobility is causing delays, while the subsequent decrease suggests that isolated nodes reduce congestion, making packet delivery more efficient.

In the mobile network, IPT decreases further as the proportion of mobile nodes grows, continuing the trend observed from the static to the hybrid network. When the number of attacker nodes increases, IPT initially rises, then falls, and sometimes rises again. This pattern occurs because mobile attacker nodes disrupt the packet forwarding routes, leading to delays and increased IPT. However, if attackers do not significantly disrupt the routes, IPT may decrease. As the number of nodes in the mobile network increases, IPT first decreases and then increases. Initially, the presence of more neighbours allows packets to take shorter paths, reducing IPT. However, as the number of nodes continues to rise, congestion begins to outweigh the benefits of these shorter paths, leading to an increase in IPT. This demonstrates that in mobile networks, congestion can eventually dominate the efficiency gains provided by additional neighbours, leading to an overall increase in IPT.

5.4. Power Consumption

Since IoT networks are composed of resource-constrained devices, efficient power consumption is essential for maintaining device connectivity. Therefore, average power consumption is one of the most important metrics to evaluate in such networks. The analysis of this metric is shown in Figure 8, where the effect of increasing the percentage of attacker nodes on power consumption is examined.

Figure 8.

In the static network, it is evident from the graph that power consumption generally increases as the number of attacker nodes rises. This happens because attacker nodes isolate sensor nodes, reducing the number of neighbouring nodes available to forward packets. As a result, the network often fails to find the shortest paths, leading to increased power consumption. The graph also shows that power consumption tends to increase as the number of nodes grows, likely due to network congestion. However, in some instances, power consumption decreases, which may be due to the availability of more neighbours that help forward packets along shorter paths, thereby reducing energy usage.

The hybrid network exhibits a similar trend to the static network. However, the gap in power consumption between different percentages of attacker nodes is narrower in the hybrid network compared to the static network. This reduced gap is attributed to the mobility of nodes, which introduces a level of dynamism in the network. Despite this, overall power consumption continues to increase as attacker nodes are added, similar to what is observed in the static network.

When examining the mobile network, the graph shows that power consumption increases even more compared to the hybrid network. This confirms that as the number of mobile nodes increases, power consumption also rises. In the mobile network, as the number of attacker nodes increases, power consumption initially rises, then decreases. This pattern can be explained by two factors previously discussed: congestion and the availability of shorter paths in the network. As attacker nodes isolate others, congestion may decrease, but the availability of shorter paths plays a crucial role. If the network can still find shorter paths despite the attack, power consumption may decrease. However, if shorter paths are not available, power consumption will increase. Finally, as the number of nodes in the mobile network increases, power consumption initially rises and then falls. This indicates that the same two factors, congestion and the availability of shorter paths are at play. Initially, congestion causes power consumption to increase, but as more neighbours become available and shorter paths are found, power consumption decreases. However, if congestion becomes too severe, power consumption rises again, demonstrating the complex interplay between these factors in a mobile IoT network.

The results indicate that sinkhole attacks can cause substantial degradation in RPL-based IoT networks, particularly when attacker density increases. In the literature, mitigation approaches such as INTI [51], SoS-RPL [52], RFTRUST [53], InDReS [54], and NADSA [55] have been shown to improve detection accuracy and reduce false alarms to varying degrees, but their reported performance is generally dependent on network conditions such as node density, traffic pattern, and mobility. The attack effects observed in this study are consistent with those findings, showing that malicious nodes can significantly lower packet delivery reliability while increasing routing disruption and false forwarding behavior. This suggests that any mitigation strategy must be robust enough to maintain stable detection performance under changing network conditions, especially in dense and dynamic IoT deployments. Therefore, the present results provide a useful baseline for comparing the severity of sinkhole attacks against the effectiveness of existing defense mechanisms reported in the literature.

6.1. Implementation Overhead

In this analysis, a sinkhole attack was applied to an RPL-based IoT network. The attacker nodes, sensor nodes, and gateway nodes used for implementation were all of the Zolertia Z1 mote type. As shown in Figure 9, it is evident that the sinkhole attack was implemented with minimal overload because both ROM and RAM usage were lower than the standard Zolertia Z1 node. This allows us to conclude that the sinkhole attack can be implemented with less overload in static, hybrid, and mobile networks.

Figure 9.

6.2. Limitation and Future Work

This study has some limitations. First, the evaluation is based solely on simulations conducted in the Cooja environment and does not include validation using real-world IoT testbeds. Second, node mobility is modeled using only the Random Waypoint mobility model, and different mobility patterns may lead to variations in network behavior. Finally, the scope of this work is limited to analyzing the impact of sinkhole attacks on mobile RPL-based IoT networks; therefore, no attack detection or mitigation mechanism is proposed or evaluated. Future work will address these limitations through real-world experimentation, the use of additional mobility models, and the investigation of suitable mitigation strategies.