Abstract—Internet Protocol version 6 (IPv6) over Low Power Wireless Personal Area Networks (6LoWPAN) is extensively used in Wireless Sensor Networks (WSNs) due to its ability to transmit IPv6 packet with low bandwidth and limited resources. 6LoWPAN has several operations in each layer. Most existing security challenges are focused on the network layer, which is represented by its routing protocol for low- power and lossy network (RPL). The 6LoWPAN with its Routing Protocol (RPL) usually uses nodes that have constrained resources (memory, power, processor). In addition, RPL messages are exchanged among network nodes without using any message authentication mechanism. Therefore, the RPL exposes to various attacks that may lead to network disrupt. A sinkhole attack is one of the attacks that is utilizing the vulnerabilities in RPL and attract considerable traffic by advertising falsified information data that change the routing preference for other nodes. This paper intents to propose a hybrid monitoring technique for detecting abnormal behaviour in RPL -based network. The proposed technique is evaluated using Cooja simulator in term of power consumption and detection accuracy. Also, the proposed technique was compared with other popular detection mechanisms.

Index Terms—Internet of things, intrusion detection system, sinkhole attack, WSN, RPL, 6LoWPAN

Cite: Mahmood Alzubaidi, Mohammed Anbar, Yung-Wey Chong, and Shadi Al-Sarawi, "Hybrid Monitoring Technique for Detecting Abnormal Behaviour in RPL-Based Network," Journal of Communications, vol. 13, no. 5, pp. 198-208, 2018. Doi: 10.12720/jcm.13.5.198-208.