SYSTEM FOR DATA COLLECTION AND DETECTION OF DISTRIBUTED DENIAL OF SERVICE ATTACKS IN THE RPL-BASED NETWORKS

Abstract

Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks are among the main security threats to Internet of Things (IoT) networks today. This type of attack leads to the loss of access to the device or the resources it offers. Therefore, with the aim of countering such cyber threats, it is proposed, a system for data collection and detection of distributed denial of service in the RPL-based networks is presented. The system consists of three modules: a data gathering module, a classification module and a detection module. The main purpose of the data collection module is that data collection was provided by several sniffers installed in the RPL network and with subsequent aggregation of the collected data. For the implementation of the classification module, research was carried out on the method of support vector machines (SVM) and a multilayer perceptron (MLP). The detection module was used to broadcast a message about the abnormal behaviour to the rest of the RPL network nodes, containing the ID of the compromised node and the path to it.

To evaluate the efficiency of the proposed system that is based on the data collected by the data gathering module, a number of experiments are conducted. To obtain the data set for the experiments, an infrastructure based on the Ubuntu operating system and the Cooja simulator are deployed, which allowed to simulate the RPL network. Based on the operation of the deployed network, network traffic was collected that corresponded to both legitimate traffic and traffic during a black hole attack. The total number of test data was 24,023 samples. According to the research results, it is established that the SVM-based model demonstrated better performance level, in particular, the accuracy of detecting denial-of-service attacks was 89.6%, while the rate of false positives was 6%.