A Theil Index-Based Countermeasure Against Advanced Vampire Attack in Internet of Things

In the last decade, design, development, and advancement in embedded processing, sensing, and wireless communication have fueled the emergence of Internet of Things (IoT), where various smart devices communicate and cooperate with each other and existing communication systems to achieve the goal of sharing information and coordinating decisions. Meanwhile, IPv6-based Low Power and Lossy Network (LLN), which is a major building block of IoT, has attracted a fair amount of attention for all sorts of IoT applications and deployments. In order to provide IPv6 connectivity to an enormous number of resource-constrained smart devices in IoT environment, an efficient routing protocol for IPv6-based LLNs, also widely known as RPL, has been standardized. However, RPL lacks security protection and is vulnerable to various Denial-of-Service (DoS) attacks. In this paper, we first present an advanced vampire attack, which is a novel routing layer specific service disruption and resource exhaustion attack, against RPL in IPv6-based LLNs. Then we propose a Theil index-based countermeasure to effectively detect and mitigate advanced vampire attack. The basic idea of the proposed Theil index-based countermeasure is that each node measures the distribution of destination MAC addresses in the received data packets to detect advanced vampire attack. Through experimental study, the effectiveness of the Theil index-based countermeasure is validated, indicating a viable approach against advanced vampire attack in the IoT.