Behavioural Analysis of Hatchetman Attacker for Detection & Prevention in Low Power and Lossy IoT Network

The control of devices on a network is made possible by the Internet of Things (IoT). In the network still it’s difficult to control the device's response on the basis of requirements. The IoT nodes are capable of doing work on time and efficiently controlling the functioning of other devices. The purpose of a network is to create the proper connection among a number of devices or users. Users use the internet for proper data transfer with high speed for a limited time. The users are using the internet for properly transferring of data with high speed and limited time. In the network still the challenge is to control the device reaction on the basis of requirement. The IoT nodes are capable to do work on time and efficiently control the functioning of other devices. IoT is becoming increasingly important in today's high-tech society, which is characterised by the increasing connectivity of all intelligent devices to the internet. IoT is becoming increasingly appealing because of the growing number of nodes or devices that are connected to the internet [1]. The routing protocol plays an important role in transmitting information between IoT devices. The attacker's presence only degrades the actual routing procedure. IoT nodes are used with any network like Mobile Ad-hoc network (MANET), Flying hoc Network (FANET), Vehicular Ad-hoc Network (VANET) and Wireless Sensor Network (WSN) [2]. The open network is insecure and vulnerable to attacks such as flooding attacks and Denial-of-Service (DoS) attacks, which waste energy and channel capacity [3, 4]. The Internet of Things (IoT) integrates nearly all aspects of everyday life, including things like smart homes and healthcare systems. Several utilities can talk to each other and work together to provide a wide range of services. The nodes in the IoT are considered mobile because controlling stationary nodes is easy as compared to dynamic networks. Therefore, efficient utilization of node energy cannot use properly for communication of devices. Many of these connected devices will be very small and cheap, so they can be placed wherever they can be useful. This intelligent nature of things leads to an inclusive range of applications, including home automation, smart agriculture, healthcare, military surveillance smart cities, building management, healthcare, energy and transportation [1, 5]. The example of IoT is mentioned in Figure 1. Here the heterogeneous IoT devices or nodes are communicate with individually other with the help of internet signals.

a1.jpg

Figure 1. Example of IoT

The utilisation of IPv6 made the Internet of Things more appreciable and practicable, in addition to making its acceptance simpler [6]. Therefore, because IPv6 has a wider address space, it makes it possible for more computers to connect to the internet. As a result, they are able to communicate with each and every node in network. Additionally, machines have restricted amounts of energy, processing power, and computational capacity. In order to keep a close eye on and handle any situation, the resource-constrained sensing devices have been linked to the internet over IPv6 networks. So, for the future of Internet of Things applications, these devices need to be able to talk to each other in a safe way. The network attacker repeatedly injects incorrect information or sends out undesired packets in addition to impairing routing performance [4, 6]. Due to the widespread interest in this paradigm, low-power and lossy networks (LLN), including wireless sensor networks, have been widely deployed. A high loss rate and poor throughput are characteristics of networks with substantial resource constraints, such as energy, memory, computation, and their communication links. This is due to data being dropped or retransmitted. The efficient usage of requirements cannot be handled by the routing methods in use [5]. As a result, a full stack of standard protocols has been created, including the 6LowPAN protocol and the IEEE 802.15.4 standard protocol for the communication layers in WPANs (wireless personal area networks). The protocol is based on IPv6 and is known as RPL (Routing Protocol for Low Power and Lossy Networks) [6]. Examples of things that are connected to the IoT include a person who has an implanted heart monitor, farm animals that have biochip transponders, and automobiles that have built-in sensors to inform the driver when the tyre pressure is too low. Any other natural or man-made object that is capable of being furnished with an IP address and the capability to transmission data over a network is referred to as a network node. The increase in the number of smart nodes will result in an increase in the amount of upstream data generated by the nodes, which will give rise to new concerns around data privacy, data sovereignty, and security. The malevolent node that are capable to manipulates the source route header of the received packets is called a Hatchetman Attacker [7]. The Hatchetman attacker sends a large number of invalid packets with errors to genuine nodes. The genuine nodes are aware from the attacker presence in network. The invalid packets are dropped by genuine nodes by reply with an excessive number of error messages back to the DODAG root [6]. The congestion in network is responsible for energy consumption and poor channel capacity utilization [8].

Attackers or malicious nodes in IoT are engaging in a variety of malicious activities, which have resulted in damage to fundamental facets of security such as integrity, confidentiality, and privacy [10]. The attackers are also classified into a variety of categories, and the types of attackers that are represented by these categories are mentioned in the network [11, 12]. IoT nodes' inherent characteristics in network applications imply that any resource loss or compromise, regardless of the cause, is a malicious attack initiated by the adversary class and will have a critical negative impact on the entire network. Intelligent opponents who want to sabotage, harm, or steal network messages may be active around nodes placed across a very vast region. The network will suffer more losses because of the node compromise. IoT sensor nodes set themselves apart from other networks due to their resource-constrained nature. The only goals of the attacker are to cause packet loss, use up network bandwidth or connection capacity between mobile sensor nodes, and use a fake identity to talk on the network.

3.1 Active attack

It monitors and listens on an unauthorised communication channel while simultaneously modifying the data stream that is transmitted over that communication channel. These malicious actors are actively engaging in behaviour that is harmful to the network. The active attacks that are displayed here come in a variety of flavours [13, 14].

3.1.1 Blackhole attack

A packet consumption attack is what is known as the blackhole attack in network. The attacker identify the sender which participates in routing and send data to the receiver and reply fake route information to the sender by attacker. Then, if that happens, the attacker will lose all of their data, and the performance of the network will suffer.

3.1.2 Sybil attack

The network nodes perform routing actions in accordance with the routing protocol chosen. Only by establishing a strong link between the sender and the receiver can a strong link be established in that network. As a result, the number of packets that a network receives decreases. The flooding of routing packets is also increasing network latency.

An attacker node can replicate itself, and its presence can be felt in multiple locations. It seeks to address problems associated with fault tolerance by focusing on multiple identities for other nodes, distributed storage, multipath routing and topology in the networks. These malicious actors conceal their true identities and take over the identities of nearby nodes in order to carry out their attacks.

3.1.3 Flooding attack

In the network, a malevolent node that possesses a large radio transmission range and a significant amount of power sends "HELLO" packets to a number of mobile nodes that are not in range of another. During the time that data is being transmitted to the receiver or base station, the wounded nodes are attempting to communicate with the flooding attacker, which leads to increased spoofing [14].

3.1.4 DoS attack

This may have an impact at various layers, including the physical layer, and the DoS attack is the jamming and tampering, when unintentional node failure or malicious node attacks cause any event that reduces the network's capacity. Malicious nodes target any occurrence that breaks down the network. Even though collision, unfairness, and exhaustion are going to take place in the link layer, a DoS attack is going to be guaranteed [15].

3.1.5 Hatchetman attack

An attack of this kind might also rely on the utilisation of laptop-class adversaries; that is, adversaries with a couple of orders of magnitude higher machine power than traditional IoT nodes, and with the confirmed identities of legitimate sensing element nodes that are operating within the network [7]. In addition, distributed denial of service attacks in an extremely sensing element network may lead to the exhaustion of the target node's limited energy resources as a result of the massive flow of requests that are directed towards it. This can happen if the network is extremely sensitive. In an extremely sensor network, a distributed denial of service attack is also referred to as a distributed energy-exhaustion attack. As a result of this, we have a tendency to call this type of attack by a different name. The solution against Hatchetman attacker is provided by the SHLPLN scheme.

3.1.6 Wormhole attack

This type of attack is the most severe type of attack that can be carried out on a IoT network. In this type of attack, two attackers who are working together to carry out the attack can use private high-speed networking to transfer packet at one location and replay it at the other location. This type of attacker not follows the safe path but choose path where attacker exist in network. As a result, this can be utilised against any and all communications in order to guarantee authenticity and confidentiality.

3.2 Passive attack

Passive attackers are not particularly harmful at first, but once they steal all genuine node information, they become more dangerous. However, it is possible for an unauthorised person to monitor and listen to communication channels, which does not affect the functioning of any communication systems. Because of their stoic demeanour, it is extremely difficult to locate these kinds of attacks. Because it is difficult for them to reorganise themselves, the passive attackers do not continuously shows activeness in network or perform malicious actions into the network [16].

3.2.1 Attack on privacy

In this attacker malicious node can easily collect information from a sensor network because there is a large amount of information that is available by remote access, and the information can be accessed remotely. In this section, various intrusions into privacy are well-defined.

3.2.2 Eavesdropping and monitoring

A common type of attack is for a data adversary to be able to quickly find communication control information for sensor network design that both affects privacy protection and has information. This type of attack is known as a communication control information disclosure.

3.2.3 Traffic analysis

In this attack the messages are encrypted before being sent, there is still a high probability that communication patterns will occur due to the activities of the nodes. This could result in information being altered, which would be detrimental to the IoT network.

The previous work that has already been done in the field of secure IoT communication is mentioned in this section. The security from attacks is provided by each author, and each one was contributed to resolve attacker problem:

Pu et al. [7] describe a "Hatchetman attack" on RPL-based LLNs. Hatchetman attacker node tampers with a received packet's source route header to send erroneous, incorrectly-routed packets to trustworthy nodes. Because it is unable to relay incorrect packets using the error route, the legitimate node drops them. The identified research gap by the authors does not concentrate on enhancing routing performance while there are attackers present in the network. The research lacks the identity of the Hatchetman attacker [7].

Sharma et al. [25] proposed an investigation of Hatchetman's performance on RPL-6LoWPAN networks was suggested by When an unauthorised node alters the header of a packet it receives and subsequently sends faulty packets to authorised nodes with the incorrect route information, it is committing a Hatchetman attack. Unavoidably, authorised nodes will drop packets and reply to DODAG's root with several error signals. This leads unauthorised nodes to lose a lot of packets, and the excessive amount of error messages wears down the node's energy and communication bandwidth. The gap in the research is they only focuses on detection rather than how networks behave after deployed security measures. The effects of a Hatchetman assault on RPL-based IoT networks are demonstrated by simulation results, not by the effectiveness of security measures in RPL-based Internet of Things networks.

Arshad et al. [26] proposed a lightweight protocol that is effective at both detecting malicious Sybil nodes and conserving energy. It guards against fake and stolen identities for both mobile and stationary or non-stationary IoT networks. Computes are offloaded to resourceful nodes to extend network lifetime. This study focuses on increasing node energy efficiency and preventing nodes from running out of power. By removing trust-related operations from the root node, it also hopes to lower compute and data storage costs. Third, find and isolate the Sybil attack node that is based on IoT. The research gap is dropping information of packets missing in the research. In the case of a drop, the energy information is less than that of a flood of packets in a network

Soni and Sudhakar [27] proposed a L-IDS technique for WSN-assisted IoT black hole attack was proposed by Sensor nodes connected by wireless links exchange packets and data routing. RPL is the routing protocol for IPv6. The suggested IDS verified the existence of the blackhole attacker and put a halt to his nefarious activities. The research on packet dropping attacks and attacker infection has not been evaluated. The research gap is that attacker energy use is not assessed. The research is solely concerned with packet dropping rather than flooding.

Thulasiramany and Wang [28] proposed a trust-based security architecture for RPL was created by and can identify external assaults in mobile IoT. The architecture was based on widely used security mitigation strategies including nonce identity, timestamping, and network whitelisting, but this research is the first to combine these factors for RPL. Among the paths already established in the IoT dynamic network, RPL can select the best one. The choice based on the receiving node will notify the DODAG root of the source route header issue. The research gap is the presence of attackers only, which is only decided by the trust calculation, with no other criteria decided for cross-checking the trust value count. The normal routing performance was not evaluated.

Khan and Herrmann [29] proposed an Intrusion detection system (IDS) to identify network attacks on distributed systems, such as DoS attacks. Performance of standard routing is not assessed. An IDS uses signatures to scan network traffic for signs of attacks. An anomaly-based IDS searches for behavioural anomalies that could be signs of assaults. Unlike signature-based IDS, they can discover novel attacks. They frequently report phoney attacks. How much each node can be relied upon, as well as how powerful its average received signal is. Priorities are the foundation of the trust value notion, although it is unclear how they affect performance. Unwanted packet injection by a DoS attacker was not assessed.

A straightforward approach for encrypting data with a private key was proposed by Chaudhry [30]. Modify the bundle architecture. Any routing protocol can be used with this process by altering the client information. These keys are kept in each base node together with the bit's individual ID. Using an arbitrary key from the vast encryption key, messages are jumbled.

Alsadi and Mohan [31] developed a plan in which a wireless transceiver with multi-directional antennae was attached to it. The data is safely transmitted from the reception node to the fusion centre. To prevent eavesdropping, this study proposes to develop an intelligent Internet of Things node that can identify the safest channel and deliver data over it. The suggested node's internal transceiver allows for direct communication with other network nodes. Any information the fusion centre has after sending its CW signal is sent as a backscattered signal through its semi-passive tag.

Conti et al. [32] proposed a SPLIT secure and extensible routing protocol built on RPL. The suggested method sends and receives attestation data using RPL's route discovery and periodic topology maintenance messages. While reducing overhead and device attestation time, SPLIT scales attestation. SPLIT makes advantage of the RPL protocol to aggregate attestation reports from devices in large-scale IoT networks efficiently (in terms of time, energy, and network overhead). For linking devices over RPL, the SPLIT IoT routing protocol is a reliable and scalable choice. The main gap is not only to measures the flooding malicious behaviour of attacker and effect of attacker infection on resources of communication. The few researchers highlight the classification or learning based security schemes [33-36].

The Hatchetman's attack is highly furtive and grimmer to detect. This is due to the attacker node's deceptive behaviour, which includes discarding received packets and sending several error messages in response, as well as the unlawful packets it delivers to legitimate nodes to cause them to attack the network. Since every action a node takes requires coordination with other nodes, which is impossible without communication, the proposed SHLPLN identifies Hatchetman attacks on the basis of significant packet flooding, which uses up unnecessary resources like bandwidth and energy from other normal nodes. The research is divided into three modules:

1. Hatchetman attack Module
2. Previous RPL scheme Module
3. Security from Hatchetman Attacker in Low Power and Lossy Network (SHLPLN) Module

The normal profile includes normal transmission (TCP with FTP transmission and UDP with CBR transmission). It also contains the network's packet flow path. This information is obtained prior to the attacker node entering the network. The malicious node then enters the network in place of a Hatchetman attack.

It captures information from the normal profile and infects the susceptible node in the network via detention flooding information of node/s in networks, after which the malicious node configures the flooding rate, malicious node port number and percentage of vulnerability to measure attacker infection. If the detailed network's and abstract network's probing ports are the same, the attacker node sends infected packets to all neighbour nodes and infect the whole network. A security scheme matches some information about suspicious nodes, shown below in Figure 4.

4.jpg

Figure 4. Simple model of SHPLN

The Intrusion Information gathers information from both the normal profile and the attacker node and compares it to detect an intrusion. It looks for information such as the attacker's node number, port number, attacker symptoms, and time of intrusion.

7.1 SHLPLN attacker detection and prevention

The proposed algorithm finds Hatchetman attacks based on high packet flooding, which uses up bandwidth and energy from other normal nodes that aren't needed. This is because coordination between nodes is needed for every operation a node can do, and coordination is impossible without communication. Every aspect of the Internet of Things' future must be created, examined, and given the go-ahead before being extensively used. The Internet of Things as a whole will be impacted by high dimensionality, which will result in issues and difficulties in both space and time.

1. Hatchetman assault Node misbehavior can result in service disruption or even network failure. In the proposed work, we proposed a new protection scheme against node misbehavior during Hatchetman attacks. Security from Hatchetman attacker in Low Power and Lossy Networks (SHLPLN) system identifies the attacker by maintaining the profile of each node that participates in communication. The attacker's profile does not match that of normal nodes, and only infection is discovered in the case of an attacker. In this plan, the routing behavior of nodes is first looked at, and then the right, well-thought-out security plan is used to stop all of the malicious behavior of Hatchetman attacker nodes and make the network more stable. Find malicious node that causes Hatchetman attack and take away the Hatchetman attacker from the network. The clear flow mentioned in Figure 5.
2. Higher standards for safety, dependability, security, energy efficiency, performance, robustness, cost effectiveness, etc. will be imposed as the IoT develops in large-scale and pervasive directions. This implies that every aspect of the Internet of Things' future must be created, examined, and given the go-ahead before being extensively used IoT develops in large-scale and pervasive directions.

5.jpg

Figure 5. SHLPLN for Hatchetman Attacker Identification

The performance of previous and proposed scheme measured by different performance metrics. The performance metrics are showing better results in SHLPLN. In IoT devices having limited processing capability and memory but few devices having sufficient amount of memory for processing and forwarding information to other nodes. Nodes in network can’t move but forwarding the all information to sink node for control the other devices and proper functioning.

The Hatchetman attacker is flooding the packets with unnecessary information, and because of that, the limited bandwidth and energy of nodes are wasted trying to handle the unwanted packets in the network. The IoT network is secure from attackers by applying the proposed SHLPLN scheme that not only detects but also prevents the network from attackers.

1. First of all, the sender broadcasts the request to establish a connection between the sender to receiver through RREQ (Route Request), and the intermediate nodes that receive RREQ also generate RREP (Route Reply) packets.
2. If the link in the network is not available, then the RERR (Route Error) message is generated.
3. If the attacker is a Hatchetman, flooding is high and continuously increases in network and energy depletion is high. nodes are
4. The main focus on the energy of nodes e_i or channel capacity c_ij between the nodes. The c_ij is on priority. Only normal and high parameter consider for measure cannel capacity.
5. The high parameter measurement is depended on the heavy flooding or flooding is more than expected.
6. The target of attacker are resources like bandwidth and limited energy source.
7. In the presence of an attacker, the energy consumption of nodes is increasing but the number of data packets received is very small.
8. The flooding of unwanted data is enhancing the energy consumption to find an attacker.
9. The attacker does not receive any packets in the network, but only sends them.
10. The attacker's packet flooding is enhanced according to time constraint and watched by W_k node.
11. After attacker confirmation P_t Broadcast h_t malicious activity to all alive nodes or remaining nodes in network.
12. If the flooding is normal then no need to identified attacker, communicate with other nodes normally and sends data to destination.
13. Finally measure the effect of attacker and security scheme by metrics.
14. All metrices showing improvement in performance in presence of Hatchman attacker in network.

7.2 SHLPLN algorithm

Behavioral Analysis of Node for Hatchetman attack prevention in Low Power dynamic network. First of all, mention the inputs and use symbolic representation.

The attacker information is important for detection of abnormal behaviour during the routing in network.

The all possibilities of channel capacity consumption with receiving are mentioned in Table 1. The 70% PDR is the target and next hop information is false but channel capacity is high, means attacker/s are flooding in network.

Table 1. Genuine nodes and attacker nodes analysis by W_k

Although SHLPLN security using RPL is feasible, a Hatchetman attack mechanism is presented to identify malevolent nodes. Therefore, creating a system to secure the RPL is a crucial component and an unsolved task in the Internet of Things space. To ensure that the state changes of the network components and the devices responsible for network connectivity are managed in accordance with the security requirements, routing security must be ensured. The creation of threat models and the execution of a thorough threat analysis serve as important pre-requisites to the establishment of the security mechanism. Hatchetman attack detection is a useful technique for simulating security flaws and all potential attack starting points. All nodes participate significantly in node-to-node communication because they are either dependent base routes or collaborative forms. This gives one indicator of the issue: security. So, in this section, we create an algorithm for monitoring and defending against denial-of-service assaults. We initialize all variables first, then examine how denial-of-service assaults behave.

A Hatchetman attack is occurring if any node delivers undefined type packets at an abnormally high rate. However, the severity of that kind of attack is determined by reviewing historical data using a method that identifies the attacking node. After that, we apply a security scheme to remove malicious actions. The communication network is strengthened by the historical analysis base detection and upcoming real-time protection due to security concerns.

The performance comparison of protocols is mentioned in this section and the performance of proposed SHLPLN protocol is better. Here, only security scheme applied on 10% and 20% flooding of data because maximum up to 20% infection of data SHLPLN identified in the presence of attacker in network. The attacker infection is very high in normal routing but SHLPLN or proposed scheme are able to handle it properly. The all performance metrices are showing better performance of proposed scheme in low power and lossy network.

9.1 PDR analysis

The successful packets receiving determine the real performance of any security solution. In this PDR analysis simulation shown in Figure 6, a scenario with 50 mobile nodes is built, and the packet delivery ratio represents the proportion of current packets transmitted by the sender and received by the authentic receiver. A greater packet delivery ratio indicates that we will do better than the competition. According to our findings, if a misbehaving node enters the network at that time and the packet delivery ratio is low because of a severe flooding infection, the node will be unable to transfer data packets to their destination. The Detection and Prevention in Low Power and Lossy Network (SHLPLN) approach prevents attackers from acting maliciously. The suggested course of action is to fully eradicate the attacker's infection.

6.jpg

Figure 6. PDR analysis

9.2 Energy consumption analysis

The number of nodes in a network determines the availability of a scarce communication resource, i.e., energy or battery power. The energy usage of both methods is shown in Figure 7. Here, the proposed Detection and Prevention in Low Power and Lossy Network (SHLPLN) protocol is measured along with the energy usage in the case of the attacker protocol. The X-axis in this graph shows simulation time, and the Y-axis shows the total energy used by the network's 50 nodes. This graph shows the energy usage for a potential attacker, the old security method, and the suggested security method. The proposed protocol has a significantly lower energy consumption because it only uses energy for communication. The proposed protocol is performing significantly better now in terms of energy consumption. Better energy efficiency is also a factor.

7.jpg

Figure 7. Energy consumption analysis

9.3 Throughput analysis

The rate at which messages are successfully sent over a communication channel is known as "throughput," sometimes known as "network throughput. It is measured in terms of time units, or per second. This information may be transmitted over a logical or physical link or via a specific mobile ad-hoc network node. The throughput is often expressed in bits per second (bit/s or bps), although it can also be expressed as data packets per second or time slots. In comparison to earlier RPL, the Hatchetman attack, and detection and prevention in low-power and lossy networks (SHLPLN) systems, the suggested security scheme performs noticeably better. An attacker's throughput performance is shown in Figure 8 (measured in bytes/seconds) is insufficient to use the entire capacity of the funnel. Due to significant network flooding caused by the attacker infestation, packet loss is increasing. The planned security plan is performing better than expected.

8.jpg

Figure 8. Throughput analysis

9.4 Attacker packets flooding analysis

Hello packets or routing packets means the total number of routing packets sent on the network for connection establishment and starts data receiving from sender. The routing overhead is the ration of data received and total routing packets. If the overhead value is lower than 1, it means overhead for data transmission is less and more amount of data packets we can send in network.

9.jpg

Figure 9. Attacker flooding analysis

The aim research fulfil by maximum network utilisation through actual data transmission rather than through routing packets. In simulation case mentioned in Figure 9, we analyse all three cases of network routing packet analysis, and we get if a misbehaving node enters the network, the network routing overhead suddenly increases. That means the sender must establish a new route from source to destination but can’t find it, so recursively searching for the destination increases the unwanted load on the network. This graph only depicts the attacker flooding in the network over time.