Designing Efficient Sinkhole Attack Detection Mechanism in Edge-Based IoT Deployment

• Main Authors: Sumit Pundir, Mohammad Wazid, Devesh Pratap Singh, Ashok Kumar Das, Joel J. P. C. Rodrigues, Youngho Park
• Format: Article
• Language: English
• Published: MDPI AG 2020-02-01
• Series: Sensors
• Subjects: sinkhole attack; internet of things (iot); intrusion detection; edge computing; ns2 simulation; security
• Online Access: https://www.mdpi.com/1424-8220/20/5/1300

The sinkhole attack in an edge-based Internet of Things (IoT) environment (EIoT) can devastate and ruin the whole functioning of the communication. The sinkhole attacker nodes (<inline-formula> <math display="inline"> <semantics> <mrow> <mi>S</mi> <mi>H</mi> <mi>A</mi> </mrow> </semantics> </math> </inline-formula>s) have some properties (for example, they first attract the other normal nodes for the shortest path to the destination and when normal nodes initiate the process of sending their packets through that path (i.e., via <inline-formula> <math display="inline"> <semantics> <mrow> <mi>S</mi> <mi>H</mi> <mi>A</mi> </mrow> </semantics> </math> </inline-formula>), the attacker nodes start disrupting the traffic flow of the network). In the presence of <inline-formula> <math display="inline"> <semantics> <mrow> <mi>S</mi> <mi>H</mi> <mi>A</mi> </mrow> </semantics> </math> </inline-formula>s, the destination (for example, sink node i.e., gateway/base station) does not receive the required information or it may receive partial or modified information. This results in reduction of the network performance and degradation in efficiency and reliability of the communication. In the presence of such an attack, the throughput decreases, end-to-end delay increases and packet delivery ratio decreases. Moreover, it may harm other network performance parameters. Hence, it becomes extremely essential to provide an effective and competent scheme to mitigate this attack in EIoT. In this paper, an intrusion detection scheme to protect EIoT environment against sinkhole attack is proposed, which is named as SAD-EIoT. In SAD-EIoT, the resource rich edge nodes (edge servers) perform the detection of different types of sinkhole attacker nodes with the help of exchanging messages. The practical demonstration of SAD-EIoT is also provided using the well known NS2 simulator to compute the various performance parameters. Additionally, the security analysis of SAD-EIoT is conducted to prove its resiliency against various types of <inline-formula> <math display="inline"> <semantics> <mrow> <mi>S</mi> <mi>H</mi> <mi>A</mi> </mrow> </semantics> </math> </inline-formula>s. SAD-EIoT achieves around <inline-formula> <math display="inline"> <semantics> <mrow> <mn>95.83</mn> <mo>%</mo> </mrow> </semantics> </math> </inline-formula> detection rate and <inline-formula> <math display="inline"> <semantics> <mrow> <mn>1.03</mn> <mo>%</mo> </mrow> </semantics> </math> </inline-formula> false positive rate, which are considerably better than other related existing schemes. Apart from those, SAD-EIoT is proficient with respect to computation and communication costs. Eventually, SAD-EIoT will be a suitable match for those applications which can be used in critical and sensitive operations (for example, surveillance, security and monitoring systems).