Early Detection of Node Capture Attack in the Internet of Things

Due to the characteristics of small volume, low power consumption and often distributed in unattended corners, node devices in IoT have become the main entrance for attackers to control the network. In order to detect abnormal nodes as early as possible, we study the detection methods in the early stage of node capture attack in this paper, and combine the characteristics of the most commonly used MQTT protocol in the Internet of things with core idea of typical detection methods. Under server-client architecture, heartbeat message and greeting message are used together to monitor the node state. Finally, a review module determines the node state to avoid false positives when an exception is found. In order to balance the detection rate and network traffic consumption, we design an adaptive mechanism of heartbeat frequency.