A novel fragment duplication attacker identification scheme using Discrete Event System based intrusion detection

Secure mechanisms protect IoT-6LoWPAN from external attackers, yet, lack of authentication capabilities and the scarcity of resources render the 6LoWPAN susceptible to various design-level internal attacks. Especially, the fragmentation mechanism is easily exploited by replaying spoofed fragments, timely slipped in by an eavesdropping attacker. Neither the original fragment nor the sender node authenticity is differentiable here, making most solution techniques challenging given the resource constrained environment. Current techniques have mostly employed mitigation methods like buffer quarantine and logical node isolation. However they are either incomplete or incur high computational overhead, since the duplicate fragment is replayed. In this paper, a probing based mechanism for attack node localization is proposed. Attack node is differentiable from normal nodes using the probing technique. Our proposed scheme is decentralized, utilizing a set of DES based IDS. Moreover, we eliminate the localized node using the kill switch mechanism to secure the 6LoWPAN. Completeness and correctness of our approach is proved and we implement it in simulation as well as real testbed. The results are observed to be superior to existing works. Minimum false positives and an accuracy over 99.8% is shown to be achieved while identifying the malicious nodes. Nonetheless, our scheme is energy efficient and takes lower detection time.