Detection and mitigation of Multicast DIS flooding attacks in RPL-based IoT networks

Routing Protocol for Low-Power and Lossy Networks (RPL) is the de facto standard for IPv6-based wireless sensor networks in Internet of Things (IoT) environments. However, the inherent characteristics of Low Power and Lossy Networks (LLNs), including limited energy resources, constrained memory and processing capabilities, high packet loss rates, and dynamic network topologies, make RPL highly susceptible to control plane disturbances. Among these, multicast DIS flooding attacks are particularly damaging, as they repeatedly trigger Trickle timer resets across multiple neighbors, causing excessive control message propagation, severe energy depletion, and routing instability. Existing countermeasures often require protocol modifications, incur high overhead, or fail to discriminate between normal and malicious multicast DIS patterns in dynamic environments. Motivated by these challenges, this work proposes DIS-FDM, a lightweight, fully distributed detection and mitigation scheme for multicast DIS floods. DIS-FDM employs Dempster-Shafer theory (DST) to fuse evidence from local DIS traffic load and parent change frequency, allowing accurate attack detection without altering core RPL functions. The simulation results in Contiki/Cooja demonstrate that DIS-FDM significantly reduces control overhead, improves packet delivery ratio, and reduces power consumption compared to baseline RPL and existing defenses.