Low false alarm rate RPL network monitoring system by considering timing inconstancy between the rank measurements

The IPv6 Routing Protocol for Low-power and Lossy networks (RPL) is a standard routing protocol to realize the Internet of Things (IoT). In order to realize secure IoT network, the Destination-Oriented Directed Acyclic Graph (DODAG) root collects information such as neighbor and parent ranks in each node and then observes network consistency by comparing a rank that a node sends to DODAG root with the rank that the same node sends to its neighbor nodes. However, the scheme has a problem that false detection rate is high since the DODAG root might compare a certain node's rank after update with its rank that its node sends to its neighbor nodes before update due to timing inconstancy between rank measurements. In this paper, we propose a low false alarm rate RPL network monitoring system by considering timing inconstancy between rank measurements. In the proposed scheme, each node sends ranks at the time when each node broadcasts the latest rank to the DODAG root so as to avoid inherent timing inconstancy, and each node attaches a timestamp at the time when each node sends and receives ranks and then sends the timestamp to the DODAG root in order to take timing inconstancy into consideration. We evaluate the false detection rates by computer simulation and we show that the proposed scheme reduces the false detection rate in comparison with the conventional scheme.