Detecting Selective Forwarding using Sentinels in Clustered IoT Networks

Compromised relays in clustered IoT networks can be used to launch attacks that cannot be easily detected using the traditional security algorithms. In this paper, we consider an attack where a compromised relay deliberately drops the packets received from the IoT devices it serves. Such an attack causes the IoT devices to retransmit more frequently, thereby increasing their processing load. As a result, their batteries will drain at a faster rate. The difficulty in differentiating a genuine packet drop event from a malicious packet drop event makes it necessary to develop a novel Intrusion Detection System (IDS) specially tailored for detecting such an attack. The IDS is installed in a special node called a sentinel, which monitors the network. The sentinel also estimates the packet retransmission rate of the IoT devices, a parameter required for the IDS. The effectiveness of the system is demonstrated experimentally on a clustered network.