Accurate Detection of Sinkhole Attacks in IoT Networks Using Local Agents

In this paper we explore the feasibility of employing
local security agents to detect sinkhole attacks in
IoT multihop networks. Sinkhole attacks, which divert traffic
towards the compromised node(s), prevent information from
reaching their intended destination. Sinkhole attacks are unique
in their operation and are often difficult to be recognized
locally. We examine three types of local agents and employ
thresholds, binary logistic regression (BLR) and support vector
machines (SVM) as anomaly detectors. The local security
agents’ deployment and evaluation is done both in a simulated
environment and in a real network of resource-constrained
nodes. We have concluded that threshold-based detection is not
suitable for deployment in local agents. During the evaluation
phase, the BLR and SVM detection modules for the Sinkhole
attack are found to be able to detect the presence of the Sinkhole
attack, with exceptionally high accuracy.