Routing protocol for low power and lossy networks (RPL) is the underlying routing protocol of 6LoWPAN, a core communication standard for the Internet of Things. RPL outperforms other wireless sensor and ad hoc routing protocols in quality of service (QoS), device management, and energy saving performance. The Rank concept in RPL serves multiple purposes, including route optimization, prevention of loops, and managing control overhead. In this paper, we analyze several different types of internal threats that are aimed at the Rank property and study their impact on the performance of the wireless sensor network. Our analysis raises the question of an RPL weakness, which is the lack of a monitoring parent in every node. In RPL, the child node only receives the parent information through control messages, but it cannot check the services that its parent provide hence it will follow a bad quality route if it has a malicious parent. Our results show that different types of the Rank attacks can be used to intentionally downgrade specific QoS parameters. This paper also reveals that attack in a high forwarding load area will have more impact on network performance than attack in other areas. The defenders can use the knowledge of such correlation between attack location and its impact to set higher security levels at particular positions by monitoring sensitive network parameters and detecting the anomalies.

This paper focuses on the security aspect of RPL (Routing Protocol for Low-power and lossy network) by introducing a new type of threat - the topology attack, which changes the node operation for breaking the optimised network topology, and designing a specification-based IDS for detecting it. We present two novel RPL attacks of this type: the rank attack and local repair attack. We also propose an IDS architecture using network monitor backbone, and describe its monitoring mechanisms through a RPL finite state machine implemented in each monitor node. We show that our system can effectively detect these routing operation threats with a reasonable overhead.

Routing Protocol for Low Power and Lossy network (RPL) is the underlying routing protocol of 6LoWPAN standard to enable the integration of Wireless Sensor Network on the Internet. Security is an essential requirement for the protocol/standard to be public accepted. One major security issue of RPL is the non-tamper resistant nature of the wireless sensor device, which can make it easy to be compromised and leads to cryptography keys exposed. If this happens, the attackers can join the network as the internal legitimate users and can manipulate the network operation based on controlling the compromised nodes. These internal attackers can make severe consequences to the network performance. In this paper, we present a simulation-based study of the impacts of different types of such attacks on RPL. We consider several new internal threats towards RPL, namely Rank attack, Local Repair attack, Neighbour attack and DIS attack. Specifically we study how the network performance can be affected by those attacks through metrics such as end-to-end delay, delivery ratio and control overhead generated. To the best of our knowledge, this is the first paper that studies the vulnerability and the performance of RPL under these internal security threats.

Connected autonomous vehicles (CAVs) will be deployed over the next decade with autonomous functionalities supported by new sensing and communication capabilities. Such functionality exposes CAVs to new attacks that current vehicles will not face. To ensure the safety and security of CAVs, it is important to be able to identify the ways in which the system could be attacked and to build defences against these attacks. One possible approach is to use reference architectures to perform an attack surface analysis. Existing research has developed a variety of reference architectures but none for the specific purpose of attack surface analysis. Existing approaches are either too simple for sufficiently detailed modelling or require too many details to be specified to easily analyse a CAV’s attack surface. Therefore, we propose a reference architecture using a hybrid Functional-Communication viewpoint for attack surface analysis of CAVs, including the Devices, Edge and Cloud systems CAVs interact with. Using two case studies, we demonstrate how attack trees can be used to understand the attack surface of CAV systems.

In today’s cyber world, assessing security threats before implementing smart grids is essential to identify and mitigate the risks. Loss Event Frequency (LEF) is a concept provided by the well-known Factor Analysis of Information Risk (FAIR) framework to assess and categorize the cyber threats into five classes, based on their severity. As the number of threats is increasing, it is possible that many threats might fall under the same LEF category, but FAIR cannot provide any further mechanism to rank them. In this paper, we propose a method to incorporate the FAIR’s LEF into Bayesian Network (BN) to derive the numerical assessments to rank the threat severity. The BN probabilistic relations are inferred from the FAIR look-up tables to reflect and conserve the FAIR appraisal. Our approach extends FAIR functionality by providing a more detailed ranking, allowing fuzzy inputs, enabling the illustration of input-output relations, and identifying the most influential element of a threat to improve the effectiveness of countermeasure investment. Such improvements are demonstrated by applying the method to assess cyber threats in a smart grid robustness research project (IRENE).