Open Access

ARTICLE

NADSA: A Novel Approach for Detection of Sinkhole Attacks Based on RPL Protocol in 6LowPAN Network

Atena Shiranzaei^1,*, Emad Alizadeh², Mahdi Rabbani³, Sajjad Bagheri Baba Ahmadi^4,*, Mohsen Tajgardan⁵

1 Department of Computer Engineering (Khash), University of Sistan and Baluchestan, Zahedan, 9816745845, Iran
2 Department of Electrical and Computer Engineering, Isfahan University of Technology, Isfahan, 8415683111, Iran
3 Canadian Institute for Cybersecurity (CIC), University of New Brunswick (UNB), Fredericton, NB E3B 5A3, Canada
4 School of Computing, Engineering & Physical Sciences, University of the West of Scotland, Paisley, PA1 2BE, UK
5 Department of Electrical and Computer Engineering, Qom University of Technology, Qom, 3718146645, Iran

* Corresponding Authors: Atena Shiranzaei. Email: ; Sajjad Bagheri Baba Ahmadi. Email:

Computers, Materials & Continua 2025, 84(3), 5381-5402. https://doi.org/10.32604/cmc.2025.064414

Received 15 February 2025; Accepted 19 June 2025; Issue published 30 July 2025

Abstract

The sinkhole attack is one of the most damaging threats in the Internet of Things (IoT). It deceptively attracts neighboring nodes and initiates malicious activity, often disrupting the network when combined with other attacks. This study proposes a novel approach, named NADSA, to detect and isolate sinkhole attacks. NADSA is based on the RPL protocol and consists of two detection phases. In the first phase, the minimum possible hop count between the sender and receiver is calculated and compared with the sender’s reported hop count. The second phase utilizes the number of DIO messages to identify suspicious nodes and then applies a fuzzification process using RSSI, ETX, and distance measurements to confirm the presence of a malicious node. The proposed method is extensively simulated in highly lossy and sparse network environments with varying numbers of nodes. The results demonstrate that NADSA achieves high efficiency, with PDRs of 68%, 70%, and 73%; E2EDs of 81, 72, and 60 ms; TPRs of 89%, 83%, and 80%; and FPRs of 24%, 28%, and 33%. NADSA outperforms existing methods in challenging network conditions, where traditional approaches typically degrade in effectiveness.

---

Keywords

---