FPES-IDS: Forecast-Path and Exponential Smoothing-Based Intrusion Detection System to Mitigate Blackhole Attack in RPL-Based 6LoWPANs

The Routing Protocol for Low-power and Lossy Networks (RPL) is vulnerable to Blackhole Attacks (BHA), where malicious nodes drop packets, isolating nodes or groups from the network. While traditional Intrusion Detection Systems (IDS) offer some level of protection, the expansion of the Internet of Things (IoT) in Low-Power and Lossy Networks (LLNs) requires more adaptive and resource-efficient solutions. This paper presents the Forecast-Path and Exponential Smoothing-based Intrusion Detection System (FPES-IDS) to detect and mitigate BHA in RPL-based IPv6 over Low-Power Wireless Personal Area Networks (6LoWPANs). FPES-IDS reduces overhead, employs Forecast-Path-based monitoring, dynamically computes thresholds, and uses environment-based smoothing parameters to predict packet arrivals. FPES-IDS operates on the principle that successful packet reception confirms the integrity of all nodes along the Forecast-Path, while packet delays indicate potential threats. FPES-IDS is an effective, lightweight, and adaptive IDS solution for securing RPL-based 6LoWPANs. FPES-IDS is structured into four modules: Pre-Detection (identifies leaf nodes and computes Forecast-Paths), Forecast (predicts packet arrival times), Monitoring and Detection (detects anomalies), and Incident Handler (mitigates threats by isolating malicious nodes and reconfiguring routes). Performance evaluations show FPES-IDS excels in detection, with a True Positive Rate between 99.01% and 99.99%, a Packet Delivery Ratio of 99.02% to 99.96%, and a throughput of 3370 to 3510 bps. FPES-IDS maintains a low False Positive Rate (0.03% to 0.88%), consumes minimal power (0.9456 mW to 0.9931 mW), and exhibits low energy consumption (5264 mJ to 6421 mJ). Additionally, FPES-IDS manages network overhead (1.15% to 1.74%) and minimises packet loss (0.04% to 0.48%).