iSTIR-RPL: Trust-Aware Routing-State Protection Against Colluding Routing Table Overload Attack in Storing-Mode RPL

Abstract

A memory exhaustion attack in the Internet Protocol version 6 (IPv6) Routing for Low Power and Lossy Networks (RPL) where attacking node inject fake Destination Advertisement Object (DAO) messages to saturate routing tables and isolate legitimate nodes is known by the name Routing Table Overload Attack (RTOA). Short-Interval Routing for RPL (STIR-RPL) is the only published countermeasure which provides zero measurable protection against RTOA and produced results similar to Baseline RPL (RFC 6550) when evaluated in this study. This paper proposes iSTIR-RPL, which addresses three fundamental deficiencies of STIR-RPL through three coordinated enhancements: (1) trust-aware routing-state admission using a three-tier pool system that allocates routing table capacity proportionally to verified, new-node, and suspicious nodes based on legitimate trust scores from iMSecTrust-RPL; (2) adaptive memory reservation that scales interval sizes continuously with trust level; and (3) suspicion-based routing-state control with colluding group detection. The proposed iSTIR-RPL eliminated node isolation completely across all evaluation runs, reduced routing table size by 69 to 72 percent relative to Baseline RPL (RFC 6550), and dropped DAO rejection events to zero, whilst maintaining statistically equivalent Packet Delivery Ratio to all comparison schemes (all p > 0.05) when evaluated across 180 simulation runs spanning three topologies, two RTOA variants, three attacker densities, and ten seeds per configuration. These results revealed that trust-conditioned routing-state admission is necessary and sufficient to prevent RTOA-induced node isolation in storing-mode RPL.