  The IPv6 routing protocol for low-power and lossy networks (RPL) is the
standard routing protocol for IPv6 based low-power wireless personal area
networks (6LoWPANs). In RPL protocol, DODAG information object (DIO) messages
are used to disseminate routing information to other nodes in the network. A
malicious node may eavesdrop DIO messages of its neighbor nodes and later
replay the captured DIO many times with fixed intervals. In this paper, we
present and investigate one of the severe attacks named as a non-spoofed
copycat attack, a type of replay based DoS attack against RPL protocol. It is
shown that the non-spoofed copycat attack increases the average end-to-end
delay (AE2ED) and packet delivery ratio of the network. Thus, to address this
problem, an intrusion detection system (IDS) named CoSec-RPL is proposed in
this paper. The attack detection logic of CoSec-RPL is primarily based on the
idea of outlier detection (OD). CoSec-RPL significantly mitigates the effects
of the non-spoofed copycat attack on the network's performance. The
effectiveness of the proposed IDS is compared with the standard RPL protocol.
The experimental results indicate that CoSec-RPL detects and mitigates
non-spoofed copycat attack efficiently in both static and mobile network
scenarios without adding any significant overhead to the nodes. To the best of
our knowledge, CoSec-RPL is the first RPL specific IDS that utilizes OD for
intrusion detection in 6LoWPANs.
