The Internet of Things (IoT) is a reality that changes several aspects of our daily life, from smart home monitoring to the management of critical infrastructure. The 'Routing Protocol for low power and Lossy networks' (RPL) is the only de-facto standardized routing protocol in IoT networks and is thus deployed in environmental monitoring, healthcare, smart building, and many other IoT applications. In literature, we can find several attacks aiming to affect and disrupt RPL-based networks. Therefore, it is fundamental to develop security mechanisms that detect and mitigate any potential attack in RPL-based networks. Current state-of-the-art security solutions deal with very few attacks while introducing heavy mechanisms at the expense of IoT devices and the overall network performance. In this work, we aim to develop an Intrusion Detection System (IDS) capable of dealing with multiple attacks while avoiding any RPL overhead. The proposed system is called DETONAR - DETector of rOutiNg Attacks in Rpl - and it relies on a packet sniffing approach. DETONAR uses a combination of signature and anomaly-based rules to identify any malicious behavior in the traffic (e.g., application and DIO packets). To the best of our knowledge, there are no exhaustive datasets containing RPL traffic for a vast range of attacks. To overcome this issue and evaluate our IDS, we propose RADAR - Routing Attacks DAtaset for Rpl: the dataset contains five simulations for each of the 14 considered attacks in 16 static-nodes networks. DETONAR's attack detection exceeds 80% for 10 attacks out of 14, while maintaining false positives close to zero. @en

Recently, the increasing spread of Online Social Networks (OSNs) provided an unprecedented opportunity of analysing online traces of human behaviour to get insight on individuals and society. Among the others, the possibility of predicting users' political orientation relying on data extracted from OSNs received growing attention. In this study, we introduce and make publicly available a dataset composed of 6.685 unique Twitter users and 9.593.055 Tweets. Differently from most of the dataset currently available in the literature, here, each user was manually labeled according to their political orientation by a pool of human judges, using strict inclusion criteria. Further, we address the feasibility of the automatic classification of Italian Twitter users' political orientation based on their Tweets content. Our analysis focuses first on implementing a series of classifiers with the aim of predicting users' political preference as right- or left-oriented. The built models were then evaluated for inferring the political orientation of those users supporting 'Movimento 5 Stelle' (M5S), an Italian political party with a still unclear political leaning. Results show high performances on the left-right classification task, with accuracy rates up to 93%. Finally, classification performances obtained on M5S supporters and possible applications of our findings are discussed.@en

Routing Protocol for Low-Power and Lossy Networks (RPL) is a standard routing protocol for the Low Power and Lossy Networks (LLNs). It is a part of the IPv6 over Low-Power Wireless Personal Area Network (6LoWPAN) protocol stack. Features such as energy-efficient mechanisms and availability of the secure modes of operations make RPL suitable for the constrained Internet of Things (IoT) devices. Hence, the majority of IoT applications rely on RPL for data communication. However, routing security in RPL-based IoT networks is a significant concern, motivating us to study and analyze routing attacks and suggested countermeasures against them. To this end, we provide a comprehensive survey on the state-of-the-art security threats and their corresponding countermeasures in RPL-based IoT networks. Based on our study, we propose a novel classification scheme that uses a mapping between RPL attacks and their countermeasure techniques to the RPL control messages used to develop these techniques. Furthermore, we provide an in-depth statistical analysis that includes analysis of routing attacks through the RPL control messages, distribution of various mitigation techniques as per the method used, RPL control messages involved in the mitigation techniques, and details of the tools used by multiple researchers. In the end, we highlight some open challenges and future research opportunities on this topic. We believe that this survey will be beneficial to researchers and practitioners working in the area of RPL security. @en

The Internet of Things (IoT) is recognized as a disruptive innovation that has been led by industry leaders and researchers. IoT promises to improve our daily life based on smart objects interacting with each other, and that can be connected to the Internet. Building a security framework into this new paradigm is a significant technical challenge today. It is mainly due to the low-cost and resource-constrained nature of IoT devices. In most of the IoT application scenarios, the routing is done by the de-facto standard protocol called routing protocol for low power and lossy networks (RPL). The use of RPL is suitable due to its energy-efficient schemes, availability of secure and multiple communication modes, and adaptivity to work in various IoT network scenarios. Hence, many researchers are now focusing on RPL related security issues. To this end, our work provides a concise description of two major threats to RPL called sybil and wormhole attacks. Moreover, we propose two solutions to detect these attacks in RPL-based IoT networks. Specifically, our proposed techniques exploit the concept of Highest Rank Common Ancestor (HRCA) to find a common ancestor with the highest rank among all the ancestors that a pair of nodes have in the target network tree. Our two detection algorithms not only detect an ongoing attack but also localizes the position of the adversary in the network. Thus, it makes the mitigation process lightweight and fast. We implement the two approaches in Cooja, the Contiki network emulator. The results obtained from our experiments demonstrate the feasibility of the proposals concerning true positive rate, detection time, packet loss ratio, memory consumption, and network overhead. Our techniques show promising to cover more complex scenarios in the future.@en

Internet of Things (IoT) employs a large number of sensors and actuators to collect and act upon data for its smart functionalities. These devices are considered as a part of the Low-power and Lossy Networks due to their use of low power embedded hardware and computationally constrained nature. For synchronization and utility, these devices are often clubbed together logically to form groups. To maintain data confidentiality within a group, a shared symmetric key called the Group Key (GK) is used by all the group members. The GK must be redistributed upon joining and leaving of a group member to maintain forward and backward secrecy. However, the key management (i.e., generation and distribution) process causes overhead which consumes the scarce network resources. In this paper, we propose TARE, a novel Topology Adaptive Re-kEying (TARE) scheme for lightweight and secure group communication. TARE integrates the principles of routing tree mapped logical key tree and local derivation of the key over the an IPv6 Routing Protocol for low-power and Lossy networks in an original way. TARE takes into consideration the current routing topology and makes maximum energy reduction as the premise for its choice of key derivation and distribution methods, thus, it reduces the network energy consumption while maintaining key secrecy and data confidentiality. In particular, TARE provides the following advantages: (1) lower network overhead and bandwidth utilization in key management and re-distribution operations, (2) effective against the network mobility in scalable IoT networks, (3) secure group communications in network against attacks such as man-in-the-middle and eavesdropping, and (4) data confidentiality by ensuring backward and forward secrecy in key distribution method. We evaluate the performance of TARE and compare it with existing schemes. Our results show the effectiveness of TARE regarding energy consumption, bandwidth utilization, and the number of encrypted message transmissions during the re-keying operations.@en