Malicious black hole node detection and circumvention
A method includes determining a number of drops of a plurality of messages sent to a first node of a plurality of nodes within a mesh network. Based at least in part on the number of drops of the plurality of messages exceeding a threshold number of drops for a time period, decrementing a first rating assigned to the first node to a second rating assigned to the first node. Based at least in part on the second rating being below a rating threshold, determining that the first node is a potentially malicious node. Based at least in part on a first distance to the first node being larger than a distance threshold, identifying that the first node is a malicious node. The method may further include ending communications with the first node.
1. A device comprising:
one or more processors; and
one or more non-transitory computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
determining a number of drops of a plurality of messages sent to a first node of a plurality of nodes within a mesh network;
based at least in part on the number of drops of the plurality of messages exceeding a threshold number of drops for a time period, decrementing a first rating assigned to the first node to a second rating assigned to the first node;
based at least in part on the second rating being below a rating threshold, determining that the first node is a potentially malicious node;
receiving second location information indicating a second location of a second node;
determining a distance threshold based at least in part on a second distance determined using the second location information;
based at least in part on a first distance to the device calculated based on coordinate information provided by the first node being larger than the distance threshold, identifying that the first node is a malicious node; and
ending communications with the first node.
2. The device of claim 1 , the operations further comprising:
sending a request to the second node for second location information of the second node;
receiving the second location information of the second node from the second node;
determining a distance threshold based at least in part on a second distance indicated by the second location information;
determining that the first distance to the device calculated based on coordinate information provided by the first node is greater than or equal to the distance threshold; and
based at least in part on the first distance to the device calculated based on coordinate information provided by the first node being larger than the distance threshold, identifying that the first node is a malicious node.
3. The device of claim 2 , the operations further comprising selecting a parent node from the plurality of nodes other than the first node based on a presumption that any of the plurality of nodes other than the first node are non-malicious.
4. The device of claim 3 , the operations further comprising reporting the first node as being the malicious node to at least a third node of the plurality of nodes or a network control device.
5. The device of claim 2 , wherein the distance threshold is at least two times a radius of a wireless communication distance of the second node.
6. The device of claim 1 , wherein the mesh network is a wireless network, a wireless mesh network, or a wireless sensor network.
7. The device of claim 1 , the operations further comprising:
determining that an intermediary node exists within a network route to the first node; and
based at least in part on a determination that the intermediary node exists within the network route to the first node, instructing the intermediary node to perform the operations of claim 1 .
8. A method comprising:
determining a number of drops of a plurality of messages sent to a first node of a plurality of nodes within a mesh network;
based at least in part on the number of drops of the plurality of messages exceeding a threshold number of drops for a time period, decrementing a first rating assigned to the first node to a second rating assigned to the first node;
based at least in part on the second rating being below a rating threshold, determining that the first node is a potentially malicious node;
receiving second location information indicating a second location of a second node;
determining a distance threshold based at least in part on a second distance determined using the second location information;
based at least in part on a first distance to a device performing the method calculated based on coordinate information provided by the first node being larger than the distance threshold, identifying that the first node is a malicious node; and
ending communications with the first node.
9. The method of claim 8 , further comprising:
determining that an intermediary node exists within a network route to the first node; and
based at least in part on a determination that an intermediary node exists within the network route to the first node, instructing the intermediary node to perform the method of claim 8 .
10. The method of claim 9 , wherein the distance threshold is two times a radius of a wireless communication distance of the second node.
11. The method of claim 9 , wherein the second location information are determined via at least one of a distance vector-hop (DV-Hop) algorithm, an approximate point in triangulation (APIT) algorithm, or a centroid localization algorithm.
12. The method of claim 9 , further comprising selecting a parent node from the plurality of nodes other than the first node based on a presumption that any of the plurality of nodes other than the first node are non-malicious.
13. The method of claim 12 , further comprising reporting the first node as being the malicious node to at least a third node of the plurality of nodes or a network control device.
14. The method of claim 8 , further comprising:
sending a request to the second node for second location information of the second node;
receiving the second location information of the second node from the second node;
determining the distance threshold based at least in part on a second distance indicated by the second location information;
determining that the first distance to the device performing the method calculated based on coordinate information provided by the first node is greater than or equal to the distance threshold; and
based at least in part on the first distance to the device performing the method being larger than the distance threshold, identifying that the first node is a malicious node.
15. A non-transitory computer-readable medium storing instructions that, when executed, cause one or more processors to perform operations, comprising:
determining a number of drops of a plurality of messages sent to a first node of a plurality of nodes within a mesh network;
based at least in part on the number of drops of the plurality of messages exceeding a threshold number of drops for a time period, decrementing a first rating assigned to the first node to a second rating assigned to the first node;
based at least in part on the second rating being below a rating threshold, determining that the first node is a potentially malicious node;
receiving second location information indicating a second location of a second node;
determining a distance threshold based at least in part on a second distance determined using the second location information;
based at least in part on a first distance to the one or more processors calculated based on coordinate information provided by the first node being larger than the distance threshold, identifying that the first node is a malicious node; and
ending communications with the first node.
16. The non-transitory computer-readable medium of claim 15 , the operations further comprising:
sending a request to the second node for second location information of at least the second node;
receiving the second location information of the second node from the second node;
determining the first distance to the one or more processors calculated based on coordinate information provided by the first node and the distance threshold defined by a second distance to the second node; and
based at least in part on a determination that the first distance to the one or more processors calculated based on coordinate information provided by the first node is larger than the distance threshold, identifying that the first node is a malicious node.
17. The non-transitory computer-readable medium of claim 15 , the operations further comprising selecting a parent node from the plurality of nodes other than the first node based on a presumption that any of the plurality of nodes other than the first node are non-malicious.
18. The non-transitory computer-readable medium of claim 15 , the operations further comprising:
determining that an intermediary node exists within a network route to the first node; and
based at least in part on a determination that the intermediary node exists within the network route to the first node, instructing the intermediary node to perform the operations of claim 15 .
19. The non-transitory computer-readable medium of claim 15 , the operations further comprising reporting the first node as being the malicious node to at least a third node of the plurality of nodes or a network control device.
20. The non-transitory computer-readable medium of claim 15 , wherein:
the plurality of nodes include sensory devices within the mesh network to sense at least one environmental event at locations where the plurality of nodes are located; and
the mesh network includes a low-power and lossy network (LLN).