Abstract
                                                                        The sinkhole attack in an edge-based Internet of Things (IoT) environment (EIoT) can  devastate and ruin the whole functioning of the communication. The sinkhole attacker nodes (SHAs)  have some properties (for example, they first attract the other normal nodes for the shortest path to  the destination and when normal nodes initiate the process of sending their packets through that path  (i.e., via SHA), the attacker nodes start disrupting the traffic flow of the network). In the presence  of SHAs, the destination (for example, sink node i.e., gateway/base station) does not receive the  required information or it may receive partial or modified information. This results in reduction of  the network performance and degradation in efficiency and reliability of the communication. In the  presence of such an attack, the throughput decreases, end-to-end delay increases and packet delivery  ratio decreases. Moreover, it may harm other network performance parameters. Hence, it becomes  extremely essential to provide an effective and competent scheme to mitigate this attack in EIoT. In this  paper, an intrusion detection scheme to protect EIoT environment against sinkhole attack is proposed,  which is named as SAD-EIoT. In SAD-EIoT, the resource rich edge nodes (edge servers) perform  the detection of different types of sinkhole attacker nodes with the help of exchanging messages.  The practical demonstration of SAD-EIoT is also provided using the well known NS2 simulator to  compute the various performance parameters. Additionally, the security analysis of SAD-EIoT is  conducted to prove its resiliency against various types of SHAs. SAD-EIoT achieves around 95.83%  detection rate and 1.03% false positive rate, which are considerably better than other related existing  schemes. Apart from those, SAD-EIoT is proficient with respect to computation and communication  costs. Eventually, SAD-EIoT will be a suitable match for those applications which can be used in  critical and sensitive operations (for example, surveillance, security and monitoring systems).