Security Analysis of an IoT Network Architecture for QR-Code-Based Smart Attendance Systems

1. Introduction

The enhancement of Information Technology has led to the application of smart systems in many sectors, including education. The introduction of automated systems to collect attendance is one of such developments that are done for eliminating manual systems. Of these, QR code-based attendance systems have become popular because of their efficiency, cost effectiveness F and easy deployment [1]. As such systems are becoming more involved with Internet of Things (IoT) architectures, they present serious issues of security, reliability and data integrity. [2] states that IoT-based systems are based on low-power devices and wireless communication protocols that are also prone to numerous cyber threats by nature. Regarding the attendance systems, these vulnerabilities can cause spoofing and replay attacks. These problems raise questions relating validity of attendance records and therefore weaken the trust of automated systems. This research is aimed to develop and test a safe IoT-based QR code smart attendance system simulated with the use of simulation tools. With the use of Contiki-NG and Cooja simulator, this research paper is expected to recreate the real-life IoT communication setting and test system behavior in both normal and adversarial conditions. This study aims to make a contribution to the area of IT by discussing the issues of the most important security considerations in IoT-enabled applications and suggesting a better organized method to test and improve the reliability of the systems.

The key terms in this study include Internet of Things (IoT), which is the interconnection of devices that communicate over low-power networks, while QR code attendance systems are the attendance systems that record the attendance of pupils through scanned codes or representations that are token based. The network architecture that is referred here in this research means the layered communication structure that involves application, network and sensor layers as depicted in Figure 1. This research focuses on security analysis, on identifying vulnerabilities like replay attacks and spoofing that are known to compromise data integrity. Hence, by integrating all these concepts, this research aims for evaluating how reliable and secure are IoT-based attendance systems that are used in the present educational environment. In a nutshell, this research integrates application-layer attendance validation, network-layer routing analysis and sensor-layer communication evaluation within a single Contiki-NG and Cooja Simulation environment.

1.1. Research Challenges and Research Questions

QR-code-based attendance systems are increasingly being adopted by educational institutions to automate attendance recording and reduce administrative effort. When these applications operate over low-power Internet of Things (IoT) networks, however, their performance depends not only on communication efficiency but also on the ability of the underlying architecture to maintain secure and reliable data exchange. Resource-constrained IoT devices typically employ lightweight communication protocols that favour low energy consumption and scalability over comprehensive security. As a consequence, attendance communication may become vulnerable to replay attacks, forged attendance submissions, duplicate records, and unauthorised network access.

Although previous studies have investigated IoT communication, routing protocols, and authentication mechanisms, comparatively little work has examined these components together within a complete QR-code-based attendance architecture. In particular, there remains a need for an integrated evaluation that simultaneously considers communication performance, network scalability, security vulnerabilities, and lightweight mitigation strategies under realistic operating conditions. This study addresses these limitations through a unified simulation framework developed in Contiki-NG and evaluated using the Cooja simulator.

Accordingly, the following research challenges are identified.

• RC1: Understanding how lightweight IoT communication protocols influence the reliability and security of QR-code-based smart attendance systems.
• RC2: Determining how increasing network density affects communication efficiency, routing behaviour, and successful attendance delivery.
• RC3: Investigating the security risks introduced by replay attacks, spoofed attendance submissions, and duplicate attendance messages.
• RC4: Assessing whether lightweight application-layer validation mechanisms can improve attendance integrity without significantly increasing communication or processing overhead.
• RC5: Developing an integrated evaluation framework capable of analysing communication performance and security behaviour within a realistic IoT attendance architecture.

Based on these challenges, the research addresses the following questions.

1.

RQ1: What communication characteristics influence the performance of an IoT network architecture for QR-code-based smart attendance systems?

During the first lecture of a university course, several students scan the attendance QR code simultaneously. The attendance server must receive every attendance message accurately despite multiple devices transmitting over the same low-power wireless network. This question examines how communication performance affects the reliability of attendance collection.

2.

RQ2: What effect does increasing network density have on communication performance and attendance reliability within the proposed IoT architecture?

A laboratory class containing 50 students generates substantially more network traffic than a tutorial with only five students. As the number of connected devices increases, packet collisions, routing overhead, and communication delays may also increase. This question investigates how well the architecture scales under different deployment sizes.

3.

RQ3: What security vulnerabilities emerge when QR-code-based attendance communication is exposed to replay and spoofing attacks?

A student attempts to resend a previously captured attendance message or submits a modified attendance packet on behalf of another student who is absent. This question evaluates whether such malicious activities can compromise the integrity of attendance records.

4.

RQ4: What level of protection can lightweight application-layer security mechanisms provide against common attendance-related attacks while maintaining efficient communication?

Example: Before recording attendance, the server validates the received token and checks whether it has already been processed. If a duplicated or replayed message is detected, the submission is rejected while legitimate attendance records continue to be processed without noticeable delay. This question evaluates the effectiveness of lightweight mitigation mechanisms in resource-constrained IoT environments.

5.

RQ5: What insights can be obtained by integrating communication performance analysis and security evaluation within a unified Contiki-NG and Cooja simulation framework?

Instead of evaluating network performance and security independently, the complete attendance architecture is assessed under both normal operation and simulated attack scenarios. This integrated approach provides a more realistic understanding of how communication behaviour and security controls jointly influence the dependability of IoT-enabled attendance systems.

2. Related Work and Research Gap

The rapid implementation of Internet of Things (IoT) technologies has changed conventional systems into smarter and automated spaces in areas like education, healthcare and infrastructure. [3,4] believe that, education, being one of these areas, smart attendance system has changed a lot, and it is no longer maintained manually, but with the help of some kind of technology (RFID, biometrics, and QR codes). On the other hand, [5] claim that QR codes based attendance systems are especially appealing because they are simple, scalable, and cost-effective. Nevertheless, combined with IoT networks, these systems present serious security concerns, which should be scrutinized. Recent studies carried out between 2024 and 2026 emphasize that lightweight communication protocols like RPL (Routing Protocol for Low-Power and Lossy Networks), UDP, and 6LoWPAN are often used in IoT systems because of resource limitations. Although such protocols can be effectively used to communicate, they do not have effective built-in security measures and they can be susceptible to various forms of attacks. A study by [6] shows that RPL networks are extremely vulnerable to routing attacks like black hole attacks that may severely affect communication reliability and data integrity. On the same note, [7] highlight that IoT networks based on RPL are vulnerable to numerous threats such as replay attacks, flooding attacks and rank attacks, deteriorating network performance and reliability. One of the most sensitive threats of IoT communication systems has been found to be replay attacks. A recent large-scale empirical study by [8] revealed that replay attacks have a significant negative impact on network performance, lowering the ratio of packet delivery to less than 60 percent and doubling the latency through up to 50 percent. The results are especially applicable to the QR-based attendance systems where repeated or duplicated attendance messages can cause erroneous or fraudulent attendance records. The replay attack basically entails the malicious resending of already legitimate data packets in order to enable the attackers to act as the legitimate users or to replicate actions. Simultaneously, in recent years, the studies conducted by [9,10,11] looked at the use of machine learning and artificial intelligence methods to improve IoT security. As an example, detection models based on deep learning have been suggested to detect network behavior anomalies, with high detection accuracy in simulated environments . Similar learning methods have also been proposed to enhance the performance of attack detection, but there are difficulties with obtaining high recall and real-time applicability. Such strategies signify a transition to smarter security systems but in many cases demand computational resources that cannot be delivered to low-power IoT systems. Application-wise, QR code-based attendance systems have been extensively researched in terms of their usability and efficiency. Recent publications published between 2024 to 2026 such as [12,13,14] show that combining QR codes with other security solutions like encryption, token validation, and multi-factor authentication can mitigate fraudulent attendance. Nevertheless, the majority of these studies mainly concentrate on application-layer enhancements and fail to properly address the vulnerabilities of the underlying IoT network. This brings a discontinuity between the application-level security and network-level threats. One more vital tendency of present literature is the significant focus on multi-layer security models. Studies by multiple researchers emphasize the significance of adopting security on the device, network, control, and application layer instead of concentrating on a single layer. This goes in tandem with the layered architecture that is taken in this study (sensor, network, application), which supports the necessity of providing integrated security analysis. Moreover, simulation-based studies with tools like Contiki-NG and Cooja have been much popular in testing IoT systems. These particular tools allow researchers to model the conditions of real-world networks, the behaviour of protocols and simulate the conditions of an attack in a controlled setting [3,15]. Although these methods have merits, the past literature hardly incorporates simulation-based analysis of IoT networks with application-specific scenarios like attendance systems. Importantly, literature demonstrates that the majority of the studies belong to either practical research (QR attendance systems) or network-based analyses (RPL security and IOT attacks). Not many studies combine both points of view into a single picture. This can be visible from the Table 1 as well. Such a failure to integrate leads to minimal knowledge of the behaviour of real-world applications in response to network-level attacks, especially in resources-constrained IoT settings. Hence, a comprehensive simulation-based evaluation of QR-based attendance systems within IoT environments seems necessary for understanding real-world security and performance challenges.

In short, present research into IoT-based attendance systems and network security mainly highlight important concerns relating the vulnerability of lightweight communication protocols and application-layer implementations. As per the studies carried out by [7,34,35] on RPL-based IoT networks indicate susceptibility to routing, replay, and spoofing attacks that adversely impact reliability and performance of network . Similarly, research by [36,37,38] dealing on QR code-based attendance systems focus improvements in efficiency, authentication, and fraud mitigation through the techniques like encryption, token validation, and identity verification. On top of that, studies performed by [39,40,41,42,43] look into broader IoT security research focusing the significance of lightweight authentication frameworks, security architectures that are multi layered, and protocol-level analysis in reporting and addressing vulnerabilities within constrained environments. Furthermore, simulation-based techniques using Contiki-NG and Cooja can been used to evaluate IoT network behavior and performance of protocols in these controlled environments [44].

Hence, the literature review reveals that there has been a significant interest in smart attendance systems using IoT technologies because they are efficient, automated, and scalable. Recent studies have revealed that QR codes, lightweight communication protocols and IoT architectures are increasingly being integrated into attendance systems. Yet, the review also uncovers significant security issues, including in RPL networks, replay attacks and spoofing attacks. Various studies are dedicated to network security, authentication or attendance applications, but few studies combine simulation analysis, multi-layer architecture, lightweight security mechanisms and performance metrics in one. This gap is the reason for the proposed research, which aims to integrate IoT communication, security analysis and attendance system functionality through Contiki-NG simulation and Cooja software. In general, the literature shows significant advances of IoT-based attendance systems and lightweight IoT security mechanisms. Most studies, however, are either at application level implementation or network level protocol analysis separately. The combination of these features (QR based attendance, simulation analysis of the IoT communication, lightweight security validation and performance evaluation) into a single framework is still limitedly researched. This restriction encourages this research.

3. Research Gap

Although the research on IoT security and QR code-based attendance systems has rapidly increased, the available literature indicates a distinct divide between the application-level solutions and network-level security analysis. Recent research on QR-based attendance system is mainly aimed at enhancing usability, authentication and fraud prevention by using methods like encryption, token validation and multi-factor verification. Although these methods improve the functionality of these systems, they do not pay much attention to the weaknesses brought about by the IoT communication infrastructure underlying it. On the other hand, IoT security studies, especially of low-power networks with RPL, have widely studied attacks, including replay, spoofing, and routing manipulation, and shown their effects on network performance metrics such as packet delivery ratio and latency. These studies however are most often done in isolation without consideration of their effects on practical application situations like attendance systems. Moreover, despite the popularity of simulation-based tools like Contiki-NG and Cooja to model the behavior of IoT networks, little work has been done to combine the simulation-based network analysis with application-specific ones. The present literature hardly provides models of full systems that include sensor, network and application layers collectively, especially in the case of QR-based attendance systems. The summary of related works has been presented in the Table 2. Although lightweight security mechanisms have been suggested, there is lack of adequate testing of their efficacy in realistic attack situations like spoofing and replay attacks. Thus, it is necessary to have a multi-layered, simulation-based, and comprehensive analysis of the performance of communication and the quality of security in a single IoT attendance system.

3.1. Overview of Research Gaps Found:

Little interaction between application-layer design and IoT network security analysis has been done in the past. There is scarcity of simulation-based researches on QR code attendance systems within IoT settings. There is lack of multi-layer (sensor, network, application) assessment models and there is also a very little achievement of practical analysis of attack scenarios like the spoofing and replay attack. On the other hand, reduced testing of lightweight security systems has been done in limited IoT systems. There has been limited studies relating network performance measures (PDR and delay) to application reliability (attendance accuracy). Additionally, previous research has not focused on issues of replay attack and spoofing behavior in the context of attendance systems that are QR code-based and used in IoT settings. Previous research mostly concentrates on the functionality of attendance or on the overall network performance without considering the effects of malicious attendance packets on the integrity of attendance. However, there has been limited investigation on the effectiveness of light-weight mitigation mechanisms (such as token validation and duplicate detection) in resource-constrained IoT systems. To this end, the present research concentrates on the analysis of the attack behavior, on the assessment of mitigation effectiveness and on the correlation between the security controls, the communication performance and the reliability of attendance in a common simulation environment, which covers all these aspects.

4. System Model and Methodology

This section looks at the overall methodology of creating a concept of smart attendance system using QR code technology in the field of IoT. This research performs a simulation-based research approach for the analysis of communication behavior in a lightweight IoT environment, network performance, and security vulnerabilities that are analyzed using Contiki-NG and Cooja simulator. The methodology is aimed at analyzing the installation of attendance communication under normal and malicious cases, especially: replay attacks and behavior related to spoofing attacks. The research methodology was chosen because there is no need to deploy expensive equipment in the real world to test the performance of IoT communication systems and to use a platform that would allow for a controlled and cheaper environment for testing. Using simulation, the attributes of packet transmissions, communication reliability, network congestion, routing patterns and security weaknesses can be observed under various network conditions and mote densities. Lightweight IoT communication protocols such as RPL Lite, UDP, IPv6, 6LoWPAN, IEEE 802.15.4 and CSMA were employed in the proposed system. The attendance communication mechanism was designed by taking the approach of token based message exchange between student motes and a centralized gateway/server node. There were several simulation tests made using 5, 20 and 50 motes to analyze the scalability and behavior of the network with different communication loads.

4.1. System Design

This research aims to create an IoT security evaluation framework for a QR code-based smart attendance system through simulation design. The proposed architecture was to have multiple student motes as clients of attendance, and a single centralised node as the gateway/server to verify and validate attendance. Lightweight IoT networking protocols commonly used in low-power wireless sensor networks were used to establish communication between devices. The system architecture was separated into three major layers, the sensor, network, and application layers. The sensor layer corresponded to the wireless sensor motes that generated and sent attendance messages. The network layer handled routing and packet forwarding with RPL Lite, IPv6, and UDP protocols. The application layer was responsible for attendance validation code, duplicate detection code, and attendance verification logic using tokens. The QR token was used as a communication method to simulate the attendance process. The attendance records were not stored as QR images, but rather as attendance messages sent between simulated nodes, in order to have a tokenized attendance. Every attendance message contained student identification data, class identifiers, dates and time and attendance tokens. This is to make the simulation process easy but retain the essential communication and security aspects of the QR-based attendance system. The study design proposed was based on three different simulation scenarios, namely 5, 20 and 50 motes. The scenarios were chosen to test the scalability of communications and network performance against growing node density. The 5-mote simulation was used to simulate light communication load and minimal congestion, whereas simulations with 20 motes and 50 motes progressively increased the communication load to simulate progressively more complex communication interactions in the network. To test the security of the system, a replay attack was simulated by attempting to duplicate attendance and a spoofing attack was simulated by requesting attendance when it wasn’t warranted, or when it was by an unauthorized individual. Replay attacks were simulated by transmitting previously accepted attendance tokens repeatedly and spoofing-related scenarios were simulated by having the unauthorized identities with attendance identities trying to communicate with the server node. A server application carried out duplicate detection and token validation to decide whether to accept or refuse attendance records coming in. Communication performance was also evaluated in terms of quantitative metrics such as Packet Delivery Ratio (PDR), End-to-End Delay, Packet Loss Rate, Attendance Success Rate, and Attack Detection Rate were included in the study. These metrics allowed for a glimpse into the reliability of the communication as well as the effectiveness of the communication’s security under varying simulation conditions. To create an integrated evaluation framework that linked IoT communication architecture, lightweight security analysis and attendance validation behavior in a single simulation environment, the overall study design was built.

4.2. Process and Implementation

The implementation process started with the installation and configuration of the Contiki-NG operating system and the Cooja network simulator environment. Ubuntu Linux was selected as the main operating system for simulation, due to its support for the Contiki-NG development tools and networking libraries. The simulation environment was set up to support low energy wireless communication protocols that are typically used in the IoT systems. Once the simulator was set up, the network architecture of the attendance system was designed. A number of wireless motes have been developed in Cooja to act as student devices and a central attendance gateway/server node. The server node received attendance packets, checked attendance tokens, and detected duplicate and unauthorized attendance packets. The UDP-based communication system was employed and IPv6 networks were used to enable communication along with RPL Lite routing. A set of low-power wireless communication techniques, namely IEEE 802.15.4 and CSMA protocols, were simulated at the sensor and data-link layers. Each student mote produced attendance packets with token-based attendance information. Lightweight communication protocols for IoT were used for these packets to be transmitted to the centralized server node. The attendance messages contained studentID, classID, timestamp, QR Token representation. After packets arrived at the server node, the application layer handled the attendance data, and validated it against the rules of the token. If the token was already processed earlier, the system will not accept the duplicate attendance message and mark the occurrence as a replay attack attempt. Likewise, any attempt to submit an invalid or unauthorized attendance was considered a spoofing attempt and validation was denied by the server. Many simulation steps were involved in the implementation process, including several with varying node densities.

A small-scale simulation of 5-mote was performed first to test the communication process and attendance validation logic. Once the simulation was successful, larger simulation environments with 20 and 50 motes were created to investigate the scalability of the simulation, the congestion of communications, the delivery of packets, and the ability of the attack detection behavior to detect attacks. The communication behaviour was monitored during the simulations by using the Mote Output window, Radio Messages window and the Cooja’s timeline interface. The system was instrumented with simulation logs which were then analyzed to determine the behavior of the system in terms of attendance transmissions, duplicate packet rejection, patterns in packet delivery and the behavior of the gateway node in terms of response. These logs were the main source of data for calculating performance metrics and analysing the security. The simulation results that were collected were subsequently used to determine Packet Delivery Ratio (PDR), End-to-End Delay, Packet Loss Rate, Attendance Success Rate, and Attack Detection Rate. A comparative analysis was then conducted to compare the sets of 5-mote, 20-mote, and 50-mote to understand what happens to the reliability of and the security behaviors of communication when the network got more complex. At the sensor layer, student motes send an attendance packet to other student motes via IEEE 802.15.4 wireless communication. These packets propagate in the network up to the gateway node via the IPv6, UDP and RPL routing. The attendance database is created in application layer where each packet is validated with tokens and duplicates are detected before storing the packet in the database. Only valid packets can be received and stored, replayed or unauthorized packets are rejected. The Figure 2 and Figure 3 show how the three IoT layers interact, and how the security evaluation is performed in the simulation.

4.3. Technical Challenges

While creating and simulating the proposed IoT-based attendance system, some technical and implementation difficulties were found. Getting the Contiki-NG and Cooja simulation environment to be configured correctly was one of the main problems. There were several configuration problems during the original implementation that were related to the compilation, creation of motes and integration of the protocol in the simulator as it heavily depends on Linux based dependencies. One of the key challenges was the integration of the application-layer attendance logic and lightweight IoT communication protocols. The project was designed for a low-power wireless communication environment, so to ensure lightweight communication behavior, the attendance validation had to be carefully modified in the UDP client and server programs in the Contiki-NG framework. While coding, there were a number of syntax, compilation and communication inconsistencies, especially when changing the packet handling and logging. There were also challenges while implementing replay attack detection. As the process of attendance was mocked up with token messages instead of QR image processing, it was necessary to manually validate the tokens at the application layer for duplicate attendance detection to be implemented. There were several iterations of testing and debugging needed to make sure previously sent attendance records were always denied while maintaining normal communications. Another major difficulty in the simulation environment was the scalability of the simulator. With an increasing number of motes from 5 to 20 and to 50 motes, the topology of the network became more complicated and the communication congestion grew significantly. Larger simulations produced more packets and more routing interactions, and were more challenging to observe the packet transmission behavior in the simulator. This also increased the complexity and time required to analyze the communication logs. More difficult tasks were associated with calculating network performance indicators. Multiple log windows and output files were used to generate the simulation data, so it was important to observe and interpret the simulation logs to get the accurate packet transmission information. In some cases, outputs of the simulation and communication events were also repeated or overlapped, thus making calculation of metrics and classification of communication events more complicated. Another drawback was the lack of advanced cryptographic security features like DTLS, blockchain authentication, or machine learning-based intrusion detection systems. Because of the time constraints imposed and the lightweight nature of the simulation environment, the project focused largely on the application-layer validation techniques such as duplicate detection and token verification, rather than implementing complex security frameworks. The challenges were overcome and the implementation process successfully proved the feasibility of the security evaluation using a simulation method in the QR code-based IoT attendance system. The final system was capable of simulating attendance communication, detecting replay attacks, assessing the communication performance, and offering a structured approach to analyze IoT security behavior in the context of educational attendance.

4.4. Description of Research Design

This research has used a simulation-based experimental research design to assess the communication behavior and security performance of a QR-based smart attendance system for a lightweight IoT system. The study has been created to understand the behavior of attendance communication under both normal and malicious network conditions, through the creation of controlled simulation scenarios. A simulation-based design was chosen because it enables a detailed investigation of network communications, packet transmission behavior, routing interaction, and activities related to attacks, all without the need to deploy expensive physical IoT devices. The study design was based on the layered IoT architecture, which includes sensor, network, and application layers. The wireless motes at the sensor layer were the student attendance devices that were tasked with creating student attendance messages. The lightweight communication protocols such as RPL Lite, IPv6, UDP, IEEE 802.15.4 and 6LoWPAN were employed at the network layer to simulate low-power wireless communication among nodes. The application layer includes attendance validation logic to handle requests for attendance, check attendance tokens, and refuse re-attendance. Instead of QR image processing, the attendance system was modeled with tokens. This abstraction enabled the study to examine the basic operational aspects of QR-based attendance systems with primary focus on communication reliability and security behavior. Every attendance request contained parameters like student identifiers, timestamps, class identifiers, and attendance tokens (QR code information in the simulation). The research design consisted of three simulation environments with 5, 20 and 50 motes, respectively. To test scalability and communication behavior as the network complexity increases, we developed these scenarios. The 5-mote simulation was a low density communication scenario, whereas the 20-mote and 50-mote simulations were higher density communication scenarios with increased communication traffic, routing interactions, and packet congestion conditions. Evaluating security was a significant part of the research design. The previously accepted attendance packets were repeatedly sent to replicate replay attacks and the invalid or unauthorized attendance packets for the representation of the spoofing related behavior. The server node operated on incoming attendance packets, using duplicate detection and token validation algorithms to decide if the attendance was accepted or rejected. Communication performance metrics such as Packet Delivery Ratio (PDR), Packet Loss Rate, End-to-End Delay, Attendance Success Rate, Attack Detection Rate were used to analyze the collected simulation outputs. The comparisons were then carried out between various simulation scenarios to assess the effects of network density on the reliability of communication and effectiveness of security. In general, the research design facilitated the investigation of the behavior of IoT communication, lightweight security validation, and the reliability of attendance in a smart attendance system using QR codes in a structured and controlled environment.

4.5. Tools, Technologies and Techniques

The proposed IoT-based attendance system was implemented and evaluated using several tools, technologies and communication techniques.

Contiki-NG: The project was primarily based on the Contiki-NG operating system and IoT development framework. Contiki-NG has support for low-power wireless communication protocols, and it is used in many IoT research labs. The platform has allowed for the development of UDP client and server applications, wireless communication behavior and routing protocol configuration for simulated IoT environments.

Cooja Simulator: A network simulator called Cooja was employed to simulate and analyze the IoT communication environments. Cooja enabled the simulation of wireless motes, packet transmission, routing behaviour, radio communication and timeline analysis, within controlled network scenarios. Visualization functions such as radio message analysis, network topology visualization and mote output monitoring were also provided in the simulator.

Ubuntu Linux: Ubuntu Linux was chosen as the development platform in consideration with the compatibility with Contiki-NG tools and networking libraries. The stable support of IoT simulation frameworks and ease of configuration of Contiki-NG development dependencies is possible in Linux-based environments.

Wireless Sensor Motes: Student attendance devices and centralized gateway nodes were simulated by wireless sensor motes. These motes were able to send and receive simple wireless messages and broadcast attendance packets in the simulation environment.These motes sent and received simple wireless messages, and broadcasted attendance packets in the simulation environment.

Communication Protocols: The system implementation was based on several lightweight IoT communication protocols. One of them being RPL Lite, which was used for packet forwarding and is network topology management protocol. The next is UDP (User Datagram Protocol), which is a Lightweight protocol to send attendance messages between motes and server node. Furthermore, IPv6 was responsible for addressing and communication in the IoT network. 6LoWPAN, which was suited for providing IPv6 support in low-power wireless networks. The next protocol being IEEE 802.15.4 is a low-power wireless physical and data-link layer standard. In wireless communications, CSMA (Carrier Sense Multiple Access) is a medium access control (MAC) method for regulating access to the wireless channel.

Token-Based Attendance Validation: Attendance was carried out by applying the technique of token communication. Attendance packets included QR attendance information in the form of attendance tokens. These tokens were then validated at the application level to check for duplicate attendance and unauthorized attendance.

Simulation Techniques: The study used simulation-based evaluation techniques which included network scalability testing, replay attack simulation, spoofing-related attendance testing, packet monitoring, and communication performance analysis that are intriguing concepts that demand careful thought. To investigate the communication behaviour under different traffic conditions, three densities of the network were simulated (5, 20 and 50 motes).

4.6. Performance Evaluation Metrics and Formulae

To test the effectiveness, reliability and security performance of the proposed IoT-based QR code smart attendance system, various quantitative performance metrics were considered during the simulation experiments. These are chosen because they are widely used in IoT communication and wireless sensor network studies for packet transmission efficiency, communication reliability, network stability and security effectiveness. The evaluation was aimed at analysing the performance of the communication and attack detection under various network densities of 5, 20 and 50 motes. The chosen metrics are the Packet Delivery Ratio (PDR), Packet Loss Rate, Average End-to-End Delay, Attendance Success Rate, and Attack Detection Rate. These metrics allow insight into the efficiency of the transmission, reception, validation and protection of attendance packets in lightweight communication between IoT devices and attacks such as replaying and spoofer attacks. Communication reliability and efficiency is evaluated by Packet Delivery Ratio (PDR), and Packet Loss Rate (PLR) between student motes and server node. The communication latency in the IoT network was measured using Average End-to-End Delay (EED). The Attendance Success Rate shows the proportion of valid attendance requests that the system could process, and the Attack Detection Rate shows how well the system’s validation process blocks duplicate or replayed attendance requests by malicious users. The mathematical relationships used to compute these performance measures are listed in Table 3.

4.7. Justification of Chosen Method

This simulation based methodology was chosen as a practical and cost-effective solution for the evaluation of IoT communication systems and security behaviour without the need to deploy actual hardware. In most cases, experimental IoT applications need heavy sensor equipment, wireless networks and testing facilities, which are costly. Researchers can use simulation environments like Contiki-NG and Cooja to simulate large-scale IoT communication systems with a controlled and repeatable environment. It is appropriate to use Contiki-NG because it is a system tailored specifically for the research into low-power IoT and wireless sensor networks. It provides support for light communication protocols that are widely used in the constrained IoT systems, and allows for in-depth study of how packets are transmitted, how they are routed, and how the network performs. Cooja simulator was chosen due to the close coupling it has with Contiki-NG, and also its ability to simulate real wireless communication between motes. Cooja also offers several visualization and monitoring tools to make communication analysis and packet tracking during simulation experiments easier. The use of RPL Lite, UDP, IPv6, 6LoWPAN and IEEE 802.15.4 lightweight communication protocols was explained because these are commonly used in low-power communication environments in IoT. As the proposed attendance system was to be a light-weight learning environment using IoT, these protocols offered a faithful communication environment to check the communication behavior and security vulnerabilities of the attendance system. The decision was made to use Token-based attendance validation as it offers a light-weight and computation-efficient way of verifying attendance without burdening with heavy cryptographic overheads to detect duplicate attendance submissions. Lightweight validation mechanisms are better suited for constrained environments, typically due to the limited processing power, energy availability, or memory of devices being deployed in the IoT. Three simulation scenarios (5, 20 and 50 motes) were used to assess scalability and communication behavior for various network densities, as the usage of multiple simulation scenarios was justified. The comparative analysis enabled the study to view the effects of increasing complexity of communications on the delivery of packets, delay, routing interactions, and effectiveness of attack detection. Overall, the selected techniques were effective ways to combine communication analysis, security evaluation and simulation-based experimentation in a single environment for research in an IoT attendance system.

4.8. Description of the Implementation Process

The process of this research was designed and experimented on a lightweight smart attendance system using QR code with IoT in a simulated environment. The system has been deployed with Contiki-NG operating system and Cooja network simulator, in order to simulate the wireless communication characteristics of several IoT devices. The simulator setup, network configuration, communication development for attendance, attack simulation, scalability tests and performance evaluations were conducted in multiple stages. The first step to implementation was to set up a Contiki-NG development environment in Ubuntu Linux. Ubuntu was chosen due to its ability to work with IoT simulation frameworks and networking tools that are essential for the successful operation of Contiki-NG. The Cooja simulator was then installed and configured to enable wireless mote simulation, monitoring of packet communication, visualization of routing and analysis of communication logs. Once the simulation environment was set up, the architecture for the attendance system was created. The implementation consisted of several student motes, where each one was an attendance client, and a single gateway/server mote that processed the verification of attendance. The student motes were programmed to send attendance messages, which included the token-based attendance information. These attendance packets were then sent to the server node using lightweight protocols in wireless communication. RPL Lite routing, UDP communication, IPv6 addressing, IEEE 802.15.4 wireless transmission, 6LoWPAN adaptation, and CSMA medium access control are the lightweight technologies used in the implementation process. These protocols were chosen because they involve communication methods similar to those employed in low-power wireless sensor networks or IoT. Furthermore, the lightweight protocols were used as per the study goals that were testing constrained IoT systems with limited computational resources. The actual function of QR image scanning was not included, but rather, token-based attendance packets were used to simulate the attendance process. This implementation decision was taken due to the fact that the main aim of the research was communication security and network architecture analysis and not QR image processing itself. To simulate communication behavior and security threats of the QR attendance system, token-based attendance simulation was used, thus making the simulation environment easier to reproduce than the real world. The application-layer validation mechanism was designed to be an analysis of incoming attendance packets and to decide whether the attendance requests should be accepted or rejected. To simulate the replay attack detection, the duplicate attendance submission was detected by the logic of token validation. The attendance behavior during the simulation was also modified by adding unauthorized attendance identifiers to represent attendance behavior that might be related to spoofing. The implementation process also involved scalability testing with three different simulation scenarios of 5, 20 and 50 motes respectively. By this approach, the study could assess the reliability of the communications and network performance with increasing complexity of communication and routing overhead. Larger mote densities created more communication traffic and also provided a realistic environment to observe the packet congestion, delay, and communication behavior in wireless IoT networks. In order to justify the implementation approach, the discussion centered on the possibility of performing experimental tests of the IoT communication system via simulation that will not necessitate the use of expensive sensor equipment. Simulation environments also enable researchers to test attack scenarios, routing behaviour, pattern of packet transmission and reliability of communication repeatedly and under controlled conditions. Overall, the process of implementation showed how the QR-code-based attendance communication is able to function in light-weight IoT architectures, and also placed emphasis on the security issues and communication restrictions of the wireless environments under consideration.

4.9. Analysis of Solution Evaluation and Testing

For the evaluation and testing process, the communication performance, scalability, and security behaviour of the proposed IoT-based attendance system with various network conditions were analysed. The testing process was performed under the Cooja simulation environment and the wireless mote configuration variant and controlled attack scenarios. Three different simulation environments with 5, 20 and 50 motes were created to investigate the effect of the density of the network on the communication behavior and on the reliability of attendance. In each simulation scenario, the student motes were grouped together to communicate with the central gateway/server node using the lightweight wireless communication protocols by sending attendance packets. The test procedure consisted of observing packet transmission patterns, routing interactions, duplicate packet detection and communication delays with the Mote Output interface, the Timeline interface, and Radio Messages tools of the Cooja simulator. Attendance packet transmission and attack communication events were analysed from the simulation logs. The results of the evaluation showed that the proposed attendance system could successfully pass the attendance packets across all network scenarios. The server node received the requests of attendance and processed the operations of checking attendance, both in normal conditions and in conditions related to attacks, consistently. As the number of motes grew, however, the congestion and complexity of communication within the network grew as well. From the Packet Delivery Ratio (PDR) analysis, it is found that in larger sizes of network, the reliability of the communication decreases over time as there is more routing overhead and congestion in the wireless packet. In the same way, an increase in mote density resulted in an increase in End-to-End Delay as the number of interactions for forwarding and transmission within the network increased with higher communication loads. As lightweight IoT communication environments were found to be viable communication paths without any validation mechanism, the replay attack testing process proved that duplicate attendance submissions may be possible in such an environment. The token validation system implemented was able to successfully detect and reject duplicate attendance submissions for all simulation scenarios, however, this was verified by multiple simulation runs showing the message that duplicate attendance was rejected. The results of the attack detection showed that the proposed application layer validation mechanism was effective in mitigating replay attacks while allowing light communication behavior in constrained IoT systems. These spoofing related attendance testing also showed that the server validation process can identify and deny invalid attendance identifiers. The performed spoofing evaluation was quite simple in comparison to the replay attack evaluation, but it still provided an understanding into the need for validation mechanisms in IoT-based attendance systems. The scalability analysis also showed that the system was operational even when the number of motes in the communication environment was increased to 50. In larger simulations, the communication delay rose, as did the number of packets that were congested, but the communication for attendance validation also worked well with no great amount of communication failure. Some practical limitations were also identified in the lightweight IoT communication systems, which were also included in the evaluation. Unlike other reliable and secure communications like TCP/IP, there are no built-in reliability or security features in UDP. This means that attendance systems can be compromised by packet loss and unauthorized retransmissions. Likewise, light wireless protocols in low density setting are still vulnerable to congestion and communication instability in larger traffic. Overall, the testing process has verified that lightweight application-layer validation methods can enhance the reliability of attendance and resistance to replay attacks in QR code-based IoT attendance systems while still maintaining the system’s lightweight nature. From this evaluation result, it can be confirmed that the simulation-based security analysis is feasible for educational IoT applications and that communication analysis is important in combination with lightweight security validation mechanism.

4.10. Technical Security Analysis and Packet Flow Evaluation

The proposed IoT-based QR code smart attendance system was tested by observing the transfer of attendance packets from sensor layer to network layer to application layer, and the security validation process during the packet transfer process. Student motes at the sensor layer created attendance packets comprising a student identifier, an attendance token, and a time stamp. These packets were then sent into the network layer via RPL Lite, IPv6, UDP, and 6LoWPAN using RPL paths dynamically determined based on the availability of nodes and the topology. Upon arrival of the packet at the server node, it was processed in the application layer to check the validity of the token and to verify attendance. Retransmission of the previous packets in the system, which were previously accepted as attendance packets were used to analyze replay attacks. In this process, the server first received the original packet, saved the token value for that packet, then checked subsequent packets to see if they matched any previously stored packets. If the same token appeared again then the duplicate packet was rejected. The examination of spoofing behavior involved the generation of packets with spoofing identification or unauthorized attendance, on the same route used by legitimate packets. Such packets were allowed to pass through the network layer, but were denied at the application layer when the tokens were not recognized. The token validation algorithm was simple to perform, involving only extraction, checking of the structure of the token, comparing the token with the stored values and finally deciding whether the token is accepted or rejected. A duplicate detection was performed in the same manner: checking the token to see if a token already existed. This analysis revealed that network protocols were effective in getting packets from one mote to another, with the most significant security control being on the application layer. Results showed that the proposed scheme of packet routing, token validation, and duplicate detection enhanced the reliability of attendance and boosted the protection against replay and spoofing attacks in the simulated IoT environment.

5. Results and Discussion

In this section, the outcomes of the proposed smart attendance system which is implemented using the QR code with the help of the IoT simulation are described. Three different network setups, where the number of motes is 5, 20, and 50 were considered for the simulations performed with Contiki-NG, Cooja simulator. The evaluation objective was to investigate communication behavior, network reliability, effectiveness of attendance validation and security performance, in normal and attack conditions. The evaluation was carried out concerning the detection of replay attacks, the rejection of attendance due to spoofing, the packet transmission behaviour and scalability of the IoT network architecture. The analysis was carried out using simulation logs and Mote output records, radio messages and observations made during the simulation timeline from the simulation environment. As a measure of the system effectiveness, the system metrics such as Packet Delivery Ratio (PDR), End-to-End Delay, Packet Loss Rate, Attendance Success Rate and Attack Detection Rate were investigated. Representative simulation evidence is provided in the supplementary material; the quantitative results are analysed below.

5.1. Results

The simulations showed that the proposed IoT-based attendance system was effective in relaying attendance messages between the student motes and the centralized server node for all three networks configurations. The system could also identify duplicate attendance submissions and prevent replay attacks using the token validation mechanisms at the application layer. An increasing number of motes resulted in growing complexity of communication and packet traffic as well. This caused some packets to be lost and communication delay in bigger network configurations. System’s communication and successful attendance validation behavior was maintained though. A summary of the overall results from the simulation scenarios is shown in Table 4.

The results show that Packet Delivery Ratio slowly decreased with the increase of network size. This behavior was as expected, since a higher density of motes led to higher amounts of communication traffic and more routing interactions in the wireless network. Likewise, End-to-End Delay rose with the increase in the size of the simulation environment because of the increased packet congestion and routing overhead. Although the communication was increased, the communication remained working and messages about attendance were successfully delivered to the server node in most cases. The replay attack detection mechanism was effective in all the scenarios. The server node was able to detect and block duplicate attendance logs with a perfect 100 percent Attack Detection Rate within the simulation environment. The simulation repeatedly produced the outputs mentioning duplicate attendance rejection. This output verified communication replay attack mitigation. The system also exhibited simple spoofing related attendance rejection behaviour by submitting false attendance by providing invalid attendance identifiers.

Table 5. Replay Attack Detection Results.

Scenario	Duplicate Attendance Attempts	Successfully Rejected	Detection Accuracy
5 Motes	5	5	100 percent
20 Motes	12	12	100 percent
50 Motes	21	21	100 percent

Table 5. Replay Attack Detection Results.

Scenario	Duplicate Attendance Attempts	Successfully Rejected	Detection Accuracy
5 Motes	5	5	100 percent
20 Motes	12	12	100 percent
50 Motes	21	21	100 percent

This replay attack simulation made sure that the implemented token validation process stopped duplicate attendance submission across all the densities of network.

The scalability analysis as shown in the Table 6 demonstrates that scaling up the IoT environments added more communication overhead and routing complexity. The application-layer validation mechanism, however, continued to work even in a high traffic network.

5.2. Discussion on Results

The results show that the proposed QR code attendance system maintained good detection of the basic attack behavior and attendance validation, and operated well in a light-weight IoT communication environment. The combination of token-based attendance validation and light communication protocols helped to create a feasible solution for detecting duplicate attendance and replay attacks. Among the significant results of this study is that, without duplicate validation, the presence of replay attacks has the potential to have a substantial impact on the reliability of attendance. The simulation results indicated that it is easy to get unauthorized repeated attendance submission in lightweight IoT environment based on UDP communication and limited security capabilities of low-power wireless protocols. The duplicate attendance validation logic that was implemented was able to detect and disregard these duplicate attendance packets. The communication performance analysis also demonstrated that the higher the number of motes, the more influential the network performance parameters such as Packet Delivery Ratio and End to End Delay are. With an increasing density of the network from 5 to 50 motes, the routing overhead and wireless packet congestion also grew. This led to moderate packet loss and delay in communication. However, the global communication reliability was still satisfactory in all simulation scenarios. The results also suggest that it is possible to practically improve the reliability of an attendance system without adding complex computational overhead by using lightweight application-layer validation mechanisms. In real-world applications, typical IoT devices usually have limited computational power and energy, and therefore lightweight security mechanisms might be more appropriate for an educational IoT system than the heavyweight cryptographic ones. A second insight is that communication architecture is an important factor of system reliability. This layered architecture in this study enabled responsibilities for communication management, routing behavior and attendance validation to be distributed among the different layers. This enhanced the flow of communication and made the implementation of attacking the system easier.In general, the outcomes are evidence that simulation-based security analysis of IoT systems can be useful to gain insights about the communication behavior, scalability limits, and security risks of smart attendance systems in IoT constrained environments.

Figure 4 shows the comparative view of Packet Delivery Ratio, Attendance Success Rate, and Attack Detection Rate in simulation environments of 5, 20 and 50 motes. As shown from the results, the communication performance was decreased in proportion to the increase in network density due to the complexity of the routing process and wireless traffic. Overall, the attack detection mechanism was stable in all scenarios, showing the consistency of the validation and security mechanisms that were implemented.

5.3. Layer-Based Performance Evaluation Results

The proposed QR-code-based smart attendance system was tested in three layers of IoT system: Application Layer, Network Layer and Sensor Layer. A three-layered evaluation was carried out to gain insight into the communication and security behavior of different parts of the system with regard to their functionality. IoT systems are multi-layered and by studying each layer individually we can gain more insight into how the system performs, is reliable and has weak points. Attendance validation and duplicate detection were measured for the Application Layer. The Network Layer was concerned with routing, packet delivery and delay performance. The Sensor Layer was studied for radio activity, radio stability, wireless mote communication. The layered analysis was used to determine the impact on the system at various operational levels from communication problems and security issues. The layer based performance evaluation has been presented in Figure 5 and Table 7, Table 8 and Table 9.

5.3.1. Application Layer Results

The Application Layer handled the processing of attendance requests, the checking of attendance tokens, checking for duplicate entries and returning acceptance or rejection responses. This layer was the attendance logic QR code and directly related to the accuracy and security validation of attendance. The results of the simulations indicated that attendance requests were able to be processed in all three cases with 5, 20, and 50 motes. Attendance messages were received regularly by the server node and applied the token validation logic. Multiple attendance records were properly identified and removed. The system operated normally without a significant number of application failures increasing with the number of motes. But as the density of the motes increased, the number of incoming requests increased which resulted in higher validation workload at the server. The results are presented in Table 7.

5.3.2. Network Layer Results

The Network Layer was responsible for routing, addressing, forwarding, and packet communication over wireless networks (RPL Lite, UDP, IPv6, and 6LoWPAN). The outcome demonstrated the stable routing performance on all the simulations. Communication delay and routing overhead were seen to grow for higher mote densities, however, Packet Delivery Ratio was remained satisfactory. The 50-mote simulation had more packet forwarding and congestion than smaller simulations. The results are presented in Table 8.

5.3.3. Sensor Layer Results

The Sensor Layer was a wireless motes that acted as the student attendance device. This layer’s emphasis is on radio transmission, wireless packet generation, mote communication behavior and channel stability. The results indicated that the transmission remained constant in lower-density networks. Radio congestion and packet collisions increased in the 50-mote simulation, but communication still worked. The results are presented in Table 9.

5.4. Analytical Discussion of Network Behaviour and Security Performance

The simulation results revealed that there was a clear relationship between the network size, security attacks, communication performance and attendance reliability. The PDR decreased slowly with the number of motes increased from 5 to 20 and 50. This decrease was primarily due to increased packet forwarding activity and routing complexity in the network layer with higher network density. As the number of active motes which transmits attendance data increases, the RPL routing paths became more dynamic, wireless collision rate increased and some of the packets had to be retransmitted before reaching the sink node. These conditions decreased successful packet delivery as compared to smaller scenarios. The average end-to-end delay was also found to be increasing with the increasing size of the network. This is because packets had to go through more intermediate nodes before they could reach the gateway. Other routing processes and re-transmissions further delayed the communications. The network layer was thus the layer most vulnerable in terms of performance as it dealt with packet forwarding, congestion and the stability of the routing. As mote densities increased, there was also an increase in wireless traffic on the sensor layer, because the token validation and duplicate checking operations were light-weight on the application layer. The 50-mote simulation showed more congestion. The more the users who have increased the number of simultaneous transmissions there was, traffic volume increased, there was an increase in channel contention and routing overhead. This had an immediate impact on the delivery and response time. Although the efficiency of communication suffered during congestion, attendance was still reliable because the application layer kept on validating the tokens and rejecting the duplicate submission. The threat of replay attack was the most direct as it would try to duplicate an entry in the attendance log with packets previously accepted. Affecting security, but limited by token validation and verification logic, are spoofing packets. Combined together, token validation and duplicate detection proved to be the best method of mitigations. These controls always recorded the attendance packets, where they were repeated or invalid. This shows that the larger IoT networks are, the more communication problems occur at the network layer, but lightweight application-layer validation is still effective in safeguarding the integrity of attendance. The analysis also establishes a close connection between network behaviour and security mechanisms, as well as between reliable attendance results and the reliability of packet delivery and attack mitigation.

5.5. Critical Analysis of Security Limitations and Practical Deployment Risks

The introduced lightweight security solution did enhance the reliability of attendance, but some technical limitations were also revealed in the analysis. Efficient for limited IoT environments, the current system primarily relied on the token validation and duplicate detection mechanisms, but these approaches are not necessarily exhaustive in real-world deployments. While token validation is effective in rejecting repeated attempt to attend, and even invalid packet structures, an attacker may be able to capture a valid token and to mimic packet behaviour within a reasonable timeframe, leaving it possible that the application layer is not completely effective in preventing unauthorized access. This means that lightweight validation enhances security, but it is not able to provide absolute protection against more sophisticated attacks. Also, the use of UDP can led to significant vulnerabilities. Selected based on its light weight and support for low-power IoT communication, UDP does not offer built-in delivery confirmation, ordering of packets, or connections-level authentication. This means packets can be dropped, delayed, duplicated and forwarded without verification. In a larger network, this can led to more congestion and routing instability. This architecture provides for efficient communication, but also opens up the possibility of packet replay, spoofed traffic and unreliable delivery. Practical limitation is scalability as well. The result of the simulation indicated that with the increment of the number of motes, the packet delivery performance decreased and communication delay increased. This means the system is efficient in moderate-scale IoT deployments, but might be less efficient in environments where there are a large number of students in classrooms, such as large campuses or multiple classrooms using the system at the same time. More traffic can cause network congestion, routing overhead and retransmissions. Another constraint is the limited resources of the IoT devices. Low-power motes have small processing power, small memory, and small batteries. If the security level was raised, using more resources, like encryption, secure authentication, etc., and intrusion detection would be required to increase the amount of security. This results in a real-life balance of security and device performance. These constraints can have implications on the reliability of operations and trust in attendance records in a real school setting. There may be delays in attendance being recorded due to packet loss or a delay in delivery, and there may be a greater risk of impersonation or unauthorized submissions due to lack of authentication. While the proposed system showed promising results in the simulation, implementing it in the real world would require more robust security measures and also careful management of performance, scalability, and device resource usage.

5.6. Layer-Based Security Threats and Mitigation

Although the previous sections have demonstrated the overall communication performance and scalability of the proposed IoT-based attendance system, evaluating security behavior at the architectural level provides additional insight into the effectiveness of the implemented protection mechanisms. Since security events may affect different components of the system in different ways, it is important to examine how each IoT layer responds to potential attacks and how the proposed validation process contributes to maintaining the integrity of attendance records. Figure 6 presents the security workflow adopted in this study, illustrating the progression of attendance packets through the layered architecture and the points at which replay and spoofing attempts are identified and rejected before attendance is recorded. This layer-oriented analysis provides a clearer understanding of the relationship between communication processes and security controls within the simulated environment.

Application Layer

The primary application layer security issues were concerns of replay attacks and duplicate attendance attempts. There was a risk that the attendance packets may have been sent again or repeated if they were sent by token based messages. To help decrease this risk, the token validation logic was added to the server node. All attendance messages were pre-screened before being accepted and duplicate attendance messages were refused right away. The simulation results showed that the repeated submission packets were identified correctly and the invalid packets were detected. This has proved that light weight application-layer validation improves attendance reliability and ensures integrity of attendance.

Figure 7. Layer Interaction Diagram.

Figure 7. Layer Interaction Diagram.

Network Layer

The threats to communication at the network layer included routing instability, packet retransmission, and the increase in communication traffic between nodes. Since the system was based on RPL Lite and UDP communication, the simulations grew larger, causing more routing interactions and network congestion. The monitoring of the network layer was done with the Cooja timeline and communication output tools. To allow for a stable communications, controlled routing behaviour and packet observation were applied during the transmission. The results indicated that routing was consistent in all scenarios, but the greater the number of motes, the greater the complexity of packet forwarding and the greater the delay.

Sensor Layer

The key issues at the sensor layer were the packet collision that happens when more than one mote is transmitting at the same time and wireless transmission congestion. In the 50-mote environment, these problems became more evident due to the higher radio activity. Wireless channel access was managed using IEEE 802.15.4 and CSMA mechanisms, and the number of transmissions conflicts between nodes is reduced. In all of the simulations, the wireless sensor layer worked throughout the increased communication load. The result showed that the packet generation rate and radio communication were stable even with the different sizes of the network with the sensor layer. The overall threats, mitigations and results are presented below in Table 10.

Analysis showed that there are different security and communication issues at the different layers of the IoT attendance system. At the application layer, there was a possibility of replay attack and duplicate submission of attendance, but token validation and duplicate rejection mechanisms were able to detect and reject fake attendance. It was the case that at the network layer protocols, including RPL, UDP and IPv6, were susceptible to routing abuse and packet retransmission, which could result in higher delay and packet loss. The routing performance in the network was steady and stable due to the mitigations implemented on these issues, such as routing monitoring and topology control. Wireless motes had to cope with the additional traffic problems at the sensor layer, including radio congestion and packet collisions. These factors, coupled with the use of the CSMA and IEEE 802.15.4 communication mechanisms, kept the communication stable. In general, the findings show that light-weight mitigation techniques at various layers can prove to be effective to enhance the security, reliability and stability of the IoT-based attendance system.

5.7. Evaluation of Implemented Mitigation Mechanisms

In addition to analysing network behaviour and security vulnerabilities, this study also evaluated the effectiveness of the lightweight mitigation mechanisms implemented within the proposed IoT-based attendance system. The primary security controls consisted of token validation, attendance verification, and duplicate detection logic operating at the application as shown in Figure 8. These mechanisms were designed to provide lightweight protection suitable for resource-constrained IoT devices while maintaining attendance reliability. During simulation, attendance packets containing student identifiers, timestamps, and attendance tokens were transmitted from wireless motes to the gateway node. Upon reception, the server validated each token and compared it against previously accepted attendance records. If a token had already been processed, the attendance request was immediately rejected mentioning as duplicate attendance rejected. On the other hand, if a token was bad, the attendance was rejected immediately mentioning bad token. Therefore, both replay and spoofing attacks were detected. This behaviour was repeatedly observed in the simulation outputs through messages indicating Duplicate Attendance Rejected message, demonstrating that the mitigation mechanism was functioning correctly. The implemented mitigation proved particularly effective against replay attacks as well. Since replay attacks rely on retransmitting previously accepted attendance packets, the duplicate detection process successfully prevented repeated attendance registration. The mitigation also improved attendance integrity by ensuring that only unique attendance submissions were recorded. Although the system did not implement advanced security techniques such as encryption, blockchain authentication, or intrusion detection, the lightweight validation approach provided practical protection against the most common attendance-related threats within the simulated environment. Overall, the results indicate that token validation and duplicate detection were the most effective mitigation mechanisms implemented in this project. These controls maintained attendance reliability, reduced the risk of duplicate attendance entries, and demonstrated that lightweight security can provide meaningful protection in low-power IoT attendance systems.

Table 11 demonstrates that the proposed system did not only analyse security threats but also implemented lightweight mitigation mechanisms. The results show that token validation and duplicate detection were particularly effective against replay attacks and duplicate attendance submissions. These mitigation strategies improved attendance integrity while maintaining the lightweight characteristics required by resource-constrained IoT devices.

5.8. Comparison to Previous Studies

Most of the existing research on IoT-based attendance systems has been mainly concerned with the development of the application, the automation of attendance, the implementation of the QR code, or the analysis of the routing protocol. However, many studies mentioned in the literature about QR code attendance systems discussed it from usability aspect and did not critically examine the communication security in the network layer or the behavior of the replay attacks. For instance, Irawan et al. (2024) and Nwabuwe et al. (2024) primarily examined QR code attendance implementation and lightweight authentication concepts, but lacked in-depth security analysis of the behavior of the packets in the IoT network. In a similar manner, Albinali and Azzedin (2024) and Ayoub et al. (2024) investigated the replay attack and vulnerabilities in RPL communication in an IoT environment, but these vulnerabilities were not incorporated in smart attendance system applications. Unlike previous studies which focused on individual components of IoT-based attendance systems one by one, the present work is developed based on the integration of various components of an IoT-based attendance system in a single simulation environment. First, the study introduces the concept of attendance packet with student identification, timestamp and attendance token, which are created and sent via an IoT network, to communicate student attendance. This enables the real world communication setting to be assessed, not as an application in its own right. Second, it integrates attendance management and a full IoT network architecture (sensor layer, network layer and application layer). This study is different from other works that examined either attendance application or the network performance separately but evaluated the flow of the attendance information via various communication layers such as IEEE 802.15.4, IPv6, UDP, and RPL Lite. Third, the study explores replay attack behavior by repeating the arrival of packets at the network. These attacks were analysed for their impact on the attendance integrity and lightweight measures such as token validation and duplicate detection were taken to prevent duplicate attendance registration. The behaviour associated with spoofing was also studied to investigate the impact that an unauthorized attendance submission might have on the reliability of the system in an IoT setting. The research also assesses the performance of the network using important communication metrics such as Packet Delivery Ratio (PDR), Packet Loss Rate, Average End-to-End Delay, Attendance Success Rate, and Attack Detection Rate. These figures give indications of the reliability of the communication and the security performance under various operating conditions. This research included practical scenarios with motes count 5, 20, 50 deployed which were simulated in Contiki-NG and Cooja simulator, as opposed to some studies that used theoretical analysis or protocol-level experiments. This made it possible to study the reliability of communication and security behaviors at the same time. The study also makes a contribution by combining the application-layer validation with the analysis of the communication in the network layer to validate it, which was found to be one of the most important gaps in the literature. Hence, the results offer a more comprehensive view of the security of the attendance system in the context of IoT than those of many previous studies.

5.9. Answer to Research Questions and Objectives

The first research question was what types of security problems are revealed with the use of a QR-based attendance system in the context of lightweight IoT network architecture. The simulation results indicated a number of important potential security issues, such as replay attack, duplicate attendance submission, communication congestion, packet loss, and security issues with light-weight wireless communication protocols. These results prove that IoT attendance systems are still susceptible with weak security validation systems.

The second research question focused on the impact of replay attacks and attendance submission due to spoofing on attendance reliability and communication performance. Results showed that replay attacks could have a direct impact on attendance integrity by submitting attendance multiple times. In any case, the duplicate attendance validation system that was put in place, was able to identify and catch these fraudulent attempts. Spoofing related attendance behavior was also detected when the attendance is submitted by an invalid attendance identifier.

The research objectives were also successfully achieved. The study was successful in designing and simulating a lightweight IoT attendance architecture based on the Contiki-NG and Cooja. To communicate the attendance, student motes were modeled by exchanging the attendance token among the student motes and a centralized attendance gateway node. Various network density configurations (5-motes, 20-motes, and 50-motes) were tested and analyzed to investigate the scalability and communication characteristics. Replay attacks and spoofing related attendance submissions were simulated and analyzed, and network performance metrics such as Packet Delivery Ratio, Packet Loss Rate, End-to-End Delay, the Attendance Success Rate and the Attack Detection Rate were successfully computed and evaluated.

5.10. Limitations

The study was successful in evaluating the security of an IoT attendance system using simulation, but there were a few limitations in it. One of the study’s most significant drawbacks is that the experiments used only simulated environments, not hardware that is part of an IoT system. Hence, some traits of real-world communication (e.g., hardware interference, variation of environmental signals, limitations of physical devices) were not completely captured. One constraint is the adoption of light, application-layer validation systems instead of strong security protocols. It mainly focused on duplicate attendance detection and token validation without using encryption methods like DTLS, block-chain authentication or machine learning based intrusion detection systems. The evaluation of the spoofing attack was also relatively simple compared to the replay attack evaluation. The simulated un-authorized attendance submission was not an advanced attack as the packet manipulation and identity impersonation attacks can be investigated further in future research. Moreover, the simulations were not performed at larger scales (hundreds of motes) because of computational and time constraints. Thus, the scalability analysis is confined to small / medium sized IoT network environments.

5.11. Contributions of the Research

Based on the above, this study brings the following contributions to the field of IoT security and smart educational systems. It evaluates the communication of attendance using QR codes in the context of lightweight architectures and simulation. The study combines a communication analysis, attendance verification, replay attack detection, and scalability testing in a single simulation framework developed with Contiki-NG and the Cooja simulator. The integration of sensor, network and application layer analysis in a single attendance system environment is one of the key contributions of the research. This study is different from most of the previous studies which were either based on security analysis or application functionality or only protocol level analysis as it incorporates the communication performance evaluation and security analysis with multiple network conditions. The research also offers practical knowledge on the replay attack behavior, lightweight validation mechanisms, and communication scalability in limited environments of IoT. Furthermore, this study lays a groundwork for future research on the IoT attendance system, showing that simulation tools can be used to test the reliability of communication and security vulnerabilities before the real deployment.

5.12. Future Work, Practical Implication and Recommendation

There are several aspects that can be taken into consideration for future research on IoT-based smart attendance systems. An additional promising direction is the introduction of more sophisticated cryptographic protocols like DTLS, blockchain attendance verification, or lightweight encryption methods to enhance communication security even more. In future, studies can also incorporate machine learning or artificial intelligence (AI) based intrusion detection systems to automatically detect abnormal communication patterns and malicious attendance submissions in IoT environments. These methods can enhance accuracy in detecting attacks, and they can help enable adaptive security mechanisms. Another interesting direction for future work is to integrate the proposed attendance system into a real IoT hardware platform like Raspberry Pi, ESP32 or wireless sensor motes to test the simulation results in the real communication environment. More comprehensive simulations with hundreds of nodes could also be performed to assess the scalability, congestion handling and routing capabilities for dense IoT communication scenarios. Furthermore, future works can explore further sophisticated attack models including sinkhole attacks, sybil attacks, routing manipulation or packet injection attacks in smart attendance system. Future incorporation of cloud computing, mobile application and real-time database synchronisation could boost the real-world usability of attendance systems based on IoT devices. The proposed smart attendance system can be further enhanced by implementing the system in real hardware scenarios by using real motes and embedded devices in the physical IoT environments. This would enable the practical assessment of the reliability and security of communications in real classroom settings. QR scanning apps for mobile devices can also improve ease of use by allowing for immediate attendance reporting via mobile and portable devices. Furthermore, AI-driven intrusion detection methods could be implemented to detect unexpected network activities and enhance false-positive rates, thereby allowing for real-time detection of network intrusions. By using blockchain for attendance verification, it could help ensure that attendance records are tamper-resistant and trustworthy, enhancing both data integrity and trust. Possible future improvements include secure cloud integration for protected storage and remote monitoring, and implementation of energy-aware security mechanisms for low-resource IoT devices to minimise energy use. Finally, extensive deployment testing with greater numbers of nodes and more complex network conditions would give more comprehensive testing of scalability, network stability and long term system performance in real educational settings.

5.12.1. Security Enhancements

The system implemented in this project employed a token validation and duplicate detection system to minimise attendance attacks by replay and spoofing; however, a number of advanced security technologies were not deployed for various reasons, including time, scope and simulation complexity. But these are the future enhancements that can make QR code smart attendance systems more secure in the IoT era. One possible improvement is the use of Datagram Transport Layer Security (DTLS). Because the system is based on UDP which is lightweight, DTLS may be used to encrypt, authenticate and provide message integrity protection to UDP-based communication. This will minimize the threat posed by packet interception, modification and unauthorized replay. DTLS, however, will add further handshake delay, memory overhead and energy consumption, which needs to be assessed in the limited resource setting of IoT. Another enhancement is the encryption of attendance packets by AES encryption while being transmitted. AES could encrypt the sensitive information like students id, token, timestamp and class id before sending. This would help to avoid reading or tampering with attendance data by the attackers. But encryption must also be managed appropriately and could result in a higher processing overhead on low-powered motes. Future iterations of the system might also consider to use blockchain for authentication. The blockchain can offer attendance records which are tamper-proof, verification which is decentralised, and increased auditability. Accepted attendance records could be kept as immutable transactions in an attendance system. But traditional blockchain systems consume a lot of storage, processing power, and network resources, which may not be feasible for the vastly resource-constrained IoT devices unless they adopt lightweight or off-chain blockchain models. The use of a lightweight Intrusion Detection System (IDS) would also benefit the security by keeping track of the unusual packet behaviour, repeated packet transmissions, spoofed identities, or unusual routing activities. For instance, if too many duplicate packets are detected, a sudden increase in traffic, or suspicious mote behaviour is detected, the IDS can detect it. This would mean there would be an added layer of security over token validation. Yet, IDS mechanisms should not be heavy to not burden the constrained IoT nodes. Another major enhancement that is imperative is the use of Secure RPL. Because RPL is in charge of the routing process in the low-power IoT network, an attack over routing behaviour might impact the delivery, delay and stability of the network. Secure RPL mechanisms can provide resistance to routing attacks like sinkhole, selective forwarding, rank manipulation and replay-based routing disruption. This would beef up the network layer, while the project is primarily about application-layer validation. Additionally, the system could implement authentication keys between student motes and gateway/server in the future versions. A key might be given to each mote, so that they could be identified before packets for attendance are accepted. This would minimize the risk of spoofing as the attacker would have to copy both the attendance token and have a valid authentication key. But to do this there must be secure key distribution, key storage, and key renewal systems. Last but not least, hash-based validation could be implemented to further enhance token validation. The student mote could compute a hash value based on student id, time, class id and a secret key, rather than using a simple token. The server could then recalculate the hash and then check if the value received is the same. This would facilitate the detection of packets that are tampered with, and enhance the integrity of messages. Compared with full encryption, hash-based validation is relatively easy to implement; it might work in constrained IoT environments. In summary, these mechanisms can play a crucial role in enhancing the security of the proposed system, ensuring the confidentiality, integrity, authentication, and reliability of communication. Each of these techniques, however, also adds further processing, memory, energy and implementation costs. Thus, it is recommended to further investigate these approaches in detail with Contiki-NG and Cooja to identify which of the security solutions is most suitable in terms of protection and lightweight implementation in attendance systems for the IoT.

6. Conclusions

This study presented a security analysis of an IoT network architecture for QR-code-based smart attendance systems using Contiki-NG and the Cooja simulator. A lightweight communication framework based on IEEE 802.15.4, 6LoWPAN, IPv6, RPL Lite, CSMA, and UDP was developed to examine both network performance and security under realistic operating conditions. Simulations involving 5, 20, and 50 motes showed that the proposed architecture maintained reliable attendance communication as network size increased, although higher node density introduced greater contention, routing overhead, and end-to-end delay.

The security evaluation demonstrated that lightweight application-layer mechanisms, including token validation, attendance verification, and duplicate detection, effectively prevented replayed and duplicate attendance submissions while imposing minimal processing overhead. These results indicate that practical protection can be achieved without compromising the resource constraints of low-power IoT devices. At the same time, the study highlights that such mechanisms alone are insufficient to address advanced threats, including device impersonation, packet interception, and routing-layer attacks. Consequently, lightweight validation should be complemented by stronger authentication, secure communication, and continuous network monitoring.

Overall, this work provides a practical framework for evaluating both communication behaviour and security within IoT-enabled attendance systems. The findings demonstrate that dependable smart attendance depends not only on efficient network operation but also on the integration of appropriate security controls across multiple layers of the architecture. Future work will focus on incorporating lightweight cryptographic protocols, authenticated communication, intrusion detection, and large-scale experimental deployments to further strengthen the security and resilience of IoT-based smart attendance systems.