# An Intrusion Detection System for Securing IoT Based Sensor Networks from Routing Attacks

Shalini Subramani, M. Selvi, S. Kumar, K. Thangaramya, M. Anand, A.

Kannan

► To cite this version:

Shalini Subramani, M. Selvi, S. Kumar, K. Thangaramya, M. Anand, et al., An Intrusion Detection System for Securing IoT Based Sensor Networks from Routing Attacks. 7th International Conference on Computer, Communication, and Signal Processing (ICCCSP), Jan 2023, Chennai, India. pp.321-334, 10.1007/978-3-031-39811-7_26. hal-05363233

HAL Id: hal-05363233

https://inria.hal.science/hal-05363233v1

Submitted on 13 Nov 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_3.png" /></figure>

# An Intrusion Detection System for Securing IoT
Based Sensor Networks from Routing Attacks

Shalini Subramani¹, M. Selvi¹(✉) ID, S. V. N. Santhosh Kumar², K. Thangaramya³,
M. Anand⁴, and A. Kannan¹

¹ School of Computer Science and Engineering, Vellore Institute of Technology,
Vellore 632014, India
selvi.m@vit.ac.in

² School of Information Technology and Engineering, Vellore Institute of Technology,
Vellore 632014, India

³ Computer Science and Engineering, College of Engineering Guindy, Anna University,
Chennai 600025, India

⁴ Department of Electronics and Communication, Saveetha Engineering College,
Chennai 602105, India

**Abstract.** Internet of Things is made up of sensor nodes that can sense the given environment, gather the data from environment and then communicates the data to the sink node and the internet through wireless communication. As it follows the routing protocols used in Wireless Sensor Networks, the Denial of Service (DoS) attacks including selective forwarding and flooding are launched by the attackers through Routing Protocol for Low-Power and Lossy Network (RPL) attacks. Intrusion detection systems are able to handle the RPL based DoS attacks and can prevent the attackers from participation in the routing process. Therefore, we propose a new fuzzy temporal random forest algorithm for detecting the attacks more efficiently. In addition, a new intelligent agent based intrusion prevention system which uses fuzzy temporal inference rules for intrusion prevention is also proposed in this work. The proposed model has been compared with other machine learning algorithms such as decision trees, logistic regression, random forest, K-Nearest Neighbor and also the deep learning algorithm namely the Convolution neural networks. Based on the experimentations carried out, we could prove that the proposed algorithm provides higher intrusion detection accuracy, reduces the false positive rate and detection time when compared with the related work.

**Keywords:** IDS · Classification · Detection Accuracy · False Positive Rate · DoS Attack · RPL Attacks

## 1 Introduction

Recently, the usage of Internet of Things (IoT) is becoming as an essential component of our daily life. The current IoT based applications are using Wireless Sensor Networks (WSNs) for sensing the data from environment using IoT and they are sent to the required
destinations including the base stations. As a result of this, the sensor nodes present in the IoT systems are prone to different kinds of attacks which lead to various types of data loss and information theft. Moreover, the routing attacks are possible through the wireless routing protocol for IoT called the Routing Protocol for Low-Power and Lossy Network (RPL) [24] since the safeguarding mechanism of the RPL protocol are compromised by the malicious nodes present in the given scenario. However, it is essential to protect IoT transmission against two significant Denial of Service (DoS) threats, namely targeted data delivery attack and flooding attacks, which are initiated over the RPL protocol when routing the data packets to the destination. In addition, Distributed DoS (DDoS) attacks are also to be consider in the design of a new Intrusion Detection System (IDS) [1]. Intrusion Detection Systems are capable of identifying the DoS attacks more efficiently since they can analysis the network traffic patterns and the behavior of sensor nodes for detecting the malicious nodes. The main objective of designing an IDS for IoT is to secure the network from unauthorized access, illegal use, disclosure, disruption of communication, data modification, or destruction of packets. Moreover, IoT network security using IDS can minimize the risks related to the three main information and network security goals namely confidentiality, integrity and availability. Various IDSs have been designed and deployed in the past to identify the malicious nodes which are launching Internet-based DoS attacks. Moreover, the IDSs [25] are capable of handling both the internal and external user attacks in the IoT environment. Therefore, IDSs provide a wall of defense in IoT communication since they overcome the actions of attackers present in the IoT.

In the IoT environment, the Network IDSs can be deployed for passively monitoring the traffic on the sensor networks and to perform more advanced security checking, including the protocol and content inspection such as the verification of RPL contents in order to predict the indications of any possible attacks. In this scenario, Intrusion Prevention Systems (IPSs) can be used to provide the actions based on the feedback received from the IDS. Therefore, the IPS can act as a security model to increase the functionality of the intrusion detection systems and the firewalls, by performing an in-depth inspection of the network traffic and also by using this analysed information to prevent possible attacks. If intrusions are detected and prevented in advance using anomaly and misuse behaviours, the security of the IoT communication system can be enhanced better. Moreover, Intrusion prevention for an IoT based sensor network, it is possible to employ intelligent agents that are capable of sensing the environment intelligently to form inference rules and to apply them for predicting and preventing the intrusions effectively.

This paper proposes a new IDS that performs feature selection using the dynamic feature selection algorithm which was developed by Nancy et al. [7] and also performs classification not only by applying the full features, but also based on the selected features for identifying the malicious nodes. Therefore, a new classification algorithm namely Fuzzy Temporal Random Forest (FTRF) classification algorithm has been proposed in this paper that performs deductive inference using fuzzy temporal rules for detecting the users having malicious intension more efficiently during the selection of decisions from the best possible decision tree for classification. This classification algorithm has
been tested by comparing it with other classifiers including the basic decision tree clas-
sification algorithm, logistic regression-based classifier, the random forest classification
algorithm and the deep learning based classification algorithm namely the Convolutional
Neural Network (CNN). Moreover, a new intelligent agent based intrusion prevention
system is also proposed in this work. The proposed work has been compared with dif-
ferent machine learning algorithms and CNN based on the metrics namely intrusion
detection accuracy with 5% attacker nodes and 2% of attacker nodes and also it has been
compared with the existing intrusion detection systems proposed by Nancy et al. [7],
Soe et al. [2], Rahman et al. [3] and Medjek et al. [6]. The evaluation also considered
the other metrics namely False Positive Rate (FPR) analysis and intrusion detection
time analysis. From all these experiments, it has been demonstrated that the proposed
IDS provided increased detection accuracy, reduced FPR and optimal classification time
when compared to the existing works. Therefore, the major advantage of the model is
improved and efficient intrusion detection with high detection accuracy and it also is
reducing the rate of false positives.

The rest of this article has been presented by following the sequence given here.
Section 2 is focusing on the study of existing systems and compares them with respect to
intrusion detection accuracy. Section 3 is provided here for explaining the salient features
of the proposed system and the methodology followed to develop it. Section 4 illustrates
the performance of this system through experiments and highlights the contributions.
Section 5 is focusing on the concluding part of this work and it gives motivations for the
further extensions.

## 2 Literature Survey

In the literature, we discuss about various security works for IoT and computer net-
works using IDSs [2, 3, 6, 7], trust management [8], key management, access control
and secure routing [9]. The attacks in IoT based sensor networks were explored by
various researchers in the past by considering both DoS [5] and DDoS [4] attacks. In
this direction, Sharmistha Nayak et al. [10], proposed a new Generative Adversarial
Network-Classifier (GAN-C) approach for the detection of RPL based DoS attacks by
using a combination of GAN and Support Vector Machines (SVM) classifiers. They eval-
uated the performance of their system in the GAN-C environment by applying the SVM
classifier. Moreover, their proposed model adopted a parallel learning and detection app-
roach which also supported Deep Learning based classification of the data communicated
through IoT devices. The main limitation of their model is the consideration of the exist-
ing classifiers to classify even the uncertain data. Saurabh Sharma and Vinod Kumar
Verma [11] proposed an IDS in which they considered one root node, one malicious
node and different number of normal and genuine nodes. Saurabh Sharma and Vinod
Kumar Verma [12] proposed a supervised machine learning algorithm based on Artificial
Neural Networks (ANNs) to detect the three RPL attacks: hello-food, decreased-rank,
and increased-version. Attacks can be avoided if the malicious nodes are identified
quickly and accurately. Their suggested model's accuracy was calculated using a hold-
out approach and a tenfold cross-validation procedure. Syeda M. Muzammal, et al.
[13] explained about security concerns and requirements for IoT networks and also the
attacks on the RPL routing protocol, such as Blackhole, Spoofing, Rank, etc. This is a
major benefit because they analyzed IoT threat models and reviewed ML-based security
solutions, including supervised, unsupervised, and reinforcement learning approaches.

Mohammad Mehedi Hassan, et al. [14] proposed a user model with better accessibil-
ity to IoT processes. In their model, the data repositories are segregated according to their
level of trust. Trust boundary techniques are used to ensure the confidentiality, integrity,
and availability of communication in IoT networks. Baifeng Ning et al. [15] proposed a
GAN-based power attack sample generation method. It used a large number of positive
and negative samples for deep learning-based attack detection and also for generating
power IoT attack samples based on an adversarial generation network. Joseph Charles
and Kalavathi [16] proposed a new technique for secure routing that relies on the quality
of links. A Link Quality-Based Objective Function to measure the link quality is used in
their proposed technique, and this yielded better link estimation values than the existing
methods. To improve the security of RPL, their work had to aggregate two or more vari-
ables and created a composite metric, and an objective function to measure the quality.
Ahmed Raoof, et al. [17] proposed a secured routing model for detection and mitigation
of attacks during routing using RPL. When it comes to protecting the network from
Internet-side threats, their work provided better mechanisms for security. The focus of
their research was to examine and build an improved RPL-based IoT network mitigation
strategies. Oana Iova et al. [18] proposed a routing mechanism for RPL with security. In
their model, each node rebroadcasts the information object based packets according to
an adaptive approach called the Trickle algorithm, which balances the energy efficiency
and also the responsiveness for dynamic routing. Mohammad Dawood Momand et al.
[19] proposed an IoT and machine learning-based IDS for identifying multiple RPL
attacks. An attempt is made by them to detect rank, version number, and DoS attacks.
Harith Kharrufa et al. [20] proposed a new IDS based on controlled reverse-trickle tim-
ing to ensure high responsiveness with low overhead and examined it for obtaining the
optimal solution. The optimization of objective function measurements is also utilised
to improve multipath routing and is essential to achieving better network performance.
Andrea Agiollo et al. [21] proposed a novel method for detecting the routing attacks in
RPL. Emre Aydogan et al. [22] proposed a way to identify intrusions into the IoT. In
particular, they were aiming to identify RPL assaults using Genetic Programming (GP).
According to these authors, RPL exploits can be detected with more accuracy using
genetic programming. Harith Kharrufa et al. [23] proposed a routing protocol based on
RPL for IoT applications. According to them, RPL can be used in a variety of applica-
tions, including but not limited to healthcare, smart environments, transportation, and
industrial and military applications.

3 Proposed Methodology

In this paper, we proposed a new intrusion detection and prevention system for detecting the malicious nodes using machine learning techniques. For this purpose, new classifier namely FRF which performs the classification of the sensor network trace data collected from the MATLAB simulator. Finally, an intelligent agent-based intrusion prevention system has been proposed in this work. The interaction among all the components of the system has been established by the development of a system architecture.
## 3.1 Proposed System Architecture

Figure 1 shows the proposed system architecture that contains eight modules namely IoT sensor nodes, data collection module, intrusion detection module, intrusion prevention module, IoT sensors communication module, fuzzy temporal rule manager, decision manager and knowledge base. The IoT sensor nodes are deployed for collecting and routing the information from the network and the data collection module gathers all the information from the sensor nodes. The intrusion detection module is composed of several components: a feature selection module, a classification module, a decision-making module, and a secure routing module. The intrusion prevention module consists of three modules namely prevention of selective forwarding attacks, prevention of flooding attacks and node isolation module. The IoT sensor communication module is used for communicating between the sender and receiver through the delivery of data packets by using RPL method. The fuzzy temporal rules are generated by the fuzzy temporal rule manager the data are stored in the knowledge base and are used for inference and output generation. The decision manager oversees and manages all the components in the proposed system. To develop the most efficient packet forwarding, the decision manager uses knowledge base rules in conjunction with fuzzy temporal inference.

## 3.2 Intrusion Detection System

In this paper, we proposed IDS for identifying the unknown nodes in the sensor network. For this reason, the network trace data collected from the IoT sensor nodes are analyzed for features which are selected using the dynamic feature selection classifier proposed by Nancy et al. [7]. In addition, a new algorithm is proposed namely Fuzzy Temporal Random Forest (FTRF) classifier by extending the random forest algorithm with fuzzy temporal rules. Finally, a new intrusion prevention module has been developed in this work using intelligent agents.

### 3.2.1 Intrusion Detection System Design using Fuzzy Temporal Random Forest

A random forest is a classifier that uses decision trees as the basis for an ensemble learning approach. L-trees are the underlying foundation of the RF model. Every single tree in the forest is designated to be the decider in the sense that it is in charge of sorting each independent variable X into the group of classes which the tree believes are the most suitable. Equation 18 shows the representation of the random forest algorithm.

$$ \{H(X, \theta_L), l = 1, 2, 3, \dots, L\} \qquad (1) $$

L denotes the number of decision trees included in RF, $\theta_L$ represents independent and identically distributed random vectors. All decisions are created randomly by randomly selecting data. In RFs, each decision split selects random features. Randomly choosing attributes which can then be used to improve predictions and outcomes of these models results in improved efficiency. Since the RF can manage missing values, deal with continuous, categorical, and binary data, and can operate in high-dimensional modelling, it is well-suited for many different types of data. Bootstrapping and ensemble techniques will make RF strong enough to surpass the difficulties of imbalanced
<figure><img src="image_4.png" /><figcaption>Fig. 1. System Architecture</figcaption></figure>

datasets and, hence, tree pruning is unnecessary. Apart from having an extremely high accuracy rate, it uses efficient, interpretable, and non-parametric classification methods. Because of the implementation of ensemble techniques and random sampling, it delivers improved accuracy in predictions and generalisation. It categorises monitored traffic as either regular or malicious.

RF uses a multi-class classifier to confirm the existence of malicious communications. The RF classifier can be used to detect the initiated target class and it can provide guidance on what form of defence mechanism should be selected. However, whenever there is an uncertainty in the dataset through the presence of incomplete information, the RF algorithm does not converge well. Therefore, the existing RF algorithm is extended with fuzzy temporal rules in this work to propose a new fuzzy temporal random forest algorithm for efficient classification of intrusion detection information even with incomplete information. Moreover, the fuzzy temporal rule system used in this work follows
the fuzzy membership functions which are shown in the Eqs. 2 and 3.

$$ \mu_{B1}(X) = \begin{cases} 0, & X \le b1 \\ \frac{X - l1}{m1 - l1}, & l1 \le X \le m1 \\ \frac{n1 - X}{n1 - j1}, & m1 \le X \le n1 \\ 0, & n1 \le X \end{cases} \qquad (2) $$

$$ \mu_{B2}(X) = \begin{cases} 0, & X \le b2 \\ \frac{d2 - z}{d2 - n2}, & n2 \le X \le d2 \\ 1, & m2 \le X \le n2 \\ \frac{d2 - z}{d2 - n2}, & n2 \le X \le d2 \\ 0, & d2 \le X \end{cases} \qquad (3) $$

The variables X and z indicate the fuzzy and actual distances. Similarly, the fuzzy distance value is generated using the membership function. In this work, we proposed a fuzzy temporal inference model with five input variables, each with three levels of input. An appropriate range of fuzzy were employed for each linguistic variable.

CH Current Energy- Low, Medium and High.

Distance between CH and BS- Closer, Medium Distant and Distant.

Distance between CH and Node- Closer, Medium, Medium Distant and Distant.

CH Degree- Low, Low Average, Average, More Average and More.

Mobility Duration of Nodes- Low, High and Medium.

Possibility of CH Selection- Lower, Medium and Higher.

The fuzzy logic with temporal constraints on the mobility of nodes is used for performing decision making based on the IF-THEN rules with the random forest algorithm to provide the fuzzy based random forest algorithm. The fuzzy rules are generated and implemented in this work are shown in Table 1. From the fuzzy temporal random forest model, the Centre of Area (COA) method is used in this work for de-fuzzification as shown in Eq. 4.

$$ COA = \frac{\int \mu_{B}(X) * Xdx}{\int \mu_{B}(X)dx} \qquad (4) $$

The steps of the proposed FTRF-IDS algorithm are as follows:

Algorithm: FTRF-IDS.

Input: Full features and dataset.

Output: Attacks, routing details.

Step-1: Read the dataset, feature names.

Step-2: Divide the dataset into training set and testing set.

Step-3: Compute the information gain values for all features.

Step-4: Call dynamic feature selection algorithm and obtain the selected features.

Step-5: Call random forest with fuzzy and temporal rules and perform the training to classify the dataset.
Step-6: Form fuzzy temporal rules and store them in the knowledge base.

Step-7: Perform fuzzy temporal inference based testing of the dataset and identify the malicious nodes.

Step-8: Classify the attacks into subclasses of RPL based DoS attacks.

Step-9: Call the intelligent agents to prevent the attacks found from step-7 and prevent them.

Step-10: Perform the secure routing by isolating the malicious nodes in the routing process.

Step-11: Stop.

This algorithm performs both intrusion detection and prevention of such intrusions. Finally, the proposed algorithm namely FTRF-IDS performs the isolation of malicious nodes and route the collected data from the nodes to the base station securely.

<table><caption>**Table 1.** Fuzzy Temporal Rules</caption><thead><tr><th>Current Energy of CH</th><th>Distance between CH and BS</th><th>Distance between CH and Node</th><th>CH Degree</th><th>Mobility Duration of Nodes</th><th>Possibility of CH Selection</th></tr></thead><tbody><tr><td>Lower</td><td>Long-Distance</td><td>Long-Distance</td><td>More</td><td>Low</td><td>Middle</td></tr><tr><td>Lower</td><td>Long-Distance</td><td>Long-Distance</td><td>Average</td><td>Middle</td><td>Lower</td></tr><tr><td>Lower</td><td>Long-Distance</td><td>Long-Distance</td><td>Low</td><td>High</td><td>Lower</td></tr><tr><td>Middle</td><td>Longer Distance</td><td>Middle</td><td>Average</td><td>Low</td><td>Higher</td></tr><tr><td>Middle</td><td>Longer Distance</td><td>Middle Distant</td><td>More</td><td>Middle</td><td>Middle</td></tr><tr><td>Middle</td><td>Longer Distance</td><td>Middle Distant</td><td>Low Average</td><td>High</td><td>Lower</td></tr><tr><td>Higher</td><td>Medium Nearer</td><td>Middle</td><td>More Average</td><td>Low</td><td>Middle</td></tr><tr><td>Higher</td><td>Nearer</td><td>Middle</td><td>Low</td><td>Middle</td><td>Higher</td></tr><tr><td>Higher</td><td>Nearer</td><td>Nearer</td><td>Average</td><td>High</td><td>Middle</td></tr><tr><td>Higher</td><td>Nearer</td><td>Nearer</td><td>More</td><td>Low</td><td>Higher</td></tr></tbody></table>

### 3.2.2 Intrusion Prevention Module

The intrusion prevention module is developed in this work using an intelligent agent based approach that consists of fuzzy temporal rule system and decision manager module. The agents structure in the decision manager module consists of the five types of agents called fuzzy temporal inference agent, Temporal Reasoning agent, data communication agent, coordination agent and action agent. The Agents are invoked by the decision manager module for intrusion prevention. The fuzzy temporal rule system can be called
by decision manager in which the intelligent coordination agents are used to initiate the
inference process to perform the intrusion prevention.

**Fuzzy Temporal Inference Agent:** The fuzzy temporal inference agent resides in fuzzy temporal rule manager and the details are already explained in the fuzzy temporal inference process used in intrusion detection.

**Temporal Reasoning Agent:** This agent is responsible for monitoring the user behavior with respect to temporal intervals by using fuzzy temporal rules. The action taken by this agent is to prevent a user from accessing the networks for an interval of time, which may vary from a few minutes to some hours. This agent uses interval rules and applies interval comparison operators for decision-making. An interval based temporal rule is fired by the fuzzy temporal inference system whenever an intrusion alarm is raised and if the time of occurrence between the communication of two consecutive messages related to time based data delivery is either less or greater than the lower and upper bounds of the time interval.

**Data Communication Agent:** This agent is responsible for applying security policies during transmission and retransmission of messages. These agents are responsible to trigger rules in order to set a monitor the network conditions. In the prevention of RPL attacks, the data communication agent fires a cascading rule that monitors the network events continuously and deny some privileges to the intruders so that it is not possible for the intruders to suppress the message transmission. This cascading rule has mainly different sub components and are called as inner level rules to check the intrusions based on fuzzy temporal rules.

**Coordination Agent:** This agent provides a menu driven information about all the modules in the system to the user. The various services provided by this agent are input validation, output filtering, identification of applications using port number and IP address, authentication of users, access control and maintenance of integrity. This agent makes use of the rule manager for providing these services effectively. The main advantage of this agent is to provide the naïve users with necessary information for using the intrusion detection and prevention system through menus and forms. It can interact with administrator module and other agents to update the security policies.

**Action Agent:** This agent is used to kill all the processes from the local host. Moreover, this agent is responsible for providing information about the status of the processes. In order to achieve this, an alert message is sent to all the nodes before killing a process. It can suspend the connection for a desired time delay and can permit the connection to resume the connection establishment back. The various actions handled by this agent are suspending a process for a specified interval of time, making a process to sleep for a given time duration, locking the keyboard, locking the monitor and killing a process.

# 4 Results and Discussion

In this paper, we propose a new IDS called FTRF-IDS that has been simulated by using MATLAB simulator. The proposed FTRF-IDS algorithm has been implemented and has been evaluated by comparing with three classifiers namely Decision Tree Algorithm
(DTA), Logistic Regression Algorithm (LRA) and Random Forest Algorithm (RFA). The experiments conducted in this work has been evaluated here and the performance of the proposed IDS is compared with existing algorithms namely the works proposed by Nancy et al. [7], Soe et al. [2], Rahman et al. [3] and Medjek et al. [6] by performing the routing of the collected data.

Figure 2 shows the performance comparison based on accuracy of intrusion detection between the proposed FTRF classifier for selected features and the existing classifiers namely DTA, LRA, CNN and RFA. This experimentation has been carried out with 1% of malicious nodes out of total number of nodes such as 100, 200, 300, 400 and 500 which are considered in different experiments. From figure-2, it is noticed that the proposed algorithm namely FTRF-IDS is providing higher classification accuracy for selected features are compared with other existing classifiers namely DTA, LRA, CNN and RFA. The proposed FTRF classifier for IDS are experimented with 1% of the nodes were considered to be malicious.

<figure><img src="image_5.png" /><figcaption>Fig. 2. Accuracy Analysis with Selected Features</figcaption></figure>

Figure 3 shows the false positive rate analysis with full features when compared with existing classifiers namely DTA, LRA and RFA.

From Fig. 3, it is observed that the proposed algorithm namely FTRF-IDS is providing reduced false positive rate for full features were compared with other existing classifiers namely DTA, LRA and RFA.

Figure 4 shows the false positive rate analysis with selected features when compared with existing classifiers namely DTA, LRA, CNN and RFA.

From Fig. 4, it is observed that the proposed algorithm namely FTRF-IDS used to reduce the false positive rate with selected features are compared with other existing classifiers namely DTA, LRA, CNN and RFA.
False Positive Rate Analysis with
Full Features

<figure><img src="image_6.png" /><figcaption>Fig. 3. False Positive Rate Analysis with Full Feature</figcaption></figure>

False Positive Rate Analysis with
Selected Features

<figure><img src="image_7.png" /><figcaption>Fig. 4. False Positive Rate Analysis with Selected Features</figcaption></figure>

Figure 5 shows the classification time analysis for proposed algorithm namely FTRF-IDS are compared with existing classifiers namely DTA, LRA, CNN and RFA with selected features. From figure-5, it noticed that the proposed algorithm namely FTRF-IDS is used to reduce the classification time when it is compared with other existing classifiers namely DTA, LRA, CNN and RFA with selected features.
<figure><img src="image_8.png" /><figcaption>Fig. 5. Classification Time Analysis with Selected Features</figcaption></figure>

## 5 Conclusion

In this paper, a new IDS using the machine learning algorithm namely FTRF-IDS has been proposed for securing the communication in IoT based sensor networks. Therefore, the existing feature selection algorithm called as the dynamic feature selection algorithm proposed by Nancy et al. [7] was employed to select the most contributing and optimal features from the set of available features extracted from the network trace data. Moreover, a new classifier namely FTRF has been proposed in this work for classify the network traffic that was generated by the IoT based sensor network. Here, the simulations were carried out using MATLAB for the deployment of IoT sensors, data collection, classification and intrusion detection. In addition, a new intelligent agent-based intrusion prevention system is also proposed in this paper for preventing two types of RPL based DoS attacks namely selective forwarding attacks and flooding attacks more effectively. According to the results of the experiments conducted in this work, the proposed intrusion detection model improves detection accuracy by more than 5% when compared to other relevant systems, it reduces false positive rates by more than 4% and optimizes classification time by up to 1%. Future works on this IDS can be the introduction of a new technique for sending the data to the cloud from the sensor nodes in order to perform the routing through the cloud networks.
References

1. Labiod, Y., Korba, A.A., Ghoualmi-Zine, N.: Detecting DDoS attacks in IoT environment. Int. J. Inform. Secur. Privacy **15**(2), 145–180 (2021)

2. Soe, Y.N., Feng, Y., Santosa, P.I., Hartanto, R., Sakurai, K.: Implementing lightweight IoT-IDS on raspberry pi using correlation-based feature selection and its performance evaluation. In: Barolli, L., Takizawa, M., Xhafa, F., Enokido, T. (eds.) Advanced Information Networking and Applications: Proceedings of the 33rd International Conference on Advanced Information Networking and Applications (AINA-2019), pp. 458–469. Springer International Publishing, Cham (2020). https://doi.org/10.1007/978-3-030-15032-7_39

3. Rahman, M.A., Asyhari, A.T., Leong, L.S., Satrya, G.B., Tao, M.H., Zolkipli, M.F.: Scalable machine learning-based intrusion detection system for IoT-enabled smart cities. Sustain. Cities Soc. **61**, 102324 (2020)

4. Al-Hadhrami, Y., Hussain, F.K.: DDoS attacks in IoT networks: a comprehensive systematic literature review. World Wide Web **24**(3), 971–1001 (2021). https://doi.org/10.1007/s11280-020-00855-2

5. Liang, L., Zheng, K., Sheng, Q., & Huang, X.: A Denial of Service attack method for an IoT system. In: 2016 8th International Conference on Information Technology in Medicine and Education (ITME), pp. 360–364. IEEE (2016)

6. Medjek, F., Tandjaoui, D., Djedjig, N., Romdhani, I.: Fault-tolerant AI-driven intrusion detection system for the internet of things. Int. J. Crit. Infrastruct. Prot. **34**, 100436 (2021)

7. Nancy, P., Muthurajkumar, S., Ganapathy, S., Kumar, S.S., Selvi, M., Arputharaj, K.: Intrusion detection using dynamic feature selection and fuzzy temporal decision tree classification for wireless sensor networks. IET Commun. **14**(5), 888–895 (2020)

8. Selvi, M., Thangaramya, K., Ganapathy, S., Kulothungan, K., Khannah Nehemiah, H., Kannan, A.: An energy aware trust based secure routing algorithm for effective communication in wireless sensor networks. Wireless Pers. Commun. **105**(4), 1475–1490 (2019)

9. Thangaramya, K., Kulothungan, K., Logambigai, R., Selvi, M., Ganapathy, S., Kannan, A.: Energy aware cluster and neuro-fuzzy based routing algorithm for wireless sensor networks in IoT. Comput. Netw. **151**, 211–223 (2019)

10. Nayak, S., Ahmed, N., Misra, S.: Deep Learning-Based Reliable Routing Attack Detection Mechanism for Industrial Internet of Things, Elsevier, Ad Hoc Networks 123 | 102661, vol. 123, pp. 1–11 (2021)

11. Sharma, S., Verma, V.K.: Security explorations for routing attacks in low power networks on Internet of Things. J. Supercomput. **77**(5), 4778–4812 (2020). https://doi.org/10.1007/s11227-020-03471-z

12. Sharma, S., Verma, V.K.: AIEMLA: artificial intelligence enabled machine learning approach for routing attacks on internet of things. J. Supercomput. **77**(12), 13757–13787 (2021). https://doi.org/10.1007/s11227-021-03833-1

13. Muzammal, S.M., Murugesan, R.K., Jhanjhi, N.Z.: A comprehensive review on secure routing in Internet of Things: mitigation methods and trust-based approaches. IEEE Internet Things J. **8**(6), 4186–4210 (2021). https://doi.org/10.1109/JIOT.2020.3031162

14. Hassan, M.M., Rafiul Hassan, M., Huda, S., de Albuquerque, V.H.C.: A robust deep-learning-enabled trust-boundary protection for adversarial industrial IoT environment. IEEE Internet Things J. **8**(12), 9611–9621 (2021). https://doi.org/10.1109/JIOT.2020.3019225

15. Ning, B., Qiu, S., Zhao, T., Li, Y.: Power IoT attack samples generation and detection using generative adversarial networks. In: 2020 IEEE 4th Conference on Energy Internet and Energy System Integration (EI2), pp. 3721–3724 (2020)

16. Joseph Charles, A.S., Kalavathi, P.: A reliable link quality-based RPL routing for Internet of Things. Soft Comput. **26**(1), 123–135 (2021). https://doi.org/10.1007/s00500-021-06443-4
17. Raoof, A., Matrawy, A., Lung, C.-H.: Routing attacks and mitigation methods for RPL-based Internet of Things. IEEE J. Magaz. IEEE Xplore 21(2), 1582–1606 (2019)

18. Iova, O., Picco, P., Istomin, T., Kiraly, C.: RPL: the routing standard for the Internet of Things... Or Is It? IEEE Commun. Magaz. 54(12), 16–22 (2016). https://doi.org/10.1109/ MCOM.2016.1600397CM

19. Momand, M.D., Mohsin, M.K., Ihsanulhaq: Machine Learning-based Multiple Attack Detection in RPL over IoT. In: IEEE Conference Publication, IEEE Xplore, pp. 1–8 (2020)

20. Kharrufa, H., Al-Kashoash, H., Al-Nidawi, Y., Mosquera, M.Q., Kemp, A.H.: Dynamic RPL for multi-hop routing in IoT applications. In: IEEE Conference Publication, IEEE Xplore, pp. 100–103 (2017)

21. Agiollo, A., Conti, M., Kaliyar, P., Lin, T.-N., Pajola, L.: DETONAR: detection of routing attacks in RPL-Based IoT. IEEE J. Magaz. IEEE Xplore 18(2), 1178–1190 (2021)

22. Aydogan, E., Yilmaz, S., Sen, S., Butun, I., Forsstrom, S., Gidlund, M.: A central intrusion detection system for RPL-based industrial Internet of Things. In: IEEE Conference Publication, IEEE Xplore, pp. 1–5 (2019)

23. Kharrufa, H., Al-Kashoash, H.A.A., Kemp, A.H.: RPL-based routing protocols in IoT applications: a review. IEEE J. Magaz. IEEE Xplore, pp. 124–130 (2018)

24. Raghavendra, T., Anand, M., Selvi, M., Thangaramya, K., Santhosh Kumar, S.V.N., Kannan, A.: An Intelligent RPL attack detection using machine learning-based intrusion detection system for Internet of Things. Procedia Comput. Sci. 215, 61–70 (2022). https://doi.org/10. 1016/j.procs.2022.12.007

25. Subramani, S., Selvi, M.: Multi-objective pso based feature selection for intrusion detection in IoT based Wireless Sensor Networks", Optik, Elsevier, vol. 273, pp. 170419 (2023)