# Hybrid Deep Learning-Based Intrusion Detection System for RPL IoT Networks
## 2 Literature Review
### Related Works
In addition, the approach does not consider the energy consumption of those constrained nodes that have agents that might be high, and without this important overhead, it is difficult to assess this method. In practice, most recent ML- and DL-based IDS approaches use existing benchmarking datasets to evaluate their works. The KDD99 [11] dataset is considered the most popular one released in 1999. It consists of 4.9 million labeled samples of regular traffic and 22 attack types that are categorized into four categories, namely, probing (probe) attacks, root to local (R2L) attacks, user to root (U2R) attacks, and denial of service (DoS) attacks. Another common dataset is NSL-KDD [12], an improved version of KDD99 that eliminates the redundant records in both the training and testing sets while keeping a reasonable number of records. The UNSW-NB15 [13] dataset was introduced to reflect real network traffic and modern low-footprint attacks. The dataset contains a total number of 2.5 million records, 49 features, and 9 types of modern attacks. A more recent WSN-DS dataset [14] was developed for a Wireless Sensor Network (WSN). It consists of 23 features and 4 labeled attacks (Blackhole, Grayhole, Flooding, and Scheduling). A more recent Bot-IoT dataset [8]was developed for both normal IoT-related and other network traffic, along with different types of attack traffic generally used by botnets. It contains of a total number of 72 million records, 35 features, and 3 attack categories (probing, DDOS, and information theft). However, the KDD99, NSL-KDD, and UNSW-NB15 datasets are not sufficient to be used as a benchmark for IoT-IDS. The network topologies used to create these datasets are based on client-server wired (Ethernet) communication, which is different from the one used in IoT, where wireless LLN networks are mostly used. Hence, the data traffic types, protocols, and attack types are different in those datasets compared to the IoT case. For example, in IoT networks that use RPL routing over 6 LoWPAN, specific control messages (DIO, DIS, DAO, and DAO-ACK) are responsible for network creation and management. Therefore, they are sensitive to different types of attacks. For the WSN-DS dataset, although it was designed for WSN (IoT type network), it requires a set of monitoring nodes to watch the neighbors and report them to the base station. This process consumes more energy and is difficult to manage and apply in reality. With the Bot-IoT dataset, the IoT services are simulated in a direct communication fashion, where the devices are connected directly with the server. However, this does not replicate other scenarios where the IoT devices form a sort of ad hoc network that allows them to communicate with each other and route the data to a center using a routing protocol. In addition, the majority of normal and attack traffic in the dataset are related to traditional computer network systems, and very little traffic is associated with the IoT services. Therefore, our proposed IoTR-DS dataset is more specialized for IoT-type networks where the RPL protocol is used over the 6 LoWPAN link layer. It adds some features that are further related to IoT normal and attack traffic that are not considered in the other dataset. In addition, no monitoring or sniffing tools are required to collect the nodes' data. The important IDS parameters are carried on the data packet sent by the nodes to the root, without any extra overhead. A full description of the IoTR-DS dataset is given in the next section.