# Hybrid Deep Learning-Based Intrusion Detection System for RPL IoT Networks
## 3 IoTR-DS Dataset Creation and Attacks Modeling
### Attack Implementation  
For the evaluation purpose, four subsets are created using four different scenarios in which the traffic is labeled according to an individual scenario. The first dataset represents the normal traffic behavior when there is no attack within the network. The other three datasets are the results of simulating three types of attacks, which are DIS, rank, and wormhole attacks. In all scenarios, the network's size consists of 100 nodes, whereas the number of malicious (attackers) nodes varies in a different attack scenario. The following gives more details about these attack implementation scenarios. Algorithm 1 shows the pseudocode for implementing a flood attack (DIS attack in RPL). At a preset time interval, three selected nodes at different locations will periodically (every 0.2 s in our implementation) broadcast DIS messages. This process is repeated with another three malicious nodes at a different place and at different time intervals. ```
1 Begin
2 If Malicious node and Start Attack < time < End Attack then
3 Create DIS, Send DIS to all reachable nodes every t time
4 If a node receiving DIS then
5 Trickle reset DIO timer, Send DIO to all reachable nodes on next interval
6 End
```  
**Algorithm 1** DIS Attack  
The pseudocode in Algorithm 2 shows the rank attack implementation. At a preset point of a time interval, three malicious nodes will initially decrease their rank by two and broadcast DIO messages, including the new ranks to their neighbors. The nodes receiving this DIO will see a better-preferred parent candidate than it currently has, and, thus, it will select it as its preferred parents, recalculate the rank, and broadcast the DIO with the new parameters. The nodes receiving this new DIO might also consider changing their rank and preferred parent. This process is repeated again with another three malicious nodes at a different location and at different time intervals. \begin{table}
\begin{tabular}{c l l} \hline \hline
**Number** & **Feature/Abbreviation** & **Description** \\ \hline
1 & No & Packet sequence number \\
2 & recTime & Packet receiving time \\
3 & sendTime & Packet sending time \\
4 & sendrIP & Source IP address \\
5 & nodeID & Node ID \\
6 & nextHopAddr & Node preferred parent \\
7 & Delay & Time received–time sent \\
8 & numSentDIO & Count of DIO sent messages \\
9 & numSentDIS & Count of DIS sent messages \\
10 & numPrefParentChange & Count of preferred parent changes at sending time \\
11 & numRankChange & Count of node rank changes at sending time \\
12 & residualEnergy & Node residual energy at sending time \\
13 & numUdpSent & Count of UDP (data) packets sent at sending time \\
14 & numUdpRec & Count of UDP (data) packets received at receiving time (calculated) \\
15 & PDR & Packet delivery ratio (numUdpRec/numUdpSent) at receiving time (calculated) \\
16 & label & Multi-class labels for different attacks and normal traffic \\ \hline \hline \end{tabular}
\end{table} 
Table 2: IoTR-DS Dataset Attributes. In a wormhole attack, the malicious node has two network interfaces. On the 802.15.4 interface, the node makes communication to the normal RPL tree, whereas it uses the 802.11 (WiFi) interface to create a tunnel with another malicious node. Although the two malicious nodes are far apart, they are considered neighbors to other nodes. Algorithm 3 shows the pseudocode for implementing this attack. After the tree creation, and at a particular time, one malicious node's multicast DIO message on its interface 802.11 (wider coverage) will be picked up by another malicious node, which has a similar interface. The second malicious node will connect to the sender (create a tunnel) and broadcast the DIO message on 802.15.4, advertising a better link. The node receiving the DIO from this malicious node will probably change its preferred parent to be the sender. The RPL protocol and attacks are implemented using the OMNeT++ simulation tool. OMNeT++ is an extensible, modular, component-based C++ simulation library and framework, primarily for building network simulators [24].