# A Specification-Based IDS for Detecting Attacks on RPL-Based Network Topology
## 1 Introduction  
Routing Protocol for Low power and Lossy network (RPL) is a protocol developed specifically for the 6 LoWPAN network, in order to bring the concept of Internet of Things (IoT) to the real life. RPL has many advantages such as the energy efficiency, optimal routing and minimal overhead, which makes it outperform other previous routing protocol [1]. As a result, the protocol is also proposed to apply in a lot of other situations such as Smart Grid and so on. For the overall operation of the protocol as well as the basic concepts of routing messages like DIO, DIS, and the trickle algorithm, readers can refer to [1; 2; 3; 4; 5; 6; 7; 8] for more detail. Internal threats on RPL-based network is a challenge due to the weak physical protections of the nodes, no centralized administration, low capability node that make strong cryptography not applicable, and lack of node co-operation. Internal threats can be categorized into two types: the performance attacks and the topology attacks [2]. The performance attacks focus on manipulating the network performance directly, for instance, making an adverse source dropping all the packets (black hole attack), dropping some of the packets (selective forwarding attack), or adding delay to the forwarding. On the other hand, topology attacks involve node operation to disrupt the optimal network topology, for example, creating loops, attracting traffic, or generating heavy overhead. Internalattackers often combine these two types of attacks to boost the effect of their attacks, for example, using topology attack to gain the traffic towards a malicious source and then manipulating those traffic through this source's performance. The main focus of this paper is the topology attack. Several RPL topology attacks such as Sinkhole, Rank, Local Repair, Neighbor, and DIS attacks have been reported to have significant bad impact on network performance [3; 5; 8]. Cryptographic solutions cannot prevent the internal threats once the attackers tamper the nodes and obtain the secure keys [2]. Moreover, some security modes of RPL are considered impractical without the use of public key cryptography, which is believed to be too expensive in common [9]. [PERSON] _et al._[9] also provided several countermeasures for a number of RPL attacks, however, such countermeasures mostly change the operations to overcome the attack impacts rather than specifying and eliminating the malicious sources, which can create long term issues for the network performance. Therefore, it is necessary to have an Intrusion Detection System (IDS) to monitor and detect the compromised nodes. In RPL-based network, the two most applicable IDS approaches for detecting the internal threats are the anomaly-based and specification-based. Anomaly-based IDS identifies a node as intrusion when this node has too much deviation in behaviors compare to the normal baselines. The most important aspect for the accurateness of an anomaly-based IDS is to define the normal or legitimate behaviors and the threshold for the deviations, in which any node acts more than this threshold will be identified as the malicious. Anomaly-based IDS is used widely in securing routing protocols in wireless sensor and wireless ad hoc network from the internal threats. However, the work follows this approach in securing RPL is only in the initial step. [PERSON] _et al._[6] proposed SVELTE, the first anomaly-based IDS for securing the RPL protocol with two phases, including collecting and analyzing the IDS data. In the collecting phase, the Destination Oriented Directed Acyclic Graph (DODAG) root (also the monitoring node of all nodes in the network) will request its network members to send information about itself and its neighbors. The information that each member has to send includes the RPL Instance ID, the DODAG ID, the DODAG Version Number, all neighbors and their corresponding ranks, the parent ID, the node's rank and a timestamp.