# An Intrusion Detection System for RPL-Based IoT Networks
## 2 Background
### Basics of RPL  
RPL is a routing protocol proposed by IETF for low-power and lossy networks (LLNs). The protocol is based on IPv6, and the network devices are interconnected in a tree topology, which is named destination oriented directed acyclic graph (DODAG) [8]. An RPL network can be composed of one or more instances, where each instance has a dedicated DODAG. In addition, a DODAG is formed by one root node that operates as the main maintainer of the entire graph, and by the rest of the nodes that adapt their topology according to a set of exchanged messages among all the nodes inside the transmission and reception range. The purpose of the RPL tree topology is to allow the nodes in the network to find the best path based on a _rank_ metric. The rank is set by each node, depending on the distance to the root node, and by the link cost (i.e., the quality of the link) of the nodes in range. This metric allows nodes to provide information about their own position to the rest of the nodes in the network to enable the others to choose the best parent. As the distance from the root node increases and the link quality becomes poorer, the node rank will continue to increase, and vice versa. Hence, the RPL protocol provides ICMPv6 control messages, which are sent and received by the network nodes. The purpose of these messages is, for example, to receive information about the neighbours of a node (i.e., nodes in range) or to be able to select the parent by providing the best path to the root node. The relevant RPL control messages are the following [34]:  
* _DIO message_: The DODAG information object (DIO) message is broadcasted by the root node at the beginning in order to advertise a DODAG instance. The message contains information that allows the nodes in range to determine, for example, the RPL instance, the instance version, or the rank of the root, so that they can decide whether to join the network or not. Afterwards, DIO messages are sent among nodes to build and maintain the topology.
* _DIS message_: While waiting for a DIO message, which would allow a node to join a network, nodes periodically send DODAG information solicitation (DIS) messages to inform their neighbours of their presence and increase the possibility of joining a DODAG. Upon hearing a DIS message from a neighbour, the node will send a DIO message back to the sender so that it can join the DODAG with knowledge of the required information about the network.
* _DAO message_: If a node decides to join a DODAG, it will select the best parent based on the rank received by hearing DIO messages and the link cost, and it will later send back a destination advertisement object (DAO) message to register itself to the network. DAO messages are always sent to the root node in order to create the downward route from the root to the sender node. However, if the root is not in range, the sender node will send the message to its parent, and the latter will relay the DAO message to the root.  
In addition, there are two main mechanisms that allow an RPL instance to heal itself (self-healing mechanisms):  
* _Global repair mechanism_: This mechanism is triggered when the root node detects inconsistency in the network; it results in an increase in the version number of the DODAG instance. This new version is announced in the next DIO message sent to the neighbours and forces the whole DODAG to rebuild itself.  
* _Local repair mechanism_: In some scenarios, for example, when a node is turned off and so it is not in the network any more, a global repair is not necessary, and it would be too costly in terms of performance. In those cases, a local repair is the best option. It relies on using a different neighbour node for routing instead of the failing one by switching parents or by routing to a new node [35].