# Hybrid Deep Learning-Based Intrusion Detection System for RPL IoT Networks
## 2 Literature Review
### Related Works  
Several IDS systems based on deep learning have been proposed, aiming to secure IoT systems. In [17], the authors introduce a DL-based IDS that uses the spider monkey optimization (SMO) algorithm to extract the most relevant features from the dataset and a stacked-deep polynomial network (SDPN) to classify the data as normal or abnormal. The model is evaluated using the NSL-KDD dataset and shows a high detection rate for different attack categories (DoS, U2R, R2L, and probe). The authors in [18] implemented a DL-based IDS for the IoT at the fog level rather than at a centralized cloud. They demonstrate that distributed attack detection at the fog level is scalable, and DL models outperform shallow ML models when used to detect attacks in the NSL-KDD dataset. Similarly, at the fog level, the authors in [19] proposed an IDS using a deep multi-layered recurrent neural network. The system is composed of a cascaded filtering stage where each filter is tuned to different hyperparameters for enhancing the detection of specific attack types. The model is evaluated using the NSL-KDD dataset to detect particular types of attacks. A cloud-based distributed deep learning framework is proposed by [20] to identify and mitigate Botnet, DDoS, and phishing attacks. The framework consists of two components that work cooperatively. These two components are the Long-Short-Term Memory (LSTM) network model at the back-end for detecting Botnet attacks. A Distributed Convolutional Neural Network (DCNN) model hosted in the IoT devices is used to detect DDoS and phishing attacks. In [21], the authors propose using a Deep Auto-Encoder (DAE) and Deep Feedforward Neural Network (DFFNN) to detect anomaly behaviors in Internet Industrial Control Systems (IICSs). The (DAE) algorithm is used to learn normal network behaviors and tweak the optimal parameters (i.e., weights and biases), which then give the DFFNN a better tuning of the parameters and classify normal and abnormal network behaviors. In more related works that use ML-based IDS in detecting attacks to the RPL, the author in [22] introduces an IDS to detect wormhole attacks in the RPL using three approaches based on ML, namely, the K-means-based approach, a decision tree (DT), and a hybrid approach that combines both methods. The K-mean algorithm is used to cluster routers into groups of safe zones from which a router can communicate with other nodes in the same zone. If the router tries to add new neighbors outside the safe zone, this is considered a wormhole attack. The DT is used to learn the safe distance between any two neighboring routers, where any attempt to communicate more than this distance will consider victims of wormhole attacks. The hybrid approach is used to enhance accuracy by filtering out some of the false-positives. This approach is only limited to one type of attack: the wormhole attack; it also uses additional control messages to send the mapping requests to other nodes. The router nodes' locations are required as input data to the IDS, which is considered impractical in more real implementation. In [23], the author proposed a hybrid IDS framework based on specification-based and anomaly intrusion detection models for detecting selective-forwarding and sinkhole attacks in an RPL-based network. The specification-based intrusion detection uses the agents located in the router nodes to monitor the behavior and send the results to the root. The anomaly-based intrusion detection works as a global detection approach. It is located in the root, and it uses an unsupervised optimum-path forest algorithm to analyze incoming data and detect anomalies. The hybrid method can achieve a reasonable true-positive and false-positive rate for detecting both attacks. This approach considers separating the network nodes into router and leaf nodes. The local IDS agents are only located on the router nodes, and they do not generate data. However, this is not the case in the usual IoT RPL-based network, where the node generates and routes the data simultaneously.