# An Intrusion Detection System for RPL-Based IoT Networks
## 1 Introduction  
The Internet of Things (IoT) could be defined as a concept that extends the connectivity of standard connected devices (e.g., workstations, laptops, and tablets) to the integration of physical objects into a global network by connecting all of them to the Internet [1]. In general, the main purpose of an IoT device is to process, collect, and analyse data generated in the real world in order to provide certain specific services to an individual, to a company, or to a field of study. For example, a body sensor could be used to provide live data for a medical study, CCTV cameras to monitor an area for security purposes, or a meteorological station to supply information on the current and expected weather. At the same time, the industrial IoT (IIoT) marries physical production and operations with smart digital technology, machine learning, and big data analytics [2]. IIoT is currently an active area of research that encompasses industrial applications, including smart manufacturing, robotics, and software-defined production processes [3]. The IIoT industry is rapidly growing year by year, both economically and in the number of devices used. According to the Statista report, the global market for IIoT was sized at over USD 260 billion in 2021 and is estimated to offer an economic impact of more than USD 1 trillion a year by 2028 [4]. Thus, it is becoming more important as new services and features appear. The demand for such devices increases every year, whichtranslates to the generation of terabytes of new information every second. The increase in the number of IoT devices can be accompanied by numerous benefits for states, companies, and individuals. Nevertheless, as the demand grows, attackers are also becoming more interested, and as a result, security incidents are on the rise [5; 6; 7]. In order to ensure the efficient functioning and operation of IoT networks, in 2012, the Internet Engineering Task Force (IETF) proposed a routing protocol standard for IPv6 over Low-power Wireless Personal Area Network (6 LoWPAN), which is named IPv6 Routing Protocol for Low-power and Lossy Networks (RPL) [8]. Moreover, the IETF and academia consider RPL as a potential routing protocol for the industrial low-power and lossy networks of field devices [9]. RPL is expected to improve the productivity and safety of industrial plants while simultaneously providing more timely information for efficient plant operations [10]. Since the standardisation of the RPL, there has been an increase in research activity focused on relevant attacks and countermeasures. More specifically, the published attacks on the RPL-based IoT exploit the power limitations, the wireless connectivity, and the lossy network environment in 6 LoWPAN in which the devices operate. Traditionally, one of the popular methods of securing Internet-connected systems is to set up appropriate security mechanisms, such as intrusion detection systems (IDS), to be able to detect attacks that target systems and networks [11; 12]. Some more recent solutions rely on deep learning techniques for IoT data analysis [13], cloud-based security mechanisms [14], cross-layer intrusion detection [15], reinforcement learning (RL) [16], and machine learning (ML)-based attack detection [17]. For the purpose of performing real or simulated experiments on RPL-based networks, ContikiOS [18] is the operating system (OS) used in the majority of the published literature. ContikiOS focuses on resource-constrained and low-power wireless IoT devices, and it provides a built-in network simulator called Cooja [19]. Recently, as a fork of the original ContikiOS, a new version called Contiki-NG [20] offers a more efficient routing protocol, RPL-Lite, as well as more continuity on the Contiki project. The increasing interest in IoT devices has made them more appealing to attackers than before. Hence, new security issues must be countered to ensure the correct functioning of the IoT environment [21].