# An Intrusion Detection System for RPL-Based IoT Networks
## 5 Evaluation
### Attack Detection Accuracy
#### 5.1.1 Flooding Attacks Detection  
An analysis of the accuracy of the proposed IDS in detecting flooding attacks is provided in this subsection. In particular, the IDS design is executed during the Hello flood attack, DIS attack, and DAO insider attack to verify its detection accuracy. First, an evaluation is carried out to verify the detection accuracy on an attack-by-attack basis (i.e., run a simulation with only one attack at a time). Later on, a simulation is run with all flooding attacks at the same time. The topology used in order to test the proposed IDS against a Hello flood attack is shown in Figure 5. In this scenario, node 1 is the central IDS, node 5 is the attacker, node 9 is an IDS detector, and the rest of the nodes are benign (dummy nodes). As can be seen, the attacker node 5 is performing a Hello flood attack against the nodes in range. In this scenario, both the central IDS (ID 1) and the IDS detector (ID 9) are receiving the attack packets. Figure 6 illustrates the logs, which show the time when the attack started (i.e., at 02:01.055), the detector IDS and the central IDS detecting a DIO flood (at 02:04.266 and 02:04.834, respectively) that corresponds to a Hello flood attack, and the moment when the IDS detector sent the DIO alarm (at 02:04.305) to the central IDS and its arrival (at 02:04.540). The IP address fe80::212:7405:5.505 corresponds to node 5. In addition to this detection, after minute 3, the central IDS asks the IDS detector for information, and the latter again sends the DIO alarm corresponding to a Hello flood attack. After this, the IDS detector detects the attack again and sends an additional alert message that is received by the central IDS. Figure 5: Hello flood attack network topology under IDS detection. Node 1 is the central IDS. Node 5 is the Hello flood attacker. Node 9 is an IDS detector. The rest of the nodes are benign. The detection of the DIS attack occurs in a similar way to the one performed during the Hello flood attack simulation. Figure 7 represents the DIS attack detection by both the central IDS (ID 1) and the IDS detector (ID 9). The DIS attack starts at 02:01:055. After that, both the central IDS and the IDS detector detect the attack (at 02:02.517 and 02:02.292, respectively). As soon as the IDS detector detects the attack, an alarm is sent to the central IDS (at 02:02.331), which receives the alert at 02:02.589. As before, the IP address fe80::212:7405:5:505 corresponds to node 5, the DIS attacker. Moreover, after minute 3, the central IDS asks the IDS detector for information, and the detector loops over all the neighbours to detect a possible attack. In fact, it did detect an attack at 03:01.167 and sent an alarm to the central IDS, which received the alert at 03:01.523. In the case of the DAO insider attack, a different topology for the simulation was used. This topology is shown in Figure 8. As mentioned before, a DAO message is retransmitted through all the parents of the sender until the message reaches the root node. A DAO insider attack is always detected by the central IDS as the destination of the DAO message is the root. However, in order for the IDS detectors to detect such an attack, they must be the parent of the attacker as the message is sent through them. For this simulation, the parent of the attacker node is the IDS detector. More specifically, the IDS detector (node 9 with IP address fd00::212:7409:9:909) is the parent of the attacker node 12 (IP address fd00::212:740::cc:0c). Once the simulation started, our logs showed that the attack was being detected. The DAO insider attack starts at 02:00.915, and after 21 s, an alarm is raised by the IDS detector and the alert is sent to the central IDS. The attack is detected after 21 s because the threshold for DAO messages (\(T_{DAO}\)) is set to 20, and for this specific attack, the attacker sends a DAO message every one second.