# An Intrusion Detection System for RPL-Based IoT Networks
## 6 Conclusions  
In this work, we experimentally evaluated and compared the following RPL attacks: Hello flood attack, DIS attack, DAO insider attack, blackhole attack, and greyhole attack. Firstly, we implemented these attacks and then analysed the behaviour and results obtained from the simulated experiments. The performance metrics used were the CPU usage and the TX/RX rates. In addition to the evaluation of the attacks, a hybrid IDS was designed and implemented using Contiki-NG. After the implementation, the IDS was evaluated in  
Figure 12: Comparison between node types in terms of RAM and ROM usage. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline  & \multicolumn{3}{c}{**Hearbeat Enabled**} & \multicolumn{3}{c}{**Hearbeat Disabled**} \\ \hline \multirow{2}{*}{**ID**} & \multirow{2}{*}{**Radio ON (\%)**} & \multicolumn{1}{c}{**Transmission**} & \multirow{2}{*}{**Reception**} & \multirow{2}{*}{**CPU**} & \multirow{2}{*}{**Radio ON (\%)**} & \multirow{2}{*}{**Transmission**} & \multirow{2}{*}{**Reception**} & \multirow{2}{*}{**CPU**} \\  & & \multicolumn{1}{c}{**Tx (\%)**} & & & & & \\ \hline
1 & 99.75 & 0.08 & 0.13 & 1.22 & 99.75 & 0 & 0.02 & 0.61 \\ \hline
2 & 97.85 & 0.1 & 0.2 & 1.67 & 97.85 & 0.01 & 0.04 & 0.83 \\ \hline
3 & 98.62 & 0.02 & 0.22 & 0.89 & 98.62 & 0.01 & 0.05 & 0.78 \\ \hline
4 & 97.8 & 0.02 & 0.23 & 1.00 & 97.8 & 0.01 & 0.05 & 0.83 \\ \hline
5 & 95.48 & 0.02 & 0.22 & 0.94 & 98.48 & 0.01 & 0.05 & 0.78 \\ \hline
6 & 97.44 & 0.04 & 0.26 & 1.17 & 97.44 & 0.01 & 0.04 & 0.78 \\ \hline
7 & 98.25 & 0.01 & 0.1 & 0.83 & 98.25 & 0.01 & 0.04 & 0.72 \\ \hline
8 & 98.07 & 0.04 & 0.21 & 1.22 & 98.07 & 0.01 & 0.05 & 0.83 \\ \hline
9 & 99.07 & 0.01 & 0.08 & 0.72 & 99.07 & 0.01 & 0.02 & 0.67 \\ \hline Avg. & 98.37 & 0.04 & 0.18 & 1.07 & 98.93 & 0.01 & 0.04 & 0.76 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Evaluation of the heartbeat protocol with UDP. terms of the accuracy of the attack detection and its performance regarding CPU usage, TX/RX rate, and memory usage. To detect the aforementioned attacks, existing techniques from the available literature were used (i.e., threshold usage to detect flooding attacks, and signature matching to detect the version number attack). Moreover, new methods for detection were developed, such as the UDP-based heartbeat protocol for blackhole and greyhole attacks detection. A study on specific RPL attacks was provided during the experimental evaluation. The main conclusion to be taken from this evaluation is that the studied RPL attacks can have a big impact inside an RPL network by exhausting the nodes or by isolating them from the network. Therefore, it is mandatory to include security measures in order to mitigate potential attacks and reduce the damage caused by the attackers. In order to mitigate those RPL attacks, a new IDS design and implementation was proposed, and according to the obtained results, the proposed IDS was able to detect flooding attacks, blackhole attacks, greyhole attacks, and version number attacks with high accuracy and very quickly. Regarding performance, the developed solution was shown to be appropriate as the overhead caused by the IDS implementation was negligible in terms of CPU usage and TX/RX rates. On the other hand, as the devices under consideration had very limited RAM and ROM, the memory overhead caused by the IDS implementation was close to the maximum limit. Therefore, the IDS design is suitable for execution on resource-constrained devices, but the memory of these devices must be taken into account. Regarding the version number attack, the evaluation showed that the problem occurred after the attack was propagated through the network. At that moment, the network became unstable and loops were created. To mitigate this, a new blocking mechanism can be included in the IDS design to remove the attacker node from the network before it is too late.