# An Intrusion Detection System for RPL-Based IoT Networks
## 1 Introduction
In such environments, denial-of-service (DoS) and routing attacks are two of the common security threats to cope with [22; 23]. DoS attacks take advantage of the resource constraint characteristics of the IoT devices by draining the battery or exhausting the resources of the device. In RPL-based networks, examples of DoS attacks are: _Hello flood attack_, _DIS attack_, and _DAO insider attack_[24; 25; 26]. On the other hand, routing attacks focus on distorting the routing information in order to cause a negative impact on the network. Examples of these attacks are _version number attack_, _blackhole attack_, _greyhole attack_, _wormhole attack_, and _rank decrease attack_[24; 27; 28; 29]. To detect the aforementioned attacks, IDSes are being studied and tested on RPL-based networks. However, as there is a wide variety of attacks, this still remains an open research problem. For these reasons, our work proposes a hybrid intrusion detection approach to detect multiple and diverse attacks on RPL-based IoT. Our hybrid approach refers to the combination of multiple strategies and methodologies to provide a general-purpose solution. The contributions of this work are as follows. (i) We experimentally evaluate and compare the following RPL attacks: Hello flood attack, DIS attack, DAO insider attack, version number attack, blackhole attack, and greyhole attack. This evaluation consists in the implementation of the aforementioned attacks and the experimentation with their behaviour and operation. To compare and analyse these attacks, the following metrics were used: CPU consumption, transmission rate, and reception rate. (ii) We design a hybrid IDS to detect the previously mentioned attacks by using existing techniques and implementing new ones. Detection methods are based on thresholds, on a matching signature strategy, and on heartbeat messages. Thresholds are used for DIS/DAO/Hello attack detection, a signature matching algorithm is used for version number attacks, whereas the blackhole attack is detected using a lightweight heartbeat protocol. In addition, a UDP-based heartbeat protocol for the detection of greyhole attacks is developed. (iii) We implement the proposed IDS using Contiki-NG and evaluate it with the Cooja tool in terms of its accuracy in attack detection and its performance regarding CPU consumption, transmission and reception rates, and memory consumption. The rest of the paper is organised as follows. Section 2 presents the background information on basic RPL concepts. Section 3 introduces the existing studies on RPL attacks and on IDSes for the IoT. Moreover, specific improvements for IDSes are explained. Section 4 describes the proposed IDS design by focusing on the following four categories: placement strategy, detection method, security threats, and validation strategy. In addition, we specify the communication protocol for the different components of the hybrid IDS. Section 5 presents an evaluation of the IDS implementation as well as an analysis of the obtained results, for both the IDS design and each of the implemented RPL attacks. Finally, Section 6 concludes the paper and describes possible future research directions.