# Intrusion Detection and Prevention in CoAP Wireless Sensor Networks Using Anomaly Detection
## 4 Experimental Evaluation
### Implementation and Automation of the Experiments  
The first step towards the implementation and automation of the experiments is the selection of an operating system to be employed in the constrained sensing devices, with the purpose of supporting the detection of attacks against the security of the network and devices. In addition, as our goal is to perform an overall experimental evaluation of the proposed mechanisms, it is necessary to select the platform to be employed for this purpose, as well as the tools to support the statistical data gatherer and the intrusion detection component in our architecture. The operating system employed for the purpose of supporting intrusion detection is Contiki [5], due to its stability, hardware compatibility and the quality of the documentation at hand. As for the platform, we employed IoT-LAB [6], a platform which facilitates the process of deployment  
Figure 2: Approach considered for the Learning Methodology. experiments, collecting and performing analysis on the results. With IoT-LAB, we are able to combine physical and simulation/emulation scenarios, and obtain real time data from any of the nodes in the network via Wireshark. IoT-LAB currently supports pressure, temperature, magnetometer, accelerometer, gyroscope and light sensors and, for the purpose of our experiments, we used M3 Open Nodes [28], due to the availability of network sniffers and power tracing tools using such devices. Regarding the intrusion detection component of our architecture, the ML application classifies nodes as either in the fully operational (normal) state or, on the other hand, as being compromised. Depending on the misbehavior detected for the node considered to be compromised, the node is labeled along the nomenclature discussed in Section 3.2. We developed an application to support the training phase of the IDS in Python 2, which also incorporates the GUI illustrated in Figure 3, developed in Tkinter. The library employed to support machine learning is Scikit-learn [29], and the plots were generated with matplotlib [30]. In our application, and by tuning the adequate parameters, we are able to choose to perform stratified splitting of the dataset into train/test parts with the desired proportion, and also perform pre-processing, feature extraction and classification. We have also implemented a functionality for performing a grid search for the best parameters of the classifier, according to the desired scoring goal. In Figure 4 we illustrate the methodology considered when building the experimental scenario employing the IoT-LAB platform. The steps illustrated in Figure 4 reflect the various phases of the process employed to bootstrap the devices used in our experiments, to run the experiments and finally to retrieve information from  
Figure 4: Methodology supporting the experimental measurements. Figure 3: User interface developed to support the training phase. the experimental measurements using the IoT-Lab platform. In Step 1 the local computer is connected to the IoT-Lab server in order to select the physical nodes to be employed in the experiments. In Step 2, the experiment is submitted to the platform, together with the specification of the firmware and a profile for the CoAP server and 6 LBR devices. As for the CoAP client nodes, only a profile is associated, since the OS image of the client nodes is flashed after the IPv6 address of the CoAP server is known. In Step 3, we replace the hard-coded IPv6 address on the client nodes by the IPv6 address of the CoAP server, compiling the source code of the client and uploading the new image. After this last phase, the IoT-Lab setup is ready to support our experimental measurements. In each experiment we employ a 6 LBR, a CoAP server and three CoAP clients, among which one of the clients is employed to perform the attacks. We run each experiment during a period of 30 min, and a total of four experiments are performed with different attack (anomaly) scenarios.