# Hybrid Deep Learning-Based Intrusion Detection System for RPL IoT Networks
###### Abstract  
Internet of things (IoT) has become an emerging technology transforming everyday physical objects to be smarter by using underlying technologies such as sensor networks. The routing protocol for low-power and lossy networks (RPL) is considered one of the promising protocols designed for the IoT networks. However, due to the constrained nature of the IoT devices in terms of memory, processing power, and network capabilities, they are exposed to many security attacks. Unfortunately, the existing Intrusion Detection System (IDS) approaches using machine learning that have been proposed to detect and mitigate security attacks in internet networks are not suitable for analyzing IoT traffics. This paper proposed an IDS system using the hybridization of supervised and semi-supervised deep learning for network traffic classification for known and unknown abnormal behaviors in the IoT environment. In addition, we have developed a new IoT specialized dataset named IoTR-DS, using the RPL protocol. IoT-DS is used as a use case to classify three known security attacks (IDS, Rank, and Wormhole). The proposed Hybrid DL-Based IDS is evaluated and compared to some existing ones, and the results are promising. The evaluation results show an accuracy detection rate of 98% and 92% in f1-score for multi-class attacks when using pre-trained attacks (known traffic) and an average accuracy of 95% and 87% in f1-score when predicting un  
promising routing protocol because of its ability to provide efficient routing among resource-constrained IoT IP-based devices. RPL was standardized by IETF ROLL (Routing Over Low-Power Lossy Links) in 2012 [2]. However, the RPL protocol is vulnerable to a wide range of attacks that are difficult to detect and mitigate [3]. The attacks can target different network components in which some attacks are used to exhaust the network resources (energy, memory, and storage) to shorten the device's lifetime, which then shortens the network's lifetime. Other attacks target the RPL topology, aiming to disturb the normal data workflow. Moreover, some attacks might target data traffic confidentiality considered eavesdropping attacks [4]. Among the different security controls that are used to mitigate the security risks in IoT environments, Intrusion Detection Systems (IDS) are widely used techniques for detecting suspicious events. The main goal of the IDS is to monitor, analyze, and detect abnormal behaviors (attacks) in the network traffic [5]. There are three general types of IDS, which are signature-based, anomaly-based, and specification-based. For the signature-based approach, which is also known as rule-based, the system stores the signatures of the known attacks in a database and compares them to the network traffic pattern [6]. Whenever the pattern matches the existing attack signature, the system triggers an alert. Although this approach is considered very fast in detecting known attacks, it is not useful in identifying new attacks. In the anomaly-based detection, the system defines the network's legitimate activities and then compares them with anomalous activities (unknown attacks). The statistical methods and machine learning techniques are the most used in this type of IDS. However, many of the systems that apply in anomaly-based systems suffer from a higher rate of false-positives (regular traffic classified as malicious) if they are not designed and trained carefully. For the specification-based approaches, the expected legitimate behaviors of the network components such as the routing protocols and the nodes are defined such that any variation in this behavior is considered as an attack. Although this ensures lower false-positive rates, some security experts need to determine the elements' specifications, which is more time-consuming [6]. IDS systems have been studied and developed using machine learning (ML) techniques to detect anomaly network behaviors.