# An Intrusion Detection System for RPL-Based IoT Networks
## 2 Background
### Attacks in RPL-Based Networks  
LLNs have some specific characteristics that must be taken into account by protocol standards defined to work in such environments. In addition to these characteristics, security must play a big role in order to resolve or mitigate some concerns that may arise when using resource-constrained devices. Below, we briefly present the most common attacks in RPL networks. _Hello flood attack:_ This refers to the launch of a flooding attack on the victim by using Hello messages (i.e., the initial message sent from a node to the neighbours in order to join a network). Two variants of the Hello flood attack can be distinguished. Some authors consider that the initial message in RPL is the DIS control message because it is the first message to be sent from a node that wants to join the network [36]. On the other hand, there are others that consider the Hello message to be the message that a node sends to another to finally join the network (i.e., a DIO message) [37]. In this paper, the Hello flood attack is considered as a DIO message flood sent by the attacker to the victim, and the Hello flood attack based on DIS messages is called a DIS attack (see below). By constantly sending DIO messages to the victims, the attacker creates a huge activity in the network and causes the victims to process the DIO message, thus consuming even more CPU time. The network congestion and the increased CPU consumption reduce battery life significantly. This attack can be considered as a DoS attack as the main focus is to drain the battery of the nodes in the network so that they become unavailable. _DIS attack_ The idea behind the DIS attack is very similar to that of the Hello flood attack in terms of methodology. However, the message to be sent is a DIS control message instead of a DIO message. Depending on the characteristics of the attacker, the DIS attack may be more or less effective than the Hello flood attack. For example, by sending a unicast DIS message to the victim, it is forced to reply with a new DIO message to the attacker, adding more overhead to the communication and causing the attacker node to consume more CPU as it is receiving as many DIO messages as the DIS messages sent [27]. In this case, if the attacker controls a node that must be online as much time as possible, the DIS attack will not be the best option as the malicious node will need to handle more messages and the battery will not last as expected. On the other hand, if the attacker has compromised a node and the objective is to disturb the network, increase the CPU usage of the neighbours, or drain the battery of the compromised node, the DIS attack is the best option because it also drains the battery of the compromised node. _DAO insider attack:_ Note that DAO messages are sent by a node that wants to be registered in a network to the root node, when switching parents or when the trickle timer is triggered. If correctly transmitted, this will create a downward and upward route to enable the communication between the root and the DAO sender node. During the DAO insider attack, DAO messages are continuously sent by a child node (i.e., the attacker) to the parent. This forces the parent to handle and retransmit the DAO message to the next parent until it reaches the root node. By handling and retransmitting DAO messages, the intermediate nodes will consume more CPU, and thus the battery will be drained faster [26]. In addition, in the RPL implementation of ContikiOS, a DAO-ACK message is sent back to the DAO message sender node in order to provide information about the DAO message reception by the root node. This attack is more specific than the Hello flood attack as it can choose the target more specifically (i.e., parents, in this case). Moreover, the DAO insider attack allows the attacker to harm or disturb nodes that are not in the transmission and reception range.