# A Specification-Based IDS for Detecting Attacks on RPL-Based Network Topology
## 1 Introduction
Once the information received, the monitoring node moves to the analyzing phase by using such data to form a network map, evaluate the rank consistency and check the legitimacy of the rank rules between any parent-child pair. This anomaly-based IDS also focuses on monitoring the deviation between normal and anomaly nodes behaviors. However, in case of topology attacks, malicious nodes perform similarly to normal nodes in terms of sending and receiving messages, hence, the difference in whether a node following the protocol rules cannot be effectively detected by the anomaly-based IDS. On the other hand, the specification-based IDS detects the attackers if they do not follow a specified behavior reference of the routing protocol. This approach is effective in detecting the topology attacks because it can point out directly when the adverse nodes break the protocol rules. So far, specification-based detection has been applied to many similar situations, including securing different sensor and ad hoc network protocols [10; 11]. In such environment, the routing protocols are usually profiled manually by experts through its theoretical specifications. There are also several RPL specification [4; 7], but none of them satisfied the purpose of detecting the RPL topology attacks. In detail, in [4], we proposed only a prototype of RPL specification, which is lack of verification and implementation. On the other hand, the profile of RPL in [7] is only for the purpose of conformance testing, which mainly looks at verifying the implementation of the protocol from its documentation. Such profile is not effective when applying for the detection purpose because unlike the conformance tester, the IDS will not have the self-view of the node behaviors; its view is instead reflected from other IDS agent's report. The differences in the views bring issues like synchronization, data loss, data falsifying and so on, which make the profile not feasible to follow. Moreover, that RPL profile does not reflect any crucial behavior that the attackers may employ to attack the network performance, for example, a node needs to propagate consistent ranks with what are reflected from its neighbors,a node needs to follow the rank rule in any case, or a node needs to not generate redundant control messages. Profiling technique also needs to be considered. Previous works mainly employed manually profiling techniques, which are based on the expert understanding of the protocol. This method is, however, lack of fast and accurate profile generations for a particular protocol, as well as difficult to verify. To overcome this problem, the authors in [12] propose a technique that based on Inductive Logic Programming (ILP) method to induce a hypothesis from individual observations and background knowledge. The authors collect examples of the protocol executions through extensive simulation traces and derive an abstract model of protocol behavior out of that. This solution has the advantage of fast profiling generation with the ability of validating the correctness of such specification. This paper is the continuation of our on-going research on IDS for detecting the internal threats in IP-connected wireless sensor network [2; 3; 4; 5], where we identified and evaluated prominent internal threats and proposed a general IDS framework to detect them. This work is the next concrete step to develop, implement, and verify a specification-based IDS to detect the topology attacks in RPL-based network. In detail, we first summarized the prominent topology attacks known to RPL from previous research [2; 3; 5; 6; 8]. We then profile the RPL operation based on a semi-auto specifying technique, which is inspired from [12] and involves the use of simulation trace files to generate an Extended Finite State Machines (EFSM--a Finite State Machine with statistic information about transitions and states) for RPL. Such profile will be transformed as a set of rules applied for checking monitoring data from the network nodes regarding relevant properties.