# An Intrusion Detection System for RPL-Based IoT Networks
## 4 IDS Design
### Detection Methods
#### 4.3.1 Central IDS  
Signature-based and specification-based methods are combined into a hybrid approach for the central IDS design in order to detect the following attacks: Hello flood, IDS attack, DAO insider, and version number (Blackhole and greyhole attacks can also be detected from the central IDS; this is explained in Section 4.4). Figure 2 illustrates the detection method used by the central IDS. _Specification-based detection_: Hello flood attack, DIS attack, and DAO insider attack have similar behaviour. All of them continuously send specific packets to a target in order to cause an unexpected reception of packets and drain the battery of the victim. As a result of this similar characteristic, the central IDS can use the same strategy to detect them. \begin{table}
\begin{tabular}{c c} \hline \hline
**Symbol** & **Meaning** \\ \hline \(P\) & Packet received \\ \hline \(DIO\_counter\) & DIO messages counter \\ \hline \(DIS\_counter\) & DIS messages counter \\ \hline \(DAO\_counter\) & DAO messages counter \\ \hline \(T_{DIO}\) & Threshold for DIO messages \\ \hline \(T_{DIS}\) & Threshold for DIS messages \\ \hline \(T_{DAO}\) & Threshold for DAO messages \\ \hline \(T_{i}\) & Threshold calculated at node \(i\) \\ \hline \(RankSum\) & Total sum of all ranks at node \(i\) \\ \hline \(MaxRank\) & The maximum rank value at node \(i\) \\ \hline \(LastReceivedRank\) & The last received rank at node \(i\) \\ \hline \(K\) & Predefined constant for balancing the threshold value \\ \hline \(N\) & The number of nodes in the network \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Symbols used in Algorithms 1–5. In this case, specification-based detection is used. According to the normal behaviour of the network, the root node, which also acts as the central IDS, does not receive a large number of DIS, DIO, and DAO packets per minute. Hence, by analysing the network, appropriate thresholds \(T_{DIS}\), \(T_{DIO}\), and \(T_{DAO}\) can be specified to detect a high rate of DIS, DIO, or DAO messages if the threshold is exceeded. Algorithm 1 represents the pseudocode for Hello flood attack, DIS attack, and DAO insider attack detection. As shown, upon receiving a packet, the central IDS stores a counter, depending on the type of packet. If the threshold is exceeded, an alert is raised. _Signature-based detection_: Version number attack is a substantially different attack than those described above. Therefore, it requires a different strategy in order to be detected. Briefly explained, an attacker launching the version number attack issues a higher DODAG version number to the rest of the nodes in order to cause disruption in the network. If the IDS is capable of identifying this malformed packet, the attack will be detected as soon as the packet is inspected. In this scenario, a signature-based detection method is required in order to detect the attack. Thus, by taking into account that only the root node issues a higher version of the DODAG version number, if the central IDS (which acts as the root node) receives a DIO message (control message containing the DODAG information) with a version number that is higher than the current one, the IDS will know that an attack is taking place and will raise the corresponding alert. Algorithm 2 represents the detection algorithm for the version number attack. Figure 2: Central IDS detection diagram. ```
input:\(P\) - Packet received input:\(From\) - IP of the sender of the packet input:\(T_{DIO}\), \(T_{DIS}\), \(T_{DAO}\) - Predefined thresholds /* DIO messages counter */ \(DIO\_counter=0\); /* DIS messages counter */ \(DIS\_counter=0\); /* DAO messages counter */ \(DAO\_counter=0\); ifisDIOMessage(\(P\))then ++DIO_counter; elseifisDIMSessage(\(P\))then ++DIS_counter; elseifisDAOMessage(\(P\))then ++DAO_counter; else  printf(\"INFO: Not a control message.