# A Specification-Based IDS for Detecting Attacks on RPL-Based Network Topology
## 4 Evaluation Results and Discussion
### Simulation Results and Discussion
#### 4.3.1 Detection Efficiency
The mechanisms to detect attacks in the second group are as follows. In local repair attack, after initiating the local repair mechanism, the node sends the poison messages to the neighborhood in which its rank is reset to be infinite and it needs to resend the DIS to obtain the routing information around. The local repair will be reported after several times initiated according to Module 1. On the other hand, the local repair also invokes the high instability value in Module 5, so it will also be reported by this module. In the DIS attack, the attacker needs to send DIS messages to force the neighbor to change the DIO trickle time, or to send the unicast DIO back. In any case, it will increase the DIS statistic in Module 1 and will be reported by the DIS. Tables 6 and 7 below present the TPR and FPR detection of this group after 8 and 12 min. As can be seen from the figures, after 8 min, the IDS may not collect enough information in any of the cases so it cannot detect the Local repair attack and DIS attack, which results in a high FN and low TPR. On the other hand, after 12 min, the IDS collect all the needed information, so the FN and TPR are ideal. However, the Local repair and DIS attack is given long time enough to manipulate the neighbors around the malicious node to create the instability in the topology. Such instability is presented through the high rate of FP and FPR which make the IDS become less accurate because of detecting normal nodes as attackers. Therefore, there is a tradeoff between the TPR and FPR in detecting threats in this group. \begin{table}
\begin{tabular}{l c c c c c c} \hline  & **FP** & **TP** & **FN** & **TN** & **TPR (\%)** & **FPR (\%)** \\ \hline LA & 51 & 76 & 12 & 7605 & 86.36 & 0.67 \\ DIS & 232 & 83 & 5 & 7424 & 94.32 & 3.03 \\ \hline \end{tabular}
\end{table} 
Table 6: TPR and FPR of Rank attack, sinkhole attack and Neighbor attack after 8 min. \begin{table}
\begin{tabular}{l c c c c c c} \hline  & **FP** & **TP** & **FN** & **TN** & **TPR (\%)** & **FPR (\%)** \\ \hline RA & 402 & 88 & 0 & 7254 & 100 & 5.25 \\ SA & 251 & 88 & 0 & 7405 & 100 & 3.28 \\ NA & 202 & 88 & 0 & 7454 & 100 & 2.64 \\ \hline \end{tabular}
\end{table} 
Table 5: TPR and FPR of Rank attack, sinkhole attack and Neighbor attack after 10 min. Unlike the first group of attacks, where the attackers are always detected first before any FP happens, in the second group, a benign node can be detected as malicious before the attackers are revealed. Therefore, using a blacklist or other mechanism to eliminate the detected nodes in this case may not be appropriate. An alternative solution is to adjust the frequency threshold to adapt to the frequency of the corresponding Local repair/DIS attack in specific scenario through learning from simulation. A good chosen threshold will optimize the detection rate and accurateness of the IDS. It is worth to mention that in general, the specification-based IDS has the ability to detect the new attacks because it focuses on checking the legitimacy of the protocol operation rather than on any specific attack behaviors. Similarly, our proposed IDS aims at monitoring the optimal network topology and its stability as a whole, which is broader than just verifying illegitimate behaviors created by some specific internal attacks. Hence, it will also have the ability to detect other topology attacks which are not mentioned in this paper, if those attacks breaking the optimal topology or create network instability.