# An Intrusion Detection System for RPL-Based IoT Networks
## 5 Evaluation
### IDS Performance  
Once the accuracy of the proposed IDS design on the detection of RPL attacks has been evaluated, its performance needs to be analysed as well. First of all, a comparison of the resources consumed by the central IDS, the IDS detector, a benign (dummy) node, and a root node was performed. The results of the obtained metrics can be seen in Table 2. Note that in order to obtain the CPU usage, TX rate, and RX rate metrics for the node types Dummy Node and Dummy Node Heartbeat UDP, an average of 12 nodes for the different simulations was used to obtain the final value. On the other hand, the value obtained for the rest of the node types was extracted from only one simulation as the results are the same when using the same topology. This is the case because in all the performed simulations, there was more than one dummy node and only one node of other node types. In Table 2, it can be seen that the Dummy Node and Root Node are the ones that used less resources as compared with the rest. This is not unexpected as these nodes only contain the required code for joining and maintaining an RPL network. Although these nodes use less resources than the rest, it can be noticed that the ROM and RAM values are very high. Therefore, it can be confirmed that the memory available for these devices is very limited. Regarding the nodes using more resources, they can be divided into two groups: the ones using more CPU, TX, and RX, and the ones that use more memory. As shown in the table, node types Central IDS Lightweight Heartbeat and Central IDS Heartbeat UDP use 1.94% of the CPU and have high TX and RX rates as compared with the original nodes. Central IDS node types should be compared with the Root Node node type as the Central IDS code is an extension of the Root Node. Therefore, it is confirmed that implementing the IDS solution adds an expected overhead. The overhead in terms of CPU, TX, and RX is slightly high, but not too much. On the other hand, in terms of ROM and RAM, the overhead is more significant. Finally, the IDS Detector node type is the one consuming more ROM as it requires a lot of code in order to perform as expected, but the rest of the values are acceptable and do not differ too much if compared with the Dummy Node type. Figure 12 summarises the comparison between different node types in terms of RAM and ROM usage. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Node Type** & **CPU** & **TX** & **RX** & **ROM** & **RAM** \\ \hline Dummy Node & 1.22\% & 0.01\% & 0.04\% & 87.93\% & 70.68\% \\ \hline Dummy N. Heartbeat UDP & 1.41\% & 0.02\% & 0.10\% & 89.96\% & 73.54\% \\ \hline Root Node & 1.11\% & 0.01\% & 0.03\% & 87.95\% & 70.70\% \\ \hline Central IDS & 1.39\% & 0.01\% & 0.03\% & 94.11\% & 79.20\% \\ \hline Central IDS L. Heartbeat & 1.94\% & 0.05\% & 0.11\% & 96.59\% & 79.82\% \\ \hline Central IDS Heartbeat UDP & 1.94\% & 0.04\% & 0.10\% & 98.21\% & 82.60\% \\ \hline IDS Detector & 1.56\% & 0.01\% & 0.06\% & 99.83\% & 75.16\% \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Node type metrics table. TX: transmission. RX:reception. Figure 11: Version number attack simulation. DIO message information. The next experiment focused on checking how the proposed heartbeat implementation affects network performance. The results were obtained after executing 30 min of the simulation; no differentiation was made between the time before the attack and the time under the DIO flood attack. To execute this experiment, flooders, selectors, and the IDS detector were replaced by dummies but placed in the same positions. Upon analysis of the results obtained in Table 3, we can observe that the impact is negligible. Firstly, the Radio On rate shows almost equal results. Secondly, the TX rate shows a slight change, which on average is just a difference of 0.03%. Notice how the root obtained a TX rate that was two times or four times more as compared to the dummies. The root node has to send _N-1_ requests, where \(N\) is the number of nodes that the network has.