# A Specification-Based IDS for Detecting Attacks on RPL-Based Network Topology
## 3 A specification-Based IDS for RPL to Detect the Topology Attacks
### Design and Implementation of the Specification-Based IDS for RPL-Based Network  
#### 3.2.1 Placement of IDS Agents  
IDS agents are placed into the network through the three common methods, the host-based, network-based or the hybrid. The host-based IDS implements the detection module in every node of the network. Each node will act as a monitoring node to monitor the operation of all of its neighbors. This method creates heavy overhead and requires a lot of memory and calculation resources from the node. On the other hand, the network-based IDS implement the detection module at the sink. The necessary information for detection decision will be asked, collected from all the nodes in the network to send to the sink. This method also creates extra communication overhead, and does not guarantee that the sink will have all the information it needs, for instance, in the case when partial of the network is compromised, information from such part will not be able for the sink anymore.  
The monitoring architecture employed in this paper is the hybrid or the clustering architecture, which we found to have multiple advantages to compare with the other approaches. An illustration for this architecture is given in Figure 3 below. In this approach, the network is divided into clusters, each has similar size in terms of the number of nodes. In each cluster, there will be one cluster head, which has direct communication to all the other nodes in this cluster. Each cluster head is placed in a way that it can cover the whole network, and allow every node in the network to find the cluster head to register for the monitoring purposes. The number of nodes in each cluster is depending on the network density in this area. More detail about the cluster-based IDS design and algorithms to select the cluster head positions can be found in [14]. In this design, we will place the IDS agent in each cluster head. In detail, they will record relevant information of its cluster members either through overhearing the communication or the members report themselves upon requested. Such recorded data will be checked by the built-in IDS algorithms also integrated in the cluster head to detect malicious  
Figure 3: The cluster head IDS architecture.  
behaviors. There is always a trade-off on choosing which algorithms to apply, for example, strong algorithms may detect the threats better, however, they will consume more resource and require more data storage, which shorten the lifetime of the cluster head. In this paper, the built-in IDS algorithms (the details are in Section 3.2.3) are obtained from the RPL profile in Section 3.1, which only require simple threshold-comparison on collected data, so they are light-weight and will not affect significantly the operation of the cluster heads. Moreover, as being assigned the data collection and decision making roles, cluster head can be usually provided more resource like battery power and memory to deal with such additional IDS work. This architecture can reduce the communication overhead significantly to compare with the host-based method, while providing more robust decision than the network-based method due to full and quick access to the detection information it needs.