# Hybrid Deep Learning-Based Intrusion Detection System for RPL IoT Networks
## 2 Literature Review
### RPL Attacks  
In this section, we describe three different attacks against the RPL protocol that are used in this study. We also describe the relevant features that might help in identifying such an attack and could be used for the dataset. Figure 1: RPL Components and Terminology. _Flooding (DIS) Attack:_ In flooding attacks, the attacker nodes usually target the availability of the network by sending a large amount of traffic, which exhausts the resources of the neighboring nodes and makes them unavailable. It is a Denial of Service attack (DoS). In RPL, the malicious node may send a large number of DIS control messages to flood the neighboring nodes to solicit DIO messages. As a response, the nodes receiving DIS messages generate more traffic to the network by broadcasting DIO messages [15]. The important features that can be observed to identify such an attack are: the number of DIS messages received; the number of DIO messages sent by each node; the end-to-end delay; and the average packet delivery ratio. _Rank attacks:_ The node rank plays an important role in RPL. It is used to construct the optimal network topology and prevent the formation of loops in the network. Attacking the rank by deliberately changing its value can lead to two different types of known attacks: increased rank attacks and decreased rank attacks. The malicious node advertises a higher rank value in the increased rank attack than it is supposed to have. In this case, its new preferred parent might be its previous child in the prior sub-DODAG. This will form a routing loop between neighbor nodes. Although a loop avoidance mechanism is designed to fix such loops, it requires many DIOs to be exchanged between the nodes, resulting in exhausting node resources. In the decrease rank attack, the malicious node advertises a lower rank value, aiming to attract other nodes to connect to it. The rank attacks lead to the selection of non-optimized routes and may lead to poor network performance [3]. The important features that can be observed to identify such attacks are: the number of DIOs sent; the frequency of parent and RANK change; the end-to-end delay; and the average packet delivery ratio. _Wormhole attack:_ The wormhole attack requires at least two nodes to create a dedicated communication tunnel between them. They usually have an alternative network interface and use either wired or wireless links to make the out-of-band connection. Once the tunnel is made, one attacker can replay all the messages received from the normal path to the second attacker node using the dedicated link [16]. The attacker nodes might be far away from each other since they might use better communication coverage ranges or wire connections. In RPL, each attacker node will first replay the DIOs messages received from other nodes to the second attacker using their second interface. The receiving attacker node will process this DIO (on its second interface) and add the sender (attacker node) as its preferred parent. Now, the route is set up between the two nodes. All normal data traffic received by the first attacker on its first interface will be replayed on the second interface. Many consequences can result from the wormhole attack depending on the intention of carrying out such an attack. It can be used to disturb the normal operation of the routing by selecting non-optimal paths. It can also be used to eavesdrop on all traffic passing through the tunnel (confidentiality attack). To make it more effective, sometimes, this attack is combined with other attacks such as a decreased rank attack, which attracts more neighbors to connect to this malicious node. In this case, the aim is to route more traffic using a wormhole tunnel. The important features that can be extracted during this wormhole attack are: the number of DIOs sent by each node; the end-to-end delay; and the average packet delivery ratio.