# Hybrid Deep Learning-Based Intrusion Detection System for RPL IoT Networks
###### Abstract
However, with the rapid increase in connected network devices and traffics that produce a large scale of data, identifying various types of attacks becomes more sophisticated and challenging by using the simple or shallow machine learning approaches [7]. Deep learning (DL) is the advanced branch of machine learning that has shown its success in classification and dimensionality reduction tasks [8; 9]. In deep learning, features can be learned from a large number of training samples and automatically reduce the network traffic complexity to find the correlations among them [10]. This makes it more powerful in detecting complex attack patterns and zero-day attacks. However, DL-based IDS have not been studied enough in the IoT network context and, more specifically, in RPL-based networks. Moreover, to accurately train and evaluate the ML-DL-based IDS, a relevant dataset is required. The majority of the existing methods use existing benchmark datasets such as KDD99 [11], NSL-KDD [12], and UNSW-NB15 [13]. However, these datasets are obsolete, or they have been created using computer system traffics that are not suitable for the IoT IDS system. On the other hand, the existing datasets that are designed for IoT IDS systems, such as the WSN-DS [14] dataset, do not mimic the reality in collecting the network traffics. They are based on sniffing or monitoring mechanisms that need to be distributed across the IoT network, which is difficult to apply in practice. Moreover, the Bot-IoT [8] dataset, which is meant for IoT networks, does not consider common types of ad hoc networks where the devices form a network using routing protocols to communicate between each other to route the data to a central location. In this paper, we propose a new dataset named IoTR-DS based on RPL (which is considered the de facto routing protocol for IoT networks). IoTR-DS is created by simulating three common attack (DIS, Rank, and Wormhole) traffics beside the normal traffics. Unlike the existing datasets, the data collection does not involve traffic sniffing or monitoring but utilizes the same data packets sent by the nodes to the root by embedding the necessary information on it. The idea is to shift the IDS control to the powerful node and, at the same time, not to use the network sniffing technique, which is not practical and costly. In addition, the paper proposes a hybrid DL-based IDS based on the hybridization of supervised Deep Artificial Neural Network (DANN) and semi-supervised Deep Autoencoder (DAE) models to classify attacks using the IoTR-DS dataset. The supervised DANN model is trained using labeled attacks, and it is used to identify known attacks. The semi-supervised DAE model is trained using normal traffic samples only and is used to predict the traffic that DANN was not trained for. The idea is to compare the average reconstruction error during the normal traffic-training phase with the predicted traffics. Another goal of the proposed approach is to validate the IoTR-DS dataset in terms of whether it contains enough features to efficiently classify different attacks. In summary, the contribution of this paper is twofold:  
* Develop a new specialized dataset named IoTR-DS ([[https://github.com/alsawafi/IoT-DL-IDS](https://github.com/alsawafi/IoT-DL-IDS)]([https://github.com/alsawafi/IoT-DL-IDS](https://github.com/alsawafi/IoT-DL-IDS)) (accessed on 20 October 2020)) by simulating three types of RPL attacks along with normal traffics and characterize attack features that will be used as the primary inputs to the IDS. * Propose a new DL-based IDS using the hybridization of supervised DANN and semi-supervised DAE and evaluate it on the IoTR-DS dataset. The remainder of this paper is organized as follows: Section 2 presents some background about RPL and attacks and reviews related works on machine-deep learning-based IDS and datasets. Section 3 offers the IoTR-DS dataset creation and RPL attacks modeling. The design details of the proposed hybrid DL-IDS using the IoTR-DS dataset is discussed in Section 4.