# An Intrusion Detection System for RPL-Based IoT Networks
## 3 Related Work
### IDSes for IoT and Wireless Sensor Networks  
A lot of work has been carried out in order to comprehend the complex topic of IDSes in computer systems. For example, [PERSON] et al. [42] surveyed some of the key aspects to take into account when evaluating an IDS. In general, the authors showed the common practices applied in IDS evaluation, discussed the most controversial issues and challenges faced when using IDS technologies, and suggested a set of guidelines to follow when planning an IDS study. However, the work performed by the authors did not focus on IDSes for the IoT. With regard to the IoT, [PERSON] et al. [22] provided a survey on the relevant questions. Firstly, the authors depicted some of the most relevant terms that need to be understood when addressing this topic. Those terms are intrusion detection and the IoT. In the intrusion detection subsection, the authors illustrated the meaning of what an IDS is and described the most important characteristics to comprehend the multiple types of IDSes in general. Later on, in the IoT subsection, an explanation was given of the IoT concept, the standards followed in the IoT industry, and the possibilities offered by the IoT paradigm. Secondly, once the key concepts had been depicted, the authors showed part of the relevant work performed on surveying intrusion detection methods for technologies similar to the IoT. [PERSON] and [PERSON] [43] presented a survey on intrusion detection for mobile ad hoc networks (MANETs) by describing some of the architectures used for IDSes in MANETs. The authors concluded that the majority of the reviewed IDSes were distributed due to the characteristics of MANETs. In line with the MANET topic, [PERSON] and [PERSON] in [44] provided a survey of the most relevant intrusion detection techniques for MANETs, focusing on the technology layout and detection algorithms. The survey classified the detection techniques into nine different categories: statistical-based, heuristic-based, rule-based, state-based, signature-based, reputation-based, routing information-based, cross-layer-based, and graph theory-based. [PERSON] et al. in [45] reviewed recent work on IDSes for wireless sensor networks (WSNs) and introduced the following IDS approaches: anomaly detection, specification-based detection, and misuse detection. The authors found that although the IDS topic for WSN was going in the right direction, some core areas, such as the architecture or accuracy vs. resource usage, should be studied more in depth. [PERSON] et al. [46] introduced the topic by reporting multiple threats that could affect the security triad (confidentiality, integrity, and availability) of cloud computing. Moreover, the authors reviewed and compared IDSes used in cloud computing by classifying them according to the network placement and the detection method, and by discussing the pros and cons of each IDS scheme. As discussed above, some works have focused on the design and development of new IDSes for the IoT paradigm. [PERSON] et al. [47] proposed SVELTE, an IDS specifically developed for the IoT and implemented in ContikiOS. The main objective of this IDS was to detect network layer and routing attacks occurring in wireless LLNs. In order to detect such attacks, SVELTE was designed to comprise three main modules. The first module is the 6 LoWPAN Mapper, which collects information about the network to obtain an accurate picture of the entire network and its components. The second module is based on the intrusion detection, whose main focus is to analyse the previously mapped data to detect possible malicious intrusions. Finally, the third module acts as a firewall. Distributed among all the nodes in the network, this firewall prevents external attackers from tampering with the members of the RPL network. The authors concluded that usingSVELTE is feasible in the context of RPL networks as the results showed good performance in terms of false positives and false negatives. However, when using SVELTE, the energy overhead increased by 30%.