# An Intrusion Detection System for RPL-Based IoT Networks
## 4 IDS Design
### Detection Methods
#### 4.3.2 IDS Detector  
IDS detectors are in charge of the detection of possible intrusions in a specific region of the network, after which they alert the central IDS. This type of node combines the concepts of signature-based, specification-based, and anomaly-based detection methods, as explained below. Figure 3 illustrates the detection method used by the IDS detector. _Specification-based detection_: Regarding the Hello flood attack, DIS attack, and DAO insider attack, the detection method required to recognise those is the same as that for the central IDS (Algorithm 1 represents the detection pseudocode). Hence, specification-based detection is used by specifying the required thresholds for this purpose: \(T_{DIS}\), \(T_{DIO}\), and \(T_{DAO}\). However, the case of the DAO Insider attack is slightly different. Recall that the objective of the DAO insider attack is to make the victims (i.e., parent nodes on the path to the root) consume more power. To do so, the attacker sends a DAO message to perform the attack, with the root node as the destination. As a result of this, intermediate IDS detector nodes will simply forward the packet since they are not the packet destinations (In a 6 LoWPAN network, an additional header is included in the packet when this needs to be forwarded [54]). Therefore, with the intention of detecting the DAO insider attack, every time an IDS detector forwards a packet, this will need to be deeply inspected for the IDSdetector to realise that the packet is a DAO message. Central IDS does not need to deeply inspect the packet as it already knows that the packet is a DAO message because the central IDS is the destination. That being said, as the central IDS is always the destination of a DAO message, one may think that IDS detector nodes are not required to detect this attack, because even if the central IDS is not in the range of the attacker, the packet will always reach the IDS. However, in a scenario where the IDS is capable of removing malicious nodes from the network, such a restriction will be better applied by an IDS detector node close to the network region where the attacker is located as the blocking rule will be applied faster. _Signature-based detection_: With respect to the version number attack, the detection algorithm used by the central IDS can also be applied here. Upon receiving a DIO message from a source node other than the root, and with a higher version number than the current one, the IDS detector will issue an alert as this is the typical behaviour of an attacker performing a version number attack. Algorithm 3 represents the pseudocode of the version number attack detection performed by the IDS detector. _Anomaly-based detection_: The IDS detector also incorporates the anomaly-based detection method to detect a rank decrease attack, which consists of issuing a message with a rank lower than the real one in order to advertise a \"fake\" better route. If it succeeds, neighbours receiving a lower rank than the one used in their best path will change the preferred parent, which is the attacker node. In order to detect such attacks, a technique based on a scheme proposed by [PERSON] et al. [55] to secure the parent node selection process in RPL is used. The main idea behind this scheme is based on the possibility for an attacker to falsely claim a malformed rank in order to legitimate the nodes and thus become the  
Figure 3: IDS detector functionality. parent of the victim nodes. With this in mind, an algorithm is executed in every node of the network to avoid malicious nodes and to choose the best parent.