# Routing Attacks Detection in 6 LoWPAN-Based Internet of Things
###### Abstract  
The Internet of Things (IoT) has become increasingly popular, and opened new possibilities for applications in various domains. However, the IoT also poses security challenges due to the limited resources of the devices and its dynamic network topology. Routing attacks on 6 LoWPAN-based IoT devices can be particularly challenging to detect because of its unique characteristics of the network. In recent years, several techniques have been proposed for detecting routing attacks, including anomaly detection. These techniques leverage different features of network traffic to identify and classify routing attacks. This paper focuses on routing attacks that target the Routing Protocol for Low-Power and Lossy Networks (RPL), which are widely used in 6 LoWPAN-based IoT systems. The attacks discussed in this paper can be categorized as either inherited from Wireless Sensor Networks or exploiting vulnerabilities unique to RPL (known as RPL-specific attacks). The paper describes various RPL attacks, including Flood Attacks, Data-DoS/DDoS Attacks, Wormhole Attacks, RPL Rank Attacks, Blackhole Attacks, Version Attacks, and Sinkhole Attacks. In this paper, a novel Hybrid Intrusion Detection System (HIDS) that combines a decision tree classifier and a one-class Support Vector Machine classifier is proposed to detect routing attacks. The HIDS draws on the strengths of both a Signature Intrusion Detection System (SIDS) and an Anomaly-based Intrusion Detection System (AIDS) to identify routing attacks with a high degree of accuracy and a low false alarm rate. The routing dataset, which features genuine IoT network traffic and various kinds of routing attacks, was used to test the proposed HIDS. According to the findings, the hybrid IDS proposed in this study outperforms SIDS and AIDS approaches, with higher detection rates and lower false positive rates. a 20  
Detecting attacks on the routing system of 6 LoWPAN-based IoT devices can be difficult due to several factors such as the limited resources of the devices, the constantly changing network topology, and the different ways in which an attack can occur. To address this issue, various techniques such as anomaly detection, intrusion detection, and machine learning-based methods have been developed in recent years. These methods use different features of the network traffic, such as routing metrics, packet header information, and traffic patterns, to identify and classify routing attacks. This article specifically focuses on RPL protocol, which is a target of routing attacks. The attacks on RPL can be divided into two categories: those inherited from WSNs and those that exploit vulnerabilities unique to RPL (known as RPL-specific attacks). These attacks mainly target layer 3 of the OSI model, and this article describes several RPL attacks including Flood Attacks, Data-DoS/DDoS Attacks, Wormhole Attacks, RPL Rank Attacks, Blackhole Attacks, Version Attacks, and Sinkhole Attacks [3]. The Intrusion Detection System (IDS) technology has initially been designed for conventional networks, and thus the existing methods of developing IDSs for IoT are unable to identify various types of intrusions for the following reasons. First, the recent IDSs protect against known as security threats, so they are beaten by the new types of malware used by cybercriminals as they can escape conventional systems [4; 5]. For example, a high quantity of Distributed Denial-of-Service (DDoS) attacks uses methods that trick source IP addresses to conceal attacks; therefore, they become unnoticeable by conventional IDSs. Second, IoT systems become extremely diverse in terms of devices, platforms, communication techniques, and protocols [6]. Thirdly, one more significant matter is the feature related to IoT network design. In conventional networks, the devices are entirely connected to specific device sensors that are responsible for sending packets to the endpoints. In contrast, the IoT system connects with various devices and actuators to achieve various checking and management tasks.