# Routing Attacks Detection in 6 LoWPAN-Based Internet of Things
###### Abstract
There are substantial additional kinds of IoT sensors and many forms of networks other than conventional networks. Consequently, using conventional IDSs in an IoT system is difficult because of their limited features, such as restricted source devices and network needs. In recent years, numerous incidents involving IoT (Internet of Things) devices, such as brute-force attacks, privilege escalation attacks, IoT ransomware, IoT botnets, and DNS threats. To counteract such threats, Intrusion Detection Systems (IDSs) have been developed as an additional layer of protection against abnormal activity. However, deploying a traditional IDS system directly onto IoT networks is not feasible due to the unique characteristics of IoT networks. IoT devices are typically resource-constrained, with limited power, computing, communication, and storage capabilities. Therefore, existing security techniques need to be simplified, optimized, and adapted to suit IoT networks. Additionally, IoT networks use different protocol stacks and standards, which require the development of corresponding security mechanisms [7]. There are various dangers associated with IoT devices, and protecting them requires identifying when they are being attacked. Intrusion detection is necessary for such situations. For instance, a hacker may infiltrate an IoT device in a hospital network and insert malware to gain access to the sensitive medical, personal, and financial information of patient's data. In another example, the Black Energy malware targets industrial control systems (ICSs). Hackers may use the fixed network on a flight to gain control of an airplane's network, or even use light bulbs as an entry point to a corporate network. Unfortunately, in such scenarios, these devices cannot determine whether they are under attack, and may process or discard the packets they receive without any knowledge of whether they are legitimate or malicious. Static networks are particularly vulnerable because there are only a few IP addresses to exploit. Since IoT devices are regularly targeted and can serve as a gateway to other devices on the network, proper intrusion detection is of the utmost importance. The hybrid Intrusion Detection System (IDS) is created to overcome the limitations of Single IDS (SIDS) and Aggregation IDS (AIDS) when detecting routing attacks. The goal of the hybrid IDS is to use the advantages of both techniques and address the limitations of SIDSs, while also leveraging the lower processing cost of AIDS. Since traditional IDSs are insufficient in detecting various attacks in IoT systems and consume a considerable amount of memory and processing resources, our approach employs AIDS to identify zero-day routing attacks and SIDS to recognize known attacks. By combining the strengths of both techniques, our approach aims to produce a more resilient IDS. To achieve higher accuracy, the boosting technique is utilized to combine multiple classifiers. SIDS is based on the popular C4.5 decision tree classifier, which employs nodes to form a directed tree structure. Conversely, AIDS is based on a one-class Support Vector Machine that employs known attacks on data to build profiles of normal behavior. The contributions of this paper are as follows:  
* The simulation of several attacks on the IoT to identify if packet drop along with energy consumption constraints are suitable features for identifying routing attacks on IoT;
* A novel intelligent IDS is used to identify IoT attacks with high detection accuracy and low false alarm rates;
* An experiment to show how several types of intrusion functionality and attack techniques affect power consumption;
* This paper proposes a dataset of routing attacks that contains normal IoT network traffic in conjunction with several kinds of attacks. The reliability of the routing dataset using well-known machine learning techniques is assessed;
* An investigation on IoT malware functionality and techniques, and how these RPLs can be used for successful intrusion detection.