# An Intrusion Detection System for RPL-Based IoT Networks
## 5 Evaluation
### Attack Detection Accuracy
#### 5.1.2 Version Number Attack Detection  
As explained in Section 4.3, the version number attack can be detected by both the central IDS and the IDS detectors, and it consists of verifying that the version number advertised by the nodes is not higher than the expected value (i.e., the current version of the DODAG issued by the root). The detection in this case relies on the proximity of the IDS node to the attacker. If the IDS detector or the central IDS is not in range of the attacker, they will not receive the malformed version number from the malicious node, and therefore the detection will not be accurate. In order to evaluate this behaviour and the effectiveness of the IDS against a version number attack, the simulation used the topology shown in Figure 10. During the simulation, the log of the attacker showed that it launched the attack at around minute 2. After this, any DIO message sent from the attacker would have had to contain a higher version number to disrupt the network. Indeed, at minute 02:48.080,  
Figure 8: Network topology of DAO insider attack detection. Node 1 is the central IDS. Node 9 is an IDS detector. Node 12 is the DAO insider attacker. The rest of the nodes are dummy nodes. Figure 9: Full flooding attack detection, simulation topology. Node 1 is the central IDS. Nodes 7 and 9 are the IDS detectors. Node 2 is the DIS attacker. Node 10 is the Hello flood attacker. Node 11 is the DAO insider attacker. The rest of the nodes are dummy nodes. node 12 (the attacker with IP: fe80::212:740c:cc0c) sent a DIO message in multicast to the nodes in range, indicating a version number of 241 instead of 240, which is the expected value (this is shown in Figure 11). Notice the information given under the ICMPv6 section; the message was a DIO message, and the advertised version was 241. At minute 02:48.108, the IDS detector (ID 9) reported an alert, indicating that node 12 was performing a version number attack. After this, the IDS detector sent an alert to the central IDS, and the latter received the alert at minute 02:48.237. As demonstrated earlier, the attack had been identified and the attacker had been spotted. However, some minutes later, the network was completely disrupted due to the version number attack. First of all, the topology in terms of parent nodes and child nodes was changing constantly. The log files show the parents of the network at minute 2, just before the attack. On the other hand, the parents of the network were at minute 4 after the attack. It has been observed that the parents are completely different. More precisely, the IDS detector node 9 (IP: fd00::212:7409:9:909) has node 8 (IP: fd00::212:7408:8:808) as a parent, node 8 has node 12 (IP: fd00::212:740c:cc0c) as a parent, and node 12 has node 9 as a parent. Therefore, a loop was created during the version number attack. After all of this, the IDS detector continued to issue alarms, but the log showed a different behaviour. As reflected, the IDS detector (ID 9) sent multiple DAO alarms to the central IDS. These alerts are generated due to the high number of times that a node changes the parent as a result of the version number attack. Every time a node changes its parent, a DAO message is issued. Hence, the IDS detects this as an attack. In addition to this, at minute 04:01.119, the IDS detector sent an alert about a new version number attack generated by node 8. In theory, this is wrong as the only attacker node is node 12. However, as the version number was propagated throughout the network, the rest of the nodes also advertised a wrong version number and acted as attackers. Another remarkable issue is that the alerts sent by the IDS detector to the central IDS were not received after minute 4. This was caused by the loop created in the network, where the IDS detector was no longer able to reach the central ID. In conclusion, the developed IDS works properly in the detection of version number attacks. However, after some time, the network becomes unstable, and the IDS starts sending incorrect alerts about the attack.