# An Intrusion Detection System for RPL-Based IoT Networks
## 4 IDS Design
### Blackhole and Grajhole Detection  
Recall that the proposed IDS uses a hybrid method to detect some of the attacks mentioned earlier (i.e., Hello flood attack, DIS attack, DAO insider attack, version number attack, and rank decrease attack). However, in order to detect the blackhole or greyhole attacks, the use of traditional detection methods (i.e., signature-based, specification-based, and anomaly-based) may not be sufficient. In the case of a signature-based detection strategy, there are difficulties in detecting the blackhole and greyhole attacks as such attacks do not send packets to the victims. Therefore, an IDS using a signature-based method will not be able to match a malicious signature with a depicted malicious packet because no such packets will be received. On the other hand, specification-based and anomaly-based detection methods, if properly configured, may be able to detect both the blackhole and greyhole attacks [56; 57]. Nevertheless, in the case of specification-based detection methods, the previous analysis of the network to specify the correct set of rules for the detection of such attacks will be difficult. In addition, any modification in the network topology or configuration will require a new analysis and new specifications, which will consume time and effort. The use of anomaly-based detection to detect blackhole and greyhole attacks has similar problems. In a network without too many changes in topology and data transmission patterns, an anomaly-based IDS is able to detect malicious behaviours as the network will suffer significant changes caused by the attack. In such circumstances, the anomaly-based detection method may work. However, in dynamic network scenarios and with frequent variations (e.g., in packet transmission rate, packet size, peak hours, etc. ), the anomaly-based IDS is unable to establish a normal behaviour for the network. In fact, the normal behaviour is for a network to have too many changes. Hence, a blackhole or greyhole attack might not be efficiently detectable. Due to the aforementioned problems regarding the use of specification-based and anomaly-based detection methods for blackhole and greyhole attacks, our IDS design also includes a _heartbeat_ technique whose objective is to detect such attacks. Note that a blackhole attack does not forward or send any packet. Thus, the lightweight heartbeat protocol (LHP) of [37] will notice this behaviour, and the attack can be detected. On the other hand, with respect to the greyhole attack, the LHP may not work. Depending on the implementation of the attack, the node in charge of performing the malicious action may decide to forward only control messages. In such a case, RPL control messages and ICMPv6 packets will be forwarded, and the IDS will not notice anything suspicious as the LHP will receive the corresponding replies from other nodes in the network. For this reason, in addition to the LHP, the IDS design includes an enhanced heartbeat protocol that is based on UDP messages [58]. The main idea is that instead of using ICMPv6 messages, the IDS and other nodes will exchange UDP messages. The main benefit of this option is that it can detect both blackhole and greyhole attacks by utilising a single protocol. However, there is a major drawback when using a UDP-based heartbeat: other nodes are required to handle these UDP packets and send the corresponding responses to the IDS. Therefore, every network node will require a modification in its code to be able to communicate using the UDP-based heartbeat protocol. All in all, in order to detect possible intrusions, the IDS has been based on a hybrid placement strategy that combines signature-based, specification-based, and anomaly-based detection methods to detect a large variety of attacks. Central IDS and IDS detectors use a different combination of detection methods due to their different characteristics. In addition, the IDS design includes the heartbeat protocol as a detection method to detect both blackhole and greyhole attacks.