# A Dense Neural Network Approach for Detecting Clone ID Attacks on the RPL Protocol of the IoT
## 5 Results and Discussion
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**No. of Model** & **Configuration** & **Accuracy** & **F1-Score** & **Total Time** & **Complexity \({}^{*}\)** \\ \hline
**1** & **SAE + DNN** & **99.65** & **99.65** & **2:56:20** & \(\Omega(2^{h})\) \\
2 & AE + DNN & 99.08 & 99.08 & 4:05:47 & \(\Omega(2^{h})\) \\
3 & No Autoencoder + DNN & 99.04 & 99.04 & 3:16:44 & \(\Omega(2^{h})\) \\ \hline \hline \end{tabular} \({}^{*}\) Based on the proposition described in [67], where it was explained that the hidden units of deep networks can grow exponentially, where \(h\) is the number of hidden units and \(\Omega\) specifies that the algorithm will at least take a certain amount of time to produce and operate, without exceeding a certain period of time.  
\end{table} 
Table 11: Performance metrics for the _cloneid_50n_ node data set. capable of finding a latent representation for classification inputs, compared with non-encoded data, and improved the classification results. The time spans monitored on the training steps changed significantly when applying SAE + DNN on _cloneid_50n_ and _cloneid_100n_, proving that Autoencoders suit characterization tasks to further SL inputs. As stated in Section 1, this is the first work to build a framework to detect Clone ID attacks in the RPL protocol, aiming to enable comprehensive data exploration, a feature extraction procedure, and a training configuration, with the proper representation of more than one million samples from an IoT environment. Even though there exists little literature to deliver a deeper comparison with other state-of-the-art approaches, the survey described in Section 3, Table 4, was considered, in order to compare the proposed framework with related works that classified/detected security threats in IoT environments using ML techniques. Table 13 summarizes the works selected for comparison. As observed in Table 13, the SAE + DNN classifier used to build the proposed framework performed better, on average, than the DFFN, MLP, A-DNN, and SAE + SVM. Even though [PERSON] [20] employed additional features related to rates and packet counts, their results showed that only 19 features were sufficient to train a DFFN, which can hardly represent actual IoT network traffic; therefore, a Clone ID Attack may be undetectable. [PERSON] et al. [43] and [PERSON] et al. [45] achieved similar results compared to this proposal; however, the features were extracted from a pre-built data set which was limited to TCP/UDP traffic, mostly from non-IoT messages. As a future work, deploying the SAE+DNN as a whole framework on a IDS/IPS module is suggested; see the mechanism illustrated in Figure 12. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Author** & **Algorithm** & **Accuracy** \\ \hline [PERSON] [20] & Deep Feed Forward Network (DFFN) & 94.9\% \\ \hline [PERSON] et al. [42] & Multi-level perceptron (MLP) & 99.4\% \\ \hline [PERSON] et al. [43] & Autoencoder A-DNN (DNN) & 99.3\% \\ \hline [PERSON] et al. [45] & SAE + SVM & 99.4\% \\ \hline This proposal (_cloneid_20n_ data set) & SAE + DNN & 96.72\% \\ \hline
**This proposal (_cloneid_50n_ data set)** & **SAE + DNN** & **99.65\%** \\ \hline This proposal (_cloneid_100n_ data set) & SAE + DNN & 99.25\% \\ \hline \hline \end{tabular}
\end{table} 
Table 13: Comparison with well-known works that presented ML approaches to classify security threats in IoT environments. Figure 12: Proposed module integration for an IDS/IPS using the proposed framework. As reported in [68], the integration of a real-time AI perimeter security for IoT threat detection must contain the following workflow: 1. A physical or virtual network interface must be listening for traffic coming from a WSN, where specific RPL protocol messages must be filtered and sent to feed a detection agent; 2. The detection agent is responsible for analysing, training, and predicting malicious traffic observations from filtered RPL data packages.