# A Dense Neural Network Approach for Detecting Clone ID Attacks on the RPL Protocol of the IoT
## 1 Introduction
In addition, in [12], it was mentioned that perimeter defensive systems must update their detection controls towards major routing attacks, such as sinkhole, blackhole, selective forwarding, sybil and, specifically, identity cloning. A summary of cyber-attack types directed at IoT protocols, emphasizing those aimed at RPL and LLNs, is depicted in Figure 2.  
Detection/prevention mechanisms work through observations of network traffic, by means of IDS, IPS, firewall, and Security Information and Event Management (SIEM) systems. The aforementioned are physical or logic implementations working on a network, host, or hybrid environments and, for instance, are configured with rules, policies, and/or behavioral- and anomaly-based signatures [13]. Indeed, monitoring network flows for malicious signature matching, rules/policy disruption, and flagging abnormal patterns can lead to time and resource consumption, an increase in high false/positive rates, limited customization, and constant database updating, making this last factor a significant setback, as intruders are constantly crafting novel and more sophisticated artifacts [14]. Although the efforts to mitigate the previously mentioned flaws have been addressed by a comprehensive number of secure protocols [15], the proposed mechanisms are still not entirely suitable for IoT resource-constrained ecosystems with novel and unconventional attack surfaces, affecting the integrity of routing algorithms and the trustworthiness of RPL node identity. In that sense, [PERSON] et al. [16] mentioned that, due to the misuse of the Directed Acyclic Graph (DAG)--the core engine for RPL topology organization--attackers can easily bypass voting schemes by counterfeiting the identities of legitimate IoT physical nodes. This type of identity impersonation, better known as the Clone ID attack, is challenging to overcome, considering that RPL algorithms are bound to multiple metrics to determine each node level and ranking within a network, opening the possibility of a worst-case scenario: when the root node, as it is known by the Destination-Oriented Directed Acyclic Graph (DODAG) is compromised. As a result, any data sent through a cloned root node will be directly available to an attacker and might be susceptible to alteration, leaking, spoofing, and ex-filtration, while the cloned node and siblings can remain unreachable, levering transmission inconsistencies over the entire network. ID Cloning attacks have been cited in early work [17; 18]; however, the remediation and mitigation methods have only been partially disclosed and have been limited to node ranking optimization, secure  
Figure 2: Number of cyber-attack types directed at IoT protocols, emphasizing those aimed at RPL and LLNs. node election mechanisms, and malicious node elimination through blacklisting additions to IDS/IPS rules. Consequently, more intelligent and adaptable schemes are being developed to expand the detection capabilities of classical security defense systems. In that sense, the incorporation of Artificial Intelligence (AI), Machine Learning (ML), Deep Learning (DL), and Reinforcement Learning (RL) sensors has become imperative to deal with large amounts of samples, maximize feature engineering, learn from latent abnormal patterns, reduce the time for disclosing unknown vulnerabilities, and reinforce classification outcomes [19]. Despite this, AI-enhanced and semi-enhanced frameworks are more oriented towards easing flooding attacks [19; 20], wormhole attacks [21], machine-driven hello-flood attacks [22], Received Signal Strength Indicator (RSSI) flooding attacks [23], and DDoS attacks [24], leaving Cloning ID attacks as a virtually unexplored area of research. In this work, we present a novel protection framework based on unsupervised ML pre-processing techniques, along with a Dense Neural Network (DNN) approach, to effectively detect counterfeiting attacks on RPL-based network conversations.