# A Dense Neural Network Approach for Detecting Clone ID Attacks on the RPL Protocol of the IoT
## 4 Proposed Framework
### Data Collection  
To extract Clone ID attacks on RPL network conversations, a virtual environment was deployed using Cooja [46], a well-known WSN emulator, and t \begin{table}
\begin{tabular}{l l l l} \hline
**Authors** & **ML Algorithm** & **Attack** & **Data Set** \\ \hline [PERSON] et al. [20] & Deep Feed-Forward Network (DFFN) & Decreased rank & Custom WSN data \\  & & Hello flood & \\  & & Version number & \\ \hline [PERSON] et al. [42] & MLP & UDP DDoS/DOS & NSL-KDD \\ \hline [PERSON] et al. [45] & SAE and SVM & DoS, Probe, R2L, U2R & Custom TCP/UDP traffic \\ \hline \end{tabular}
\end{table} 
Table 4: Related work using ML models on RPL and DODAG attacks. Figure 5: Workflow of the proposed methodology. analyzer [47]. It is important to mention that the capabilities of Cooja allow for emulating traffic and working with real software for attack simulation. According to an exhaustive comparison with other IoT simulators, presented in [48], this simulator allows for the estimation of the effects of an attack, the consumption of hardware resources, and the support for different operating systems. The only disadvantage is the high consumption of resources in minimal environments. The scenario was configured on a 6 LowPAN network over RPL messages, involving o node built using a Zoleria Z1 device, 100 Z1-based dummy sensors spread across a radius of 10 and 200 m, and ten malicious sensors with Z1 embedded technology. Three types of topological structures were designed to resemble real traffic, with impersonated nodes capable of being dumped from network captures, to build the three final data sets. The first data set consisted of twenty nodes with two malicious sensors; the second one was comprised of fifty nodes with five malicious nodes; and, ultimately, the third data set contained one-hundred nodes, of which ten were malicious. Each topology had a root node or sink, which was assumed to be exposed to an external network. In Table 5, the topologies fashioned to mirror real Clone ID attacks are listed. The IoT virtual environment to exploit the Clone ID attack, carried out using the Cooja simulator, is depicted in Figure 6.  
The topology, node distribution across established radius distances, and configuration of each data set are illustrated in Figure 7a-c. \begin{table}
\begin{tabular}{l l l l l} \hline \hline
**Data Set Name** & **No. of Nodes** & **Malicious Nodes** & **Benign Nodes** & **Samples** \\ \hline _cloneid\_20n_ & 20 & 2 & 18 & 1,232,862 \\ _cloneid\_50n_ & 50 & 5 & 45 & 1,576,668 \\ _cloneid\_100n_ & 100 & 10 & 90 & 1,492,579 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Data set sizes and corresponding topologies. Figure 6: IoT virtual environment to simulate the Clone ID attack. As with any other raw network traffic examination, samples may contain many headers whose values are optional or null, thus representing a missing data problem. Figure 7: Sensors employed to simulate a Clone ID attack, with different topologies and node configurations. For this reason, instead of fulfilling a high-dimensional data representation by statistical means, incomplete headers were filtered and discarded. After replaying live network captures, a total of 1207 headers were identified as candidate features, but only 19 field headers were selected with full and complete information. Additionally, it should be noted that some features were listed as categorical values--_wpan.ack_request_, _wpan.pending_, _icmpv6.code_, _wpan.dst_addr_mode_, _and__dowpan.pattern_--due to their ordinal behaviour. Therefore, datatype casting was carried out to transform them into numerical types. To construct a tabular data set, each row was a sample. Columns represent features, according to the previously selected numerical field headers. The last column maps samples to one of two class labels, where 0 corresponds to a _Normal_ network conversation (i.e., packets sent from a legitimate node to another legitimate node) and 1 corresponds to a _cloned ID attack_.