## 2 Background and Literature Review
### IDS-Based Mitigation Methods  
Over time IDSes have been considered by researchers as security measures for keeping IoT networks secured [19]. However, traditional network detection algorithms have different requirements than those based on IoT. Below, we present the latest IDS solutions for IoT.  
Strainer-based intrusion detection of blackhole in 6 LoWPAN for the Internet of Things (SIEWE) was proposed by [PERSON] and [PERSON] [20] to detect blackhole attacks in RPL networks. Blackhole attackers attract nodes by advertising a greater routing metric to neighbouring nodes so it is selected as the preferred parent. SIEWE uses this fact and adds the nodes IDs in a suspicious list. Amart devices that have suspicious nodes in their vicinity then analyze the behaviour of these nodes and inform BR about their findings. Thus, SIEWE includes only those nodes that have suspected nodes in their vicinity rather than requiring each node in the network to process and check suspicious nodes. Evaluation results on a Cooja simulator indicated that SIEWE increased PDR of the network. A drawback of this approach is that only RSSI is utilised as parent selection metric. Attackers could send with the same signal power in order to bypass the detection mechanism.  
A sink-based intrusion detection system (SBIDS) was presented in [21] for detecting rank attacks in RPL networks. The authors used a rule-based approach to compare node's current rank with the node's parent rank as well as the minimum rank of their siblings. If a node advertised a greater rank than its parent, it was considered malicious. Evaluation of the scheme showed that SBIDS achieved good detection performance of rank attacks.  
[PERSON] et al. [22] studied the different RPL attacks using simulations and tried to identify multiple intrusions for varied network size by using an IDS. Rank attack, selective forwarding, wormhole, and denial of service (DoS) attack were identified by the algorithms discussed in their work. A Cooja simulator with ContikiOS and ETX as an objective function was used for simulating scenarios of multiple attacks. Evaluation results showed that as the number of attackers increases, network performance was reduced. Therefore, a machine learning approach would be more suitable to identify various RPL routing attacks.  
Another remarkable work in the field is the SVELTE IDS [23]. This is a signature- and anomaly-based IDS, aiming to protect smart devices from routing attacks based on RPL. Some of the considered attacks included altering information, sinkhole, and selective forwarding. The authors developed and evaluated SVELTE in ContikiOS. Results indicated that SVELTE had a high true positive rate but also some false alarms during simulations. However, SVELTE showed high traffic overhead due to the reconstruction of the network initiated by the router.  
All in all, existing IDS-based mitigation methods might detect attackers successfully with some limitations. First, suggested solutions generate too much traffic overhead in the network. Second, using a single metric to detect an attacker may lead to the wrong results. Last but not least, most of the studies detected one or more simple routing attacks. For those reasons, a novel solution that can detect a combination of attacks using multiple metrics and keeping low traffic overhead is needed.