# A Dense Neural Network Approach for Detecting Clone ID Attacks on the RPL Protocol of the IoT
## 2 The RPL Protocol
### Clone ID Attack on the RPL Protocol  
In the process of sensing RPL-based connections, the DIS and DIO control messages are liable to be manipulated or created to commit identity counterfeiting--namely, the Clone ID attack--in which malicious actors learn about the configuration of DODAG trees and modify the information required to add a malicious node. This attack is possible because the RPL standard version is not intended to implement security and self-healing mechanisms by default. In fact, the IEFT strongly recommends data confidentiality and integrity configurations using pre-shared key authentication. These characteristics can increase the reliability of the resources, but its implementation has a severe impact, in terms of limiting the nodes mobility and network performance. It has also been demonstrated that an attacker inside the network can easily bypass security controls, due to the complexity of self-configuration and organization between nodes, making key management and peering a major complication. On this basis, nodes can join freely without enforcing any authorization or authentication policy, opening a great opportunity to replicate multiple nodes in different locations [29]. In Figure 4a,b, the steps to conduct a Clone ID attack on a RPL default environment are pictured: 1. A malicious actor senses a RPL-based network and targets it, then the DODAG configuration is read and a malicious node \(Z\) learns from sibling identities and impersonate a selected one, \(E\). In this stage, \(Z\) remains a sibling node with no competition with the targeted node; 2. Forged DIS control messages containing the cloned identity of the sibling node, \(E\), are sent by the malicious node, \(Z\), until access is granted to the network; 3. Therefore, when the malicious node, \(Z\), is accepted as a member of the graph, all the other nodes in the network send a DIO control message to reconstruct the DODAG topology and communication with the malicious node, \(Z\), begins in a transparent way. It is important to mention that the legitimate node, \(E\), may send another DIS message in order to restore communication with the network, resulting in a continuous competition between the malicious node, \(Z\), and the legitimate node \(E\), in order to gain trustworthiness among the graph members, in such a way that the winner will be the one who can maintain DIS messages for a longer span of time. As described by [30], this is possible due to two main factors: 1. The IEFT states that the RPL protocol uses by default a mode called _Unsecured_, where the basic messages DIS, DIO, DAO and DAO-ACK can be easily modified, without any integrity nor authenticity check. This is a great advantage for the attacker to impersonate a node within the network. 2. RPL allows any node to join the DODAG tree at any time, by means of DIS and DIO messages to incorporate itself and re-arrange the DODAG tree, as mentioned before. With this, an illegitimate node will take advantage of the Trickle Timer mechanism of the protocol, which periodically sends DIO messages to check the stability of the DODAG tree and thus, generate persistence within the DODAG tree. \begin{table}
\begin{tabular}{l l} \hline \hline
**Code Field ID** & **Description** \\ \hline
0x00 & DODAG Information Solicitation (DIS) \\
0x01 & DODAG Information Object (DIO) \\
0x02 & Destination Advertisement Object (DAO) \\
0x03 & Destination Advertisement Object Acknowledgment (DAO-ACK) \\
0x80 & Secure DODAG Information Solicitation \\
0x81 & Secure DODAG Information Object \\
0x82 & Secure Destination Advertisement Object \\
0x83 & Secure Destination Advertisement Object Acknowledgment \\
0x8A & Consistency Check \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Codes for RPL control message types. Internally, RPL sensing algorithms are not aware of node identities, nor are security access control lists, mechanisms, and verification schedules mandatory to affiliate to a DODAG tree.