# A Dense Neural Network Approach for Detecting Clone ID Attacks on the RPL Protocol of the IoT
## 6 Conclusions  
With the extensive use of IoT technology in critical infrastructures, it is crucial to address an in-depth security approach, where a detective layer must be put in place. In this paper, we presented one of the first frameworks that employs ML to tackle a critical and stealthy threat; namely, the Clone ID Attack on the RPL protocol. Two solutions can minimize the impact of a Clone ID attack: Corrective and device-based perimeter defensive replication attacks. Centralized or distributed corrective controls in WSNs make use of hardware changes, software directives, the use of base stations to monitor node changes and authorizations, and cryptographic configurations; however, the cost of design and implementation is quite expensive, considering the need for stability in minimal environments such as IoT. Furthermore, the scalability of such systems is almost null, as stealthy attacks can become more sophisticated, making previous corrections obsolete. Perimeter defense systems (IDS/IPS) can generate a high false positive rate, as they require behavioural signatures to make a similarity match, which is a high-cost technique and faces a race over time in generating new signatures to address sophisticated threats such as the Clone ID Attack. Therefore, it is imperative to have intelligent mechanisms that can adapt the knowledge of new samples from different behavioral characteristics and detect with different levels of performance any abnormal pattern. To construct the framework, an IoT network emulator was employed to simulate counterfeiting attacks with three different topologies: Twenty sensors with two malicious nodes, fifty sensors with five malicious nodes, and one hundred sensors with ten malicious nodes. After capturing and labeling the network traffic, a thorough data exploration was conducted, in order to transform, label, and encode values to a proper numerical representation. Then, two types of Autoencoders (SAE and AE) were proposed as feature selectors and extractors, in order to feed a Dense Neural Network (DNN). Although there are no existing works that apply ML techniquesto detect, classify or cluster Clone ID Attacks, the SAE+DDN architecture proved that, by comparing with other ML and DL methods, the performance metrics can a can achieve an accuracy of 99.65%. As future work, the affordable deployment of the AI-based module, on IPD/IPS perimeter security systems with a detection agent, can be integrated with filtering capabilities to work in conjunction with a compiled classification model. Further exploration of other less widely researched RPL attacks, such as Sinkhole, Blackhole, or Selective Forwarding, will be added, in order to test the proposed framework and compare and analyze whether it is capable of detecting a wider range of stealthy menaces. Besides, future research can be conducted in other standards and broadly used IoT protocols in the application layer, such as MQTT and CoAP.  
All authors contributed equally to this work. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
The authors thank the National Science and Technology Council of Mexico (CONACyT) and the Instituto Politecnico Nacional for the financial support for this research.  
The authors declare no conflict of interest.