# A Dense Neural Network Approach for Detecting Clone ID Attacks on the RPL Protocol of the IoT
## 1 Introduction
### Aiming and Research Contributions  
The RPL protocol has been the subject of several studies since its creation and implementation. Like any type of standard, IoT device manufacturers and application developers have adapted new technologies based on the premises of RPL, in which information security has not been a primary point in its design. Over time, many vulnerabilities have been reported, which have been fully or partially remediated, according to their level of risk. One of the most difficult threats to counter is the Clone ID Attack, as, according to [25], this type of threat is independent of the applications supported in WSNs, where stealthily malicious actors are able to impersonate multiple identities in the absence of default authorization mechanisms. With the rise of the information security landscape, corrective controls have been proven to be not entirely effective, as centralized and distributed methods are needed, including the use of cryptographic algorithms, hardware modifications, high-cost resources to evaluate sensor nodes positions, neighbourhood analysis and, above all, the ability to operate in restricted environments, such as IoT. On the other hand, the addition of physical or logical perimeter systems must allow for the in-depth filtering of the content of RPL messages, where the rules and detection policies may not be adequate, leaving a large gap in the writing of a signature and the craft of a new threat. This means that there are no intelligent or adaptive controls for most of these applications [26]. As mentioned in Section 1, one of the novel approaches that can detect a Clone ID pattern is the incorporation of AI techniques, which can better characterize the behaviour of an attack and present a faster detection, supported by performance measures that endorse the functionality of the algorithms used. The contribution of this paper highlights this importance, focusing on a robust solution and implementation as a possible framework for an IDS/IPS appliance. Although there have been works that presented AI as an alternative choice (specifically, ML or DL) to solve several vulnerabilities in RPL, their scope was limited to threats in areas such as routing, localization, data aggregation, and synchronization. Moreover, the proposals had procedures limited to shallow algorithms, with little capacity for the extraction and selection of important features. To date, it is unknown if there is any other work using DL to tackle the Clone ID Attack. The contributions of this article are listed below:  
1. One of the first detection frameworks for Clone ID Attack based on Artificial Intelligence algorithms is developed; the construction is based on the following premises: * The pre-processing of traffic samples obtained by simulations with real traffic from IoT and WSN sensors, which can filter, scale, and reduce the complexity of the samples; * The use of low-cost feature selection and extraction techniques, in order to ideally represent key evidence resulting from an attack and regular behaviours over a WSN.  
The presentation of a possible real deployment detection scenario, taking into account the on-premise capabilities and constraints of current IDS/IPS systems, as well as the implications of using an ML-based solution.  
The rest of this paper is organized as follows: Section 2 provides a review of the RPL protocol and a synopsis of identity cloning attacks. Section 3 describes the related work. In Section 4, the intended framework is detailed, as well as data gathering, pre-processing, and DNN training tasks. Section 5 presents the experimental results and discussions. Finally, Section 6 concludes this work.