# A Dense Neural Network Approach for Detecting Clone ID Attacks on the RPL Protocol of the IoT
## 2 The RPL Protocol
### Detecting a Clone ID Attack  
To conduct a security evaluation of emerging technologies, such as IoT and WSNs infrastructures, the Security-in-Depth paradigm introduces the idea of minimizing any risk by maximizing the effectiveness of various security layers [33]. Within this context, security layers are the combination of physical and logical control measures that contribute to the reinforcement of abilities to prevent, detect, delay, or respond to any security disruption attempt [34]. With this, IDS, IPS, SIEM, and firewall appliances are common perimeter defensive systems, merged and placed at various network layers and operating in accordance with anomaly- and behavioural-based signatures. Once a malicious pattern is matched and flagged, the intruder may be banned or eradicated from attempting new incursions. Table 2 summarizes basic logging information gathering and detection capabilities of IoT perimeter security solutions. Corrective controls have been proposed to achieve a certain level of prevention and mitigation towards clone node attacks over IoT and WSN protocols. In [35], the review concluded that detection and prevention techniques can fall in two main categories-- centralized and distributed--for static and mobile WSNs, with different taxonomies depending on the security control algorithms and computational memory costs. It is important to highlight that, while the algorithms proposed can partially or experimentally ease some vulnerabilities, there are no ML, DL, RF, or statistical implementations to compare with. More importantly, the adjustments are not specifically oriented to RPL, thus creating a gap in the study of more intelligent solutions. Table 3 describes the proposed categories and taxonomies in the corrective controls for the mitigation of Clone ID Attacks. It is worth mentioning that the reported complexity varies exponentially, depending on the adaptations, experiments, specifications, and tests performed. This directly affects the memory cost data, as it is a measure that indicates the complexity of the number of operations that the solution must perform to observe the dynamics of each node, in order to detect a suspicious movement. Nevertheless, it is a fact that RPL, as part of many IoT and WSN routing protocols, might have already written detection signatures for its ordinary adversarial patterns. In [32], preliminary advances reported that identity and counterfeiting attacks can be lessened by extending IDS anomaly-based signatures on specific network segments, where physical nodes establish a first authentication on the DODAG tree. In this stage, geographical information can be determined and suspicious nodes can be banned. Conversely, in [36], the authors claimed that typical IDS, IPS, firewalls, and similar defensive systems \begin{table}
\begin{tabular}{l l} \hline \hline
**Logging Information Gathering Capabilities** & **Detection Capabilities** \\ \hline -Timestamp (e.g., date and time) & -Application layer reconnaissance and attacks \\ -Connection or session ID & -**Network layer reconnaissance and attacks**: \\ -Event or alert type & _Sinkhole attack_\({}^{\ddagger}\) ; \\ -Rating (e.g., priority, severity, impact, confidence) & _Neighbour attack_; \\ -**Network, transport, and application layer IoT protocols:** & _DIS attack_\({}^{\ddagger}\) and \\ _CORPL_\({}^{\ddagger}\); _CARP_\({}^{\ddagger}\); _GLoWPAN_\({}^{\ddagger}\) and _RPL_\({}^{\ddagger}\) & _Local repair attack_\({}^{\ddagger}\) \\ -Source and destination IP addresses & -Unexpected application services \\ -Source and destination TCP or UDP ports, or ICMP types and codes & \\ -Number of bytes transmitted over the connection & \\ -Decoded payload data, such as application requests and responses & \\ -State-related information (e.g., authenticated username) & \\ \hline \hline \end{tabular} \({}^{\dagger}\) IoT network protocols; \({}^{\ddagger}\) already recognized RPL-oriented attacks.  
\end{table} 
Table 2: Common logging information gathering and detection capabilities of perimeter security solutions.