# A Dense Neural Network Approach for Detecting Clone ID Attacks on the RPL Protocol of the IoT
## 4 Proposed Framework
### Supervised Classification  
The growing popularity of AI-based solutions to identify and classify malicious behaviors in different IoT networks and protocols has led to a vast range of schemes supporting supervised classification algorithms. To build a custom AI solution to detect a Clone ID Attack, the IoT surface and the previously pre-processed features must be in accordance with the natural capabilities of a chosen algorithm. In [59], counterfeiting attacks were cataloged as Network Service Surface Threats, encompassing Network Layer defenses and Effective IoT Security Controls, with dynamical and temporal features. With this preamble, the scattered and noisy form of Clone ID attack network captures may be out of the spectrum of well-known shallow algorithms, including Decision Trees (DT) [60], Support Vector Machines (SVM) [61], Naive Bayes (NB) [62], K-Nearest Neighbours (KNN) [63],  
Figure 9: Autoencoder and SAE configurations.  
and Association Rules (AR) [64]. In Table 8, some flaws detected in classic algorithms towards IoT attack and threat recognition are presented.  
Nonetheless, DL algorithms [65] have an advantage over shallow algorithms when dealing with more complex data representations of IoT network flows, by thoroughly inspecting the features in various hidden layers. To deeply contextualize the Clone ID Attack, a Dense Neural Network (DNN) architecture [66] was modeled to strengthen feature propagation and maximize the recognition of network conversations with impersonated nodes.  
In a DNN, each neuron receives a weighted sum of the outputs of the neurons connected to them, making faster computations to learn estimations over the training sets of \(D\). The model was adapted with two hidden layers and an output layer consisting of one unit, as shown in Figure 10.  
To minimize the classification error, a Binary Cross-Entropy Loss (BCEL) activation function was added, as follows:  
\[J(W,b;x,y)=-(y\log(h_{W,b}(x))+(1-y)\log(1-h_{W,b}(x))), \tag{5}\]  
where \((x^{(i)},y^{(i)})\) are the samples of the training set \(X_{train}\in D\), \(h_{W,b}(x)\) is the hypothesis equation with parameters \(W\) (weight) and \(b\) (bias), and \(y\) is the ground truth (the true label). Moreover, the DNN configuration and hyper-parameters used in this architecture are depicted in Figure 11.  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Algorithm** & **Drawbacks for Detecting IoT Attacks and Threats** \\ \hline DT [60] & Large data storage, computational complexity with high-dimensional network features, prone to over-fitting \\ \hline SVM [61] & Overlapping of class samples with large data sets, such as IoT network samples \\ \hline NB [62] & Inaccurate for finding feature relationships in complex data representations, comparable to impersonation and sybil attacks \\ \hline KNN [63] & Flawed and time-consuming processes for finding optimal neighbours over raw data corresponding to IoT packets \\ \hline AR [64] & Ineffective to map efficient rules in large IoT network nodes \\ \hline \hline \end{tabular}
\end{table}
Table 8: Comparison of different shallow algorithms and detected flaws.  
Figure 10: Architecture of the DNN.