Attack detection and classification in RPL-based iot networks

This study investigates the impact of Blackhole, HelloFlood, and Version Number attacks on the performance and energy consumption of Routing Protocol for Low-Power and Lossy Networks (RPL)-based Internet of Things (IoT) networks, aiming to automatically detect these threats using machine learning and deep learning techniques. A 52-node network model was developed using the Contiki 3.0 operating system and the Cooja simulator, where the specified attacks were simulated and their effects analyzed multidimensionally. Tools such as Powertrace, Wireshark, and Foren6 were employed to comprehensively evaluate energy consumption, network traffic, and changes in the Destination Oriented Directed Acyclic Graph (DODAG) structure. Simulation results revealed that Blackhole attacks cause data loss and routing errors, HelloFlood attacks increase network traffic intensity by 68%, and Version Number attacks result in a fourfold increase in control message traffic. Energy consumption analyses indicated that these attacks lead to a 30–60% increase in per-node energy usage. For attack detection, BiLSTM, LSTM, XGBoost, and LightGBM models were comparatively tested; BiLSTM achieved the highest performance with 99.02% accuracy and 99.83% AUC, while XGBoost offered advantages in real-time applications with a test time of 1.21 seconds. However, the computational complexity of these models limits their applicability on resource-constrained IoT devices. The study proposes exploring lightweight deep learning models, federated learning, and edge computing integration to address RPL protocol vulnerabilities. The findings underscore the need for multilayered security frameworks to enhance the reliability and sustainability of IoT networks, providing a foundation for future research in this domain.