Abstract
Keywords
1. Introduction
2. Background
3. Materials and methods
4. Classifiers evaluation and discussion
5. RF-Based Intrusion Detection System for RPL (RF-IDSR)
6. Related works
7. Conclusion
Declaration of Competing Interest
Acknowledgements
References
Abstract
Internet of Things (IoT) has emerged as a key component of all advanced critical infrastructures. However, with the challenging nature of IoT, new security breaches have been introduced, especially against the Routing Protocol for Low-power and Lossy Networks (RPL). Artificial-Intelligence-based technologies can be used to provide insights to deal with IoT’s security issues. In this paper, we describe the initial stages of developing, a new Intrusion Detection System using Machine Learning (ML) to detect routing attacks against RPL. We first simulate the routing attacks and capture the traffic for different topologies. We then process the traffic and generate large 2-class and multi-class datasets. We select a set of significant features for each attack, and we use this set to train different classifiers to make the IDS. The experiments with 5-fold cross-validation demonstrated that decision tree (DT), random forests (RF), and K-Nearest Neighbours (KNN) achieved good results of more than 99% value for accuracy, precision, recall, and F1-score metrics, and RF has achieved the lowest fitting time. On the other hand, Deep Learning (DL) model, MLP, Naïve Bayes (NB), and Logistic Regression (LR) have shown significantly lower performance.
1. Introduction
Critical infrastructures (CIs) cover various socio-economic sectors such as healthcare, agriculture, industry, gas and water distribution, transportation, energy, communications, information technology, etc. CIs are continuously changing and adapting to changes in technology. Indeed, Cyber-Physical Systems (CPS) and the Internet of Things (IoT) have emerged as core components in all advanced Cis, such as Industry 4.0 [1,2]. Since CIs are vital to daily human lives, their protection from cyber-attacks by malicious entities that cause significant impacts on the targeted CIs and their services is a serious concern. Consequently, to secure CIs, it is necessary to secure IoT networks [3].
IoT [4] consists of physical objects, usually known as things (devices) that sense, collect, and might process CIs related information. On one side, these objects are resource-constrained as they are powered by batteries and have limited computation and storage capability. On the other side, billions of these devices are interconnected and connected to the Internet under lossy and noisy communication environments such as Wi-Fi, ZigBee, Bluetooth, LoRa, GSM, WiMAX or GPRS. IoT applications have emerged in several aspects. Nevertheless, the IoT’s networks rise challenges in designing efficient and secure routing protocols [5,6]. Several efforts have been made by standardisation entities to specify efficient routing protocols for the IoT. Finally, the IPv6 Routing Protocol for Low Power and Lossy Networks (RPL) [7] was designed and standardised by the IETF ROLL working group to overcome the routing challenges underpinning IoT networks. RPL specification considers limitations in both the energy power and the computational capabilities of such networks