Tailored machine learning-based IDS for RPL-based IoT networks with feature optimization and attack profiling using a novel dataset

Securing RPL-based Internet of Things (IoT) networks remains a critical challenge due to the limited computational and energy resources of sensor nodes, making them vulnerable to routing attacks. This paper proposes a light-weight Intrusion Detection System (IDS) for the detection of five prominent RPL-specific attacks, namely Version Number Attack, DIS Flooding, Reduced Rank, Worse Parent, and Local Repair Attack. Unlike previous work that employed traditional datasets, a novel dataset is generated by simulating actual real-world RPL-based IoT scenarios, encompassing both normal and malicious behaviors. The dataset contains 13 features representing network behavior that were carefully selected to reflect the characteristics of RPL communications. Five machine learning models consisting of K-Nearest Neighbors (KNN), Decision Tree (DT), Random Forest (RF), XGBoost, and LightGBM were trained and evaluated using both the entire feature set and a subset of the top 7 most informative features. LightGBM performed the best among them, with 99.47% accuracy, 99.58% precision, 99.37% recall, and 99.47% F1-score. Even with fewer features, it still yielded robust results, confirming its robustness and viability in constrained environments. The proposed architecture offers a feasible and efficient solution to enhancing RPL security in real-world IoT networks. The proposed framework highlights the potential of tailored machine learning models and original datasets to detect protocol-specific threats while respecting the limitations of low-power networks.