CID-RPL: Clone ID Attack detection using Deep Neural Network for RPL-based IoT Networks

The proliferation of the Internet of Things (IoT) has reshaped industries based on seamless connectivity. However, it has also
brought about immense security challenges, especially in the communication protocol of routing protocol for low-power and lossy
networks (RPL). One of these security threats vital to the RPL-based IoT networks includes the Clone ID attack on malicious nodes
when they clone the identity of legitimate nodes to access their sensitive data without authorization. Detecting Clone ID attacks
in RPL-based IoT networks is complex because network traffic data has high dimensions and substantial data imbalances while
facing limited resources in these environments. The unmanaged control message system and insufficient identity authentication
methods within the RPL protocol directly expose networks to state-of-the-art cyber security threats. This paper proposes a new edge
layer-based deep neural network (DNN) approach to detect Clone ID attacks from IoT sensor networks by network traffic pattern
analysis. The proposed method is based on deep data features to distinguish legitimate nodes from cloned nodes and improve
the overall security, resilience, and operational efficiency of RPL-based IoT networks. To check the efficiency of our proposed
method, we designed a synthetic dataset called CID-RPL. The CID-RPL dataset consists of 25 attributes and 2,131,328 samples. The
experimental results are best to describe that our proposed approach outperformed the previously designed methods by offering
an accuracy improvement of 5.06%, precision improvement of 7.60%, recall increment of 7.0%, and F1 score enhancement of 11.0%.
Similarly, residual energy at the network level increased by 32.84%, which infers that the lifetime of the network will be extended
and its energy efficiency increased under attack situations. Thus, the results testify to the effectiveness of the DL-based solution
proposed herein to detect Clone ID attacks in dynamic and evolving network environments.