A Novel Dataset for Intrusion Detection in RPL-Based IoT Networks: Design, Implementation, and Open-Source Release

The widespread use of Internet of Things (IoT) networks in various industrial, medical, and critical infrastructure applications has increased the importance of research in protecting the security of these networks.The IPv6 routing protocol for low-power and lossy networks (RPL) is one of the popular protocols used in IoT networks.Although RPL is a popular and standard, it suffers from several security issues.Intrusion Detection Systems (IDS) play a key role in network security by detecting malicious activity.However, most existing RPL IDS datasets rely on full packet capture (PCAP) and centralized collection, which are impractical for IoT networks due to high storage, processing demands, and decentralized architectures.This paper presents a new behavior-based dataset for RPL IoT IDS called "RPL-IDS-Beh".Unlike traditional dataset construction methods based on capturing entire packets, the proposed mechanism collects periodic statistical summaries at the root from each node regarding its own behavior and that of its neighbors.This approach detects and prevents intrusions without requiring dedicated sniffing nodes to capture all packets transmitted over the network, enhancing privacy protection and addressing ethical concerns by transmitting only aggregated routing protocol data, minimizing the risk of adversarial attacks and exposure of sensitive node information.The dataset was validated through 96 network simulations across six topologies and 16 attack scenarios, generating 158,254 labelled instances with 27 features.It was tested using five traditional machine learning classifiers and three deep learning models, with Random Forest achieving the highest accuracy (96.8%) and F1-score (96.7%), demonstrating strong detection performance.Simulation results confirm that the RPL-IDS-Beh dataset is efficient in training intrusion detection systems to protect IoT networks.The dataset and its associated tools and code have been publicly released to support future scientific research in IoT security.