Assessing IoT Network Attack Impact and Detection Generalizability using Machine Learning

The rapid increase of Internet of Things (IoT) devices, particularly within resource-constrained Low-power and Lossy Networks (LLNs) utilizing the Routing Protocol for Low-Power and Lossy Networks (RPL), introduces significant security challenges. While Machine Learning (ML)-based Intrusion Detection Systems (IDSs) offer a potential defence, their effectiveness is often hampered by poor generalization across diverse attack types, variations, and network conditions. This report aims to enhance the understanding of ML model generalization for detecting attacks in RPL networks. To achieve this, two attack types, Local Repair and Worst Parent, along with variations, were implemented for nodes running the Contiki-NG operating system and simulated within the Cooja network simulator across various network sizes and topologies. The impact of these attacks on network performance metrics, such as Packet Delivery Ratio (PDR), hop count, and parent switching frequency, was quantified. An existing LSTM-based IDS was then trained using the collected data and its generalization capabilities were evaluated. The findings reveal that the Worst Parent attack proved more challenging for the IDS to detect compared to the Local Repair attack, attributed to its nuanced manipulation of network topology. Models trained with dynamic attack variations showed better generalization across different attack patterns than those trained on static variations, highlighting the importance of temporal diversity in training data. Furthermore, IDS generalization across network sizes and topologies presented a considerable challenge; models trained on smaller or shallower networks performed poorly on larger or deeper topologies, while training on more complex topologies showed better generalization to simpler ones. The impact analysis demonstrated that while attacks did not uniformly degrade performance, they increased network instability, with outcomes highly dependent on network topology and attacker placement rather than solely on attack intensity. This research underscores the need for diverse and representative training datasets to develop more robust IDSs for securing RPL-based IoT networks.