Machine learning in RPL -based IoT networks and cyber attack detection with deep learning approaches

The proliferation of Internet of Things (IoT) technologies has made RPL-based IoT networks increasingly vulnerable to routing attacks such as Blackhole, Version Number, and Hello Flood. This study proposes a machine learning and deep learning-based approach to detect these attacks effectively. A realistic IoT network dataset was constructed, containing key network attributes such as frame.time (timestamps), frame.len (packet lengths), wpan.src64 and wpan.dst64 (source and destination MAC addresses), icmpv6.type and icmpv6.code (ICMPv6 packet types and codes), ipv6.src and ipv6.dst (IPv6 source and destination addresses), along with classification labels. The attack detection system was developed using LightGBM, XGBoost, LSTM, and BiLSTM algorithms and evaluated through performance metrics such as F1-score and AUC. BiLSTM achieved superior performance in detecting Blackhole and Hello Flood attacks by effectively analyzing sequential patterns in frame.time and icmpv6 features, while LightGBM demonstrated low computational cost and fast testing times, making it highly suitable for resource-constrained IoT devices. All models provided high classification accuracy and real-time processing capability, fulfilling the early intervention needs in IoT cybersecurity. The proposed solution not only ensures robust detection of routing attacks in RPL-based IoT networks but also lays a strong foundation for enhancing the long-term security and resilience of IoT ecosystems.