Federated hybrid deep learning for multi-attack detection and classification in RPL-based 6LoWPAN networks

Abstract The Routing Protocol for Low-power and lossy networks (RPL) is the standard for 6LoWPAN (stands for IPv6 over Low-power Wireless Personal Area Networks)-based IoT (Internet of Thing) networks but remains highly vulnerable to routing attacks, compromising reliability, efficiency, and data integrity. Existing detection methods often rely on centralized learning and small datasets, limiting privacy and generalization, which also fail in concurrently handling the spatial and temporal correlations in network traffic. To address these limitations, this manuscript proposes a federated deep learning framework for detecting and classifying three critical RPL attacks: blackhole (BH), hello flooding (HF), and version number (VN).We applied hybrid feature selection, Random Forest and XGBoost on our collected multiclass dataset from Independent Research and Development (IRAD), covering 10, 20, 100, and 1000-node networks to ensure robust evaluation. Novel hybrid Convolutional Neural Network- Gated Recurrent Unit (CNN-GRU) architecture was developed to effectively capture both spatial features and temporal dependencies in the traffic data. Under a federated learning setup where data remains decentralized across clients, the proposed model was evaluated against CNN-LSTM, LSTM, and GRU baselines. The results demonstrate the superior performance of the Convolutional Neural Network-Long Short-Term Memory (CNN-GRU) model, achieving 99.50%. Finally, the study outlines a high-level conceptual mitigation strategy in which detected attacks automatically initiate specific countermeasures (e.g., blacklisting for BH attacks and rate-limiting for HF), and its full integration and practical implementation remain a subject for future research.