AD2EF-Net: an adaptive dropout artificial neural network with behavior-aware feature engineering for version number attack detection in RPL-based IoT networks
Internet of Things (IoT) networks commonly employ the Routing Protocol for Low-Power and Lossy Networks (RPL), where Version Number (VN) attacks can trigger unnecessary global repairs and persistent routing instability. This paper presents AD2EF-Net, an ANN-based VN-attack detection framework that integrates SHAP-guided offline analysis, behavior-aware feature engineering, intersection-consensus feature selection, and a self-tuning adaptive-dropout mechanism. To avoid information leakage, the revised experimental protocol performs the stratified 60/20/20 train/validation/test split before training-dependent preprocessing; SMOTE, Min–Max scaling, and feature selection are fitted exclusively on the training partition and then applied unchanged to validation and held-out test data. Under this corrected protocol, the final evaluated AD2EF-Net pipeline achieved 90.49% accuracy, 84.54% precision, 98.19% recall, a 90.86% F1 score, and a 95.99% AUC on the held-out test set. A controlled ten-seed dropout ablation showed only small differences among no-dropout, fixed-rate, and adaptive configurations: adaptive dropout achieved 92.45 ± 0.21% accuracy, 92.49 ± 0.20% F1, and the highest mean AUC (97.36 ± 0.13%), while fixed rates produced slightly higher mean accuracy, F1, or recall in some cases. A separate feature-selection ablation showed that the intersection-consensus strategy is not the highest-performing selector on this dataset; Extra Trees top-16 achieved stronger predictive performance, whereas the intersection-consensus configurations are discussed as consensus-based design trade-offs rather than as the highest-performing feature-selection strategy. The revised results therefore support AD2EF-Net as a transparent, leak-free framework with high recall on the evaluated IRAD benchmark, while avoiding claims of universal superiority, generalizability, or deployment readiness.
Authors
- Mohammad Emad Arafah (ORCID: https://orcid.org/0000-0001-5645-2290)
- Mohammed Anbar (ORCID: https://orcid.org/0000-0002-7026-6408)
- Mohammad Aljaidi (ORCID: https://orcid.org/0000-0001-9486-3533)
- Ziyad R. Alashhab (ORCID: https://orcid.org/0000-0002-4748-8037)
- Shankar Karuppayah (ORCID: https://orcid.org/0000-0003-4801-6370)
- Nadia A. Alfriehat (ORCID: https://orcid.org/0009-0005-2336-0839)
- Ahmad Alshammari (ORCID: https://orcid.org/0009-0000-2051-2757)
- Mohammad Ahmad
Institutions
- Northern Border University (SA)
- Universiti Sains Malaysia (MY)
- University of Bedfordshire (GB)
- Zarqa University (JO)
- Petra University (JO)
- Middle East University (JO)
Publication Details
- Journal
- Scientific Reports
- Published
- 2026-11-11
- DOI
- https://doi.org/10.1038/s41598-026-77742-9
- Primary Topic
- Network Security and Intrusion Detection
- Type
- article
- Field-Weighted Citation Impact
- 0.00