AD2EF-Net: an adaptive dropout artificial neural network with behavior-aware feature engineering for version number attack detection in RPL-based IoT networks

Internet of Things (IoT) networks commonly employ the Routing Protocol for Low-Power and Lossy Networks (RPL), where Version Number (VN) attacks can trigger unnecessary global repairs and persistent routing instability. This paper presents AD2EF-Net, an ANN-based VN-attack detection framework that integrates SHAP-guided offline analysis, behavior-aware feature engineering, intersection-consensus feature selection, and a self-tuning adaptive-dropout mechanism. To avoid information leakage, the revised experimental protocol performs the stratified 60/20/20 train/validation/test split before training-dependent preprocessing; SMOTE, Min–Max scaling, and feature selection are fitted exclusively on the training partition and then applied unchanged to validation and held-out test data. Under this corrected protocol, the final evaluated AD2EF-Net pipeline achieved 90.49% accuracy, 84.54% precision, 98.19% recall, a 90.86% F1 score, and a 95.99% AUC on the held-out test set. A controlled ten-seed dropout ablation showed only small differences among no-dropout, fixed-rate, and adaptive configurations: adaptive dropout achieved 92.45 ± 0.21% accuracy, 92.49 ± 0.20% F1, and the highest mean AUC (97.36 ± 0.13%), while fixed rates produced slightly higher mean accuracy, F1, or recall in some cases. A separate feature-selection ablation showed that the intersection-consensus strategy is not the highest-performing selector on this dataset; Extra Trees top-16 achieved stronger predictive performance, whereas the intersection-consensus configurations are discussed as consensus-based design trade-offs rather than as the highest-performing feature-selection strategy. The revised results therefore support AD2EF-Net as a transparent, leak-free framework with high recall on the evaluated IRAD benchmark, while avoiding claims of universal superiority, generalizability, or deployment readiness.

Authors

Institutions

Publication Details

Journal
Scientific Reports
Published
2026-11-11
DOI
https://doi.org/10.1038/s41598-026-77742-9
Primary Topic
Network Security and Intrusion Detection
Type
article
Field-Weighted Citation Impact
0.00
Controls
|||
ALL TIME
JAN
FEB
MAR
APR
MAY
JUN
JUL
AUG
SEP
OCT
NOV
article

AD2EF-Net: an adaptive dropout artificial neural network with behavior-aware feature engineering for version number attack detection in RPL-based IoT networks

Mohammad Emad Arafah, Mohammed Anbar, Mohammad Aljaidi, Ziyad R. Alashhab et al.
Scientific Reports
Network Security and Intrusion Detection
article

AD2EF-Net: an adaptive dropout artificial neural network with behavior-aware feature engineering for version number attack detection in RPL-based IoT networks

Mohammad Emad Arafah, Mohammed Anbar, Mohammad Aljaidi, Ziyad R. Alashhab, Shankar Karuppayah, Nadia A. Alfriehat, Ahmad Alshammari, Mohammad Ahmad
article en

Abstract

Internet of Things (IoT) networks commonly employ the Routing Protocol for Low-Power and Lossy Networks (RPL), where Version Number (VN) attacks can trigger unnecessary global repairs and persistent routing instability. This paper presents AD2EF-Net, an ANN-based VN-attack detection framework that integrates SHAP-guided offline analysis, behavior-aware feature engineering, intersection-consensus feature selection, and a self-tuning adaptive-dropout mechanism. To avoid information leakage, the revised experimental protocol performs the stratified 60/20/20 train/validation/test split before training-dependent preprocessing; SMOTE, Min–Max scaling, and feature selection are fitted exclusively on the training partition and then applied unchanged to validation and held-out test data. Under this corrected protocol, the final evaluated AD2EF-Net pipeline achieved 90.49% accuracy, 84.54% precision, 98.19% recall, a 90.86% F1 score, and a 95.99% AUC on the held-out test set. A controlled ten-seed dropout ablation showed only small differences among no-dropout, fixed-rate, and adaptive configurations: adaptive dropout achieved 92.45 ± 0.21% accuracy, 92.49 ± 0.20% F1, and the highest mean AUC (97.36 ± 0.13%), while fixed rates produced slightly higher mean accuracy, F1, or recall in some cases. A separate feature-selection ablation showed that the intersection-consensus strategy is not the highest-performing selector on this dataset; Extra Trees top-16 achieved stronger predictive performance, whereas the intersection-consensus configurations are discussed as consensus-based design trade-offs rather than as the highest-performing feature-selection strategy. The revised results therefore support AD2EF-Net as a transparent, leak-free framework with high recall on the evaluated IRAD benchmark, while avoiding claims of universal superiority, generalizability, or deployment readiness.

Scientific Reports
Northern Border University (SA), Universiti Sains Malaysia (MY), University of Bedfordshire (GB), Zarqa University (JO), Petra University (JO), Middle East University (JO)
Network Security and Intrusion Detection
AI Navigator

Ask Laika to Summarize, Analyze, and Connect papers live on the map.

Summarize Papers & Methodologies

Extract key findings, datasets, and comparative methods across publications.

Benchmark Rankings & Visual Analytics

Rank top research institutions, authors, funders, topics, and journals by Field-Weighted Citation Impact (FWCI) and paper volume with instant charts.

Connect Distant Disciplines

Bridge topological clusters on the map to find hidden collaborative intersections.

Laika access coming soon