Abstract:Technological breakthroughs in the Internet of Things (IoT) easily promote smart lives for humans by connecting everything through the Internet. The de facto standardised IoT routing strategy is the routing protocol for low-power and lossy networks (RPL), which is applied in various heterogeneous IoT applications. Hence, the increase in reliance on the IoT requires focus on the security of the RPL protocol. The top defence layer is an intrusion detection system (IDS), and the heterogeneous characteristics of the IoT and variety of novel intrusions make the design of the RPL IDS significantly complex. Most existing IDS solutions are unified models and cannot detect novel RPL intrusions. Therefore, the RPL requires a customised global attack knowledge-based IDS model to identify both existing and novel intrusions in order to enhance its security. Federated transfer learning (FTL) is a trending topic that paves the way to designing a customised RPL-IoT IDS security model in a heterogeneous IoT environment. In this paper, we propose a federated-transfer-learning-assisted customised distributed IDS (FT-CID) model to detect RPL intrusion in a heterogeneous IoT. The design process of FT-CID includes three steps: dataset collection, FTL-assisted edge IDS learning, and intrusion detection. Initially, the central server initialises the FT-CID with a predefined learning model and observes the unique features of different RPL-IoTs to construct a local model. The experimental model generates an RPL-IIoT dataset with normal and abnormal traffic through simulation on the Contiki-NG OS. Secondly, the edge IDSs are trained using the local parameters and the globally shared parameters generated by the central server through federation and aggregation of different local parameters of various edges. Hence, transfer learning is exploited to update the server's and edges' local and global parameters based on relational knowledge. It also builds and customised IDS model with partial retraining through local learning based on globally shared server knowledge. Finally, the customised IDS in the FT-CID model enforces the detection of intrusions in heterogeneous IoT networks. Moreover, the FT-CID model accomplishes high RPL security by implicitly utilising the local and global parameters of different IoTs with the assistance of FTL. The FT-CID detects RPL intrusions with an accuracy of 85.52% in tests on a heterogeneous IoT network.

DSAT-IDS: Dissimilarity and Adaptive Threshold-based Intrusion Detection system to mitigate selective forwarding attack in the RPL-based 6LoWPAN

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

A Lightweight Cooperative Intrusion Detection System for RPL-based IoT

FL-DSFA: Securing RPL-Based IoT Networks against Selective Forwarding Attacks Using Federated Learning

Detection and Mitigation of RPL Rank and Version Number Attacks in the Internet of Things: SRPL-RP

CoSec-RPL: detection of copycat attacks in RPL based 6LoWPANs using outlier analysis

Intrusion Detection System For Rpl From Routing Choice Intrusion

Work-in-Progress: Towards Real-Time IDS Via RNN and Programmable Switches Co-Designed Approach

RIDS: Towards Advanced IDS Via RNN Model and Programmable Switches Co-Designed Approaches

Secure IoT Routing: Selective Forwarding Attacks and Trust-based Defenses in RPL Network

Router based detection for low-rate agents of DDoS attack

Li-MSD: A lightweight mitigation solution for DAO insider attack in RPL-based IoT

LEADER: Low Overhead Rank Attack Detection for Securing RPL based IoT

A Lightweight Security Solution for Mitigation of Hatchetman Attack in RPL-based 6LoWPAN

SDN-Based Intrusion Detection System for Early Detection and Mitigation of DDoS Attacks

Customised Intrusion Detection for an Industrial IoT Heterogeneous Network Based on Machine Learning Algorithms Called FTL-CID

Designing Efficient Sinkhole Attack Detection Mechanism in Edge-Based IoT Deployment

An Efficient Scheme to Defend Data-to-Control-Plane Saturation Attacks in Software-Defined Networking

SoS-RPL: Securing Internet of Things Against Sinkhole Attack Using RPL Protocol-Based Node Rating and Ranking Mechanism

HADTF: a hybrid autoencoder–decision tree framework for improved RPL-based attack detection in IoT networks based on enhanced feature selection approach

Identify Selective Forwarding Attacks Using Danger Model: Promote the Detection Accuracy in Wireless Sensor Networks