Rethinking IoT Intrusion Detection: Augmenting Routing Metrics with Radio Features

2026-06-05

AI Summary

This study addresses the limitations of existing machine learning–based intrusion detection systems for the Routing Protocol for Low-Power and Lossy Networks (RPL), which rely solely on routing-layer features and thus fail to comprehensively characterize network behavior. To overcome this constraint, the work proposes a novel approach that integrates transmitter/receiver (TX/RX) wireless radio frequency characteristics with standard routing-layer metrics, forming a unified feature set for an LSTM-based joint detection model. By incorporating physical-layer information alongside network-layer data, the method substantially enhances detection accuracy for sophisticated attacks such as DIS-Flooding, Local Repair, and Worst Parent. Notably, the detection performance for Worst Parent attacks improves most significantly, achieving up to a 4% increase in F1-score across various network scales.

Abstract

Machine learning-based intrusion detection systems (IDS) for RPL-based IoT networks often rely solely on routing layer features, which provide only a partial view of network behaviour. In this work, we investigate whether incorporating Transmit (TX) and Receive (RX) radio features alongside the standard RPL feature set can improve detection performance in an LSTM-based IDS. We evaluate the proposed approach across three different attack types, namely DIS-Flooding, Local Repair, and Worst Parent under varying network sizes. The results show that incorporating TX and RX improves the IDS's overall detection performance by up to ~4% in F1-score compared with using routing-layer features alone, with the most notable gain observed for the Worst Parent attack.

Problem

• IoT intrusion detection
• RPL
• routing metrics
• radio features
• network security

Innovation

• radio features
• RPL-based IDS
• LSTM
• IoT security
• feature fusion