Received September 28, 2020, accepted September 30, 2020, date of publication October 6, 2020, date of current version

October 19, 2020.

Digital Object Identifier 10.1109/ACCESS.2020.3029191

RPL Attack Detection and Prevention in the

Internet of Things Networks Using a GRU
Based Deep Learning
SEMIH CAKIR 1, SINAN TOKLU 2, AND NESIBE YALCIN 3
1 Department of Electrical, Electronics, and Computer Engineering, Institute of Science, Düzce University, 81010 Düzce, Turkey
2 Department of Computer Engineering, Düzce University, 81010 Düzce, Turkey
3 Department of Computer Engineering, Bartın University, 74110 Bartin, Turkey

Corresponding author: Semih Cakir ([email protected])

ABSTRACT Cyberattacks targeting Internet of Things (IoT), have increased significantly, over the
past decade, with the spread of internet-connected smart devices and applications. Routing Protocol for
Low-Power and Lossy Network (RPL) enables messages to be routed between nodes for the Wireless
Sensor Network in the network layer. RPL protocol, which is sensitive and difficult to protect, is exposed
to various attacks. These attacks negatively affect data transmission and cause great destruction to the
topology by consuming the resources. Hello Flooding (HF) attacks against RPL cause consumption of
constrained resources (memory, processing and energy) in nodes. Therefore, in this study, a Gated Recurrent
Unit network model based deep learning has been proposed to predict and prevent HF attacks on RPL
protocol in IoT networks. The proposed model has been compared with Support Vector Machine and Logistic
Regression methods, and different power states and total energy consumptions of the nodes have been taken
into consideration and experimented with. The results confirm the promised and expected performance from
the model in terms of source efficiency and IoT security. In addition, attack detection has been carried out
with a much lower error rate than literature studies for HF attacks from RPL flood attacks.

INDEX TERMS Deep learning, gated recurrent unit, hello flooding, Internet of Things.

I. INTRODUCTION
Internet of Things (IoT) refers to devices, machines and
software that communicate with each other when considered
in a system, on the other hand everything connected to the
internet [1]. The interaction of objects that communicate
and transfer data, which are connected to the Internet
via 6LoWPAN (IPv6 over Low-Power Wireless Personal
Area Networks) is used to improve the quality of life
(e.g. smart cities, smart buildings, smart cars) and increase
job opportunities [2], [3]. However, due to its ad-hoc and
limited resource structure, IoT systems are very vulnerable
to attacks. Generally, attacks target the usability and energy
consumption of a node connected to a heavy data stream. FIGURE 1. Well known RPL attacks against resources [4].

Attack detection systems are one of the security measures and

are crucial in an IoT ecosystem. the most common type encountered in the literature, is to
The primary function of attacks on Routing Protocol for route messages between nodes. The most known RPL attacks
Low-Power and Lossy Network (RPL) based IoT networks, targeting resource consumption [4] are given in Fig. 1. The
purpose of source-side attacks is that the malicious node,
The associate editor coordinating the review of this manuscript and which is harmful in our highly sensitive network structure,
approving it for publication was Firooz B. Saghezchi . creates energy consumption, process crowd, and excessive

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
183678 VOLUME 8, 2020
S. Cakir et al.: RPL Attack Detection and Prevention in the IoT Networks Using a GRU Based Deep Learning

memory density to disturb the stability of the Quality of II. RELATED STUDIES AND BACKGROUND
Service (QoS) of the network. Flood attacks, one of the most Integrity, reliability, confidentiality, and security are signif-
known attack types, aim to render the nodes dysfunctional by icant parameters for the sustainability of a system. IoT has
damaging the network topology with the help of the malicious been the focus of attention with its recent popularity, but
node. They perform this by transmitting or broadcasting has brought some problems along with it. Security is at the
DODAG Information Solicitation (DIS) messages. forefront of these problems [6]–[8]. In the classification of
Hello Flooding (HF) attacks are the RPL protocol attacks, attacks, HF attacks are a type of routing attacks and are
which are not emphasized enough in terms of the energy carried out in the network layer. Sinkhole, Sybil, Rank, HF,
consumption in nodes in the literature. The values of the Spoofing, Blackhole, and Wormholes are known as common
Central Processing Unit (CPU; used for calculations data attacks in routing services [9].
processing), Low Power Mode (LPM; idle device waiting for Considering resource consumption, flood attacks come to
events), Radio Transmission (Tx; data transmission), Radio the forefront. Although HF attacks are among the attacks that
Reception (Rx; data reception) and Total Energy (TE; total are effective, the energy consumption calculation of resources
energy consumption) power states that affect the energy of when detecting the malicious nodes has been the subject of
the network topology are calculated and the changes in the not many studies in the literature. Therefore, this study will
energy after the attacks are observed in this study. contribute novelty to the literature with the methods proposed
The fact that significant amount of data is received from and the effective attack prevention system recommended.
devices that lack resources and computing abilities has
rendered the classical methods ineffective and led to the A. RPL AND RESOURCE ATTACKS
emergence of new systems [5], [6]. Therefore, it is reported
1) 6 LoWPAN (IPv6 OVER LOW-POWER WIRELESS
in the literature that machine learning methods are more
PERSONAL AREA NETWORKS
useful in terms of interpreting data in IoT attacks and making
There are insufficient IPv4 addresses and it creates conflicts
accurate predictions. For this reason, unlike similar studies
in the current communication system due to increase in
for real-time attack detection on devices in the IoT ecosystem,
the number of IoT devices. IPv6 provides billions of
the nodes have been classified using GRU (Gated Recurrent
unique IP addresses for the IoT ecosystem with 128-bit
Unit)-based deep learning method with Recurrent Neural
addressing [10]. 6LoWPAN[11] protocol is a communication
Network (RNN) architecture and achieved a high accuracy
protocol of IEEE 802.15.4 [12] standards that provides
of 99.96%. On the other hand, 3 different datasets, whose
minimum resource consumption, long battery life, and high
designations start with ‘‘SSN’’, have been created as a result
data capacity.
of the simulations conducted in Contiki OS / Cooja Simulator.
In summary, the main contributions of this study are as
follows: 2) RPL (IPv6 ROUTING PROTOCOL FOR LOW-POWER AND
a) ‘‘A GRU-based deep learning approach’’ is used to LOSSY NETWORKS
classify malicious nodes in HF attack detection and also to RPL protocol [13] is a dynamic, distance - vector protocol
protect the constrained energy sources. and seeks to find paths between nodes on the network
b) Each dataset, named ‘‘SSNx’’, includes CPU, LPM, Tx, using routing protocols [14]. Its key features are automatic
Rx and TE data calculated for each node, and can be used configuration, self-healing and loop avoidance, and its main
to prevent attacks after classification. GRU is proven to yield function is to direct data traffic with minimum energy
more dominant results than Support Vector Machine (SVM) consumption and minimum loss of packets. In addition,
and Logistic Regression (LR). The packet of the node with it can be used in point-to-point (P2P), multipoint-to-point
a value received outside the specified value range will be (MP2P), and point-to-multipoint (P2MP) topology types.
dropped from the network after checking the threshold value In the tree-based topology, the data flow is root-to-nodes
of the properties calculated within the attack prevention or vice versa. The position where each node is located in
method. the topology is called ‘‘Rank’’. Nodes are positioned in the
c) ‘‘Detection of HF attacks with a high accuracy rate’’ that topology based on their levels calculated with the help of
can inspire attack detection and prevention methods in other an ‘‘objective function’’. This function uses algorithms that
IoT ecosystems. calculate the quality of the route with the help of metrics.
The remainder of this paper is organized as follows: Main concepts used in RPL protocol;
next section presents current studies made on IoT attacks, Destination Oriented Directed Acyclic Graphs (DODAG):
their detection and prevention approaches. Section III gives The nodes are interconnected according to a specific
detailed information about HF attacks on RPL Protocol, deep topology that incorporates tree and mesh topologies called
learning-based attack detection, simulation of IoT ecosystem DODAG [4]. This is a special kind of Directed Acyclic
and dataset used in the experiment. The proposed model is Graphs (DAG) where each node wishes to reach a single
explained in Section IV and the results are summarized and destination.
discussed in Section V. Conclusions are drawn in the final DODAG Information Object (DIO): This message is
section. used to discover new nodes, transmit configuration and

VOLUME 8, 2020 183679

 S. Cakir et al.: RPL Attack Detection and Prevention in the IoT Networks Using a GRU Based Deep Learning

communicate. If a node receives a DIO message, it also emits traffic and sends messages to the nearby nodes more than
a DIO message, taking into account the rank value and link usual. When the HF attack begins, it increases the resource
metrics of the incoming node. In this way, the parent-child consumption by directing the data traffic on the neighboring
relationship is also determined. nodes via itself. In the network ecosystem where huge data
DODAG Information Solicitation (DIS): It can be consid- traffic occurs, the energy consumption of the limited nodes
ered as a message to discover neighbors. A node, not included increases and data losses occur. The repair mechanism that
in the DODAG network, broadcasts a DIS message. It sends corrects the RPL’s data flow resolves this problem after a
it to ask ‘‘Are there any DODAGs?’’. certain period, but the nodes around the malicious node will
DODAG Advertisement Object (DAO): It is sent by a child continue to be affected by this attack.
to its parent. This message includes a request to allow the
child to join a DODAG. DAO-ACK: This message includes B. DETECTION AND PREVENTION APPROACHES
‘‘Yes’’ or ‘‘No’’ response from parent or root to the child. Attacks on WSN are carried out in IoT and their protocol
structures, designs, and messages are different. Therefore,
prevention or reduction of the attacks may differ. In other
words, the methods applied to one type of attack may be
invalid for others [20].
There are many anomaly-based, signature-based and
encryption methods, machine learning, deep learning, neural
network types and classification methods are used for detec-
tion and prevention of IoT attacks in the literature. Current
studies using these methods and outputs are presented
in Table 1. Cryptographic and non-cryptographic methods
are used for HF detection but they are not suitable for
the resource-constrained IoT ecosystem [21]. New detection
methods are needed in terms of limited storage space,
FIGURE 2. RPL control messages from node to root [15].
processing capacity, and energy source. Attack prevention
systems are generally in the form of mitigating or minimizing
The message relationship between the root node and a new
the attacks.
node that wants to join DODAG is given in Fig. 2 [15].
III. DEEP LEARNING BASED RPL ATTACK DETECTION
3) ROUTING AND RESOURCE ATTACKS
‘‘Deep learning’’, first used by Igor Aizenberg and col-
Routing protocol resource attacks in wireless sensor net- leagues, is a subfield of machine learning and is based on
works (WSN) are typically based on consuming the limited Artificial Neural Networks (ANNs). The distinction of deep
resources (energy, memory or process density) of the nodes learning from ANN is the hidden layers in its structure.
in the topology through unnecessary operations. Thus, the life Consecutive layers take the output of the previous layer as
of a network decreases and loses its functionality. As shown input and its structure is based on learning the representation
in Fig. 3, resource attacks can be classified in 3 groups as of the data [27]–[29]. Deep learning methods give better
wireless network attacks, routing attacks and denial of service results than traditional data processing techniques for the
attacks [4]. data in very large sizes [1], [5], [6], [28], [29], [36].
Therefore, deep learning methods are suitable for big
data created by IoT devices. Traditional authentication
methods or RSS-based approaches cannot always provide
security for resource-restricted IoT devices in HF attacks.
Detection methods for HF attacks (bidirectional verification
technique [30]), prevention solutions (identity verification
protocol [31], multi-path multi-base station routing [30] and
FIGURE 3. Classification of attacks. µ-Tesla [32]), and both attack detection and prevention
approaches (deep learning methods [1], [28], [29]) have
In HF attacks, each node creates the neighborhood list by presented for HF attacks on IoT devices in the literature.
sending a packet with a ‘‘Hello’’ message to their neighbors. In the proposed methodology, the Cooja simulator in the
Any malicious node in the network ecosystem attempts to Contiki operating system is used for simulation scenarios, and
strike network traffic by sending ‘‘Hello’’ messages to many the data packets of the attacker and normal nodes have been
othe nodes, and imposes itself to other nodes, transmits created in Zonguldak Bülent Ecevit University Kdz. Eregli
the messages that will go through other nodes all the Vocational School. Total energies of nodes, CPU, LPM,
way to the server and performs the transmission [16]–[19]. Tx and Rx power values have been calculated from the IoT
The malicious node set in DODAG increases the network routing attacks based on the characteristics of the HF attacks

183680 VOLUME 8, 2020

S. Cakir et al.: RPL Attack Detection and Prevention in the IoT Networks Using a GRU Based Deep Learning

TABLE 1. Summary of flooding attacks and countermeasures on RPL.

VOLUME 8, 2020 183681

 S. Cakir et al.: RPL Attack Detection and Prevention in the IoT Networks Using a GRU Based Deep Learning

and recorded in a dataset. The learning algorithm has been

implemented with the support of KERAS [33] Tensorflow
from Python libraries.

A. DEEP LEARNING ARCHITECTURE

RNN is a type of ANN where the units in the system
are connected to each other with a loop and based on the
logic of receiving raw data in a certain order [29]. RNN
has a short-term memory problem [34]. If a time series
data is quite long, it may be difficult to remember the
previous data during the move of the information from the
previous step to the next step, and it becomes difficult to
forward the information. Therefore, the information that
is important in the prediction can be missing. LSTM
(Long Short – Term Memory), developed by Hochreiter and
Schmidhuber in 1997 to solve this problem [35], is a special
type of RNN that can learn in long arrays, However, its
complex structure and time-consuming analysis, compared
to neural networks, led to the emergence of the GRU in
2014. Features such as fast training, simplified structure,
and being easy-to-analyze make GRU stand out compared to
LSTM [36].
FIGURE 4. Structure of GRU cells [37].
GRU has a similar structure when compared to LSTM
units. Unlike LSTM, GRU has a reset and update gateway
instead of the entrance, exit and forget gate. The purpose
of the reset gate is how the new entry will be combined
with the previous memory, and the update gate describes how
much of the previous memory will be stored. These vectors
decide what information is to be transferred as the output
and can be trained to remove information that is irrelevant
for prediction. Briefly, it can be learned which of the data
in the series is important to store and delete and also the
learned information can be used for predictive purposes. The
general structure and architecture of GRU neural networks
are illustrated in Fig. 4 and Fig. 5, respectively.
The terms shown in Fig. 5 are explained as fol- FIGURE 5. The GRU architecture [38].
lows [39], [40]:
Update gate helps determine how much of the past
information for the model needs to be passed into the future. where, ht−1 and xt are multiplied by their corresponding
With this feature, it prevents the model from copying all the weights Wr and Ur , respectively. Then σ sigmoid function
information from the past. The model may decide to copy is applied on the sum of the results.
all the information from the past and gradient can eliminate Current memory content: A new memory content ĥt uses
the risk of eliminating the problem. Equation (1) is used to the reset gate to store the relevant information from the past.
calculate the update gate zt for time step t. The formula is given in (3)

zt = σ × (Wz × ht−1 + xt ×U z ) (1) h̃t = tanh × (Wh × (ht−1 × r) + Uc ×x t ) (3)

Here, xt is the input vector and ht−1 holds the output for the where the input xt is multiplied with the weight Uc , ht−1
previous time step t − 1. When xt and ht−1 are attached into is multiplied with the reset gate r and with the weight Wh .
the model unit, they are multiplied by their weights Uz and That will assign what to extract from the previous time steps.
Wz, respectively. The multiplication results are summed and And then the results are summed up and nonlinear activation
then a sigmoid activation function σ is applied to match the function tanh is finally applied.
results between 0 and 1. Last memory at the current time: The model needs to
Reset gate rt is used to decide how much of the past calculate the ht vector, which holds the information for the
information in the model is forgotten and determined by (2) current unit and passes it to the model. An update gate is
required for this. It determines what to gather from the current
rt = σ × (Wr ×ht−1 + xt ×U r ) (2) memory content ĥt and what from the previous steps ht−1 and

183682 VOLUME 8, 2020

S. Cakir et al.: RPL Attack Detection and Prevention in the IoT Networks Using a GRU Based Deep Learning

calculates it with the help of (4). using Python. The proposed approach works independently,
  thus saving the nodes resources.
ht = zt × h̃t + ((1 − zt ) ×ht−1 ) (4) Energy consumption E (mW) value is the amount of energy
used to send and receive data packets between motes (nodes)
B. SIMULATION OF IoT ECOSYSTEM AND SSN and calculated by (5)
The variety of use of WSN technology in different environ- energest_value × I × V
ments has enabled it to take place in the IoT ecosystem. E= (5)
rtimer_second × runtime
Possible aspects of this technology can be examined through
the simulators that offer real-life environments. Contiki - where the runtime is the time interval, rtimer_second is the
Cooja simulator [41] is an ideal tool to develop the simulation number clock frequency, energest_value is the energy usage
platforms for RPL and WSN. It is open for research purposes in two-time intervals (runtime) for a defined power state (e.g.
and has been chosen thanks to its functionality and scalability CPU, LPM, transmit), I is current and V is voltage. So the
features. The simulation control window supports start, total energy consumption, TE, is determined as follows.
pause, reload and stop buttons for the simulation in addition V
TE = × ((ICPU × ECPU ) + (ILPM × ELPM )
to the simulation time and speed of the running simulation. t
Parameters of the Cooja simulator have been designated for + (ITx × ETx ) + (IRx × ERx )) (6)
different scenarios (1, 2 and 3) and are presented in Table 2.
ECPU is the total CPU energy consumption, ELPM is
the accumulated LPM energy consumption, ETx is the
TABLE 2. Simulation parameters.
accumulated transmission energy consumption and ERx is
the accumulated listen energy consumption in time t. The
other parameters in (6) are defined in Table 3 and their
values are taken from the Tmote Sky mote datasheet [42].
In addition, Contiki-Cooja simulation provides rimeaddr and
transmitted values. Due to success rate of 99.96% of the
proposed model, other features have not been included in this
resource-constrained IoT environment.

TABLE 3. Energy consumption parameters for a constrained mote.

CPU, LPM, Tx (transmit), Rx (receive) and TE values

obtained from the motes during the simulation have been
stored in datasets named ‘‘SSN1’’, ‘‘SSN2’’ and ‘‘SSN3’’,
respectively based on the three scenarios created. The total
Sky mote is equipped with 8 MHz MSP430 low power numbers of normal and malicious motes/nodes are different
microcontroller, 10 KB RAM and 48 KB flash memory and in the scenarios.
also has 4 MHz of clock speed. The initial values of the In the simulation, new nodes join the network by
simulation of each sensor node’s output can, too, be saved broadcasting a ‘‘Hello’’ message with ID number and signal
to a file via menu options present in it, which will later power, and announce their existence to their neighbors. Then
be used for the machine learning methods. In the proposed all the other nodes update their routing table and send their
model, the simulation was started and run for 10-hours for own messages. In HF attack, malicious nodes frequently
all scenarios. During the simulation, the ‘‘Mote output’’ broadcast ‘‘Hello’’ messages by DIS packets looking like a
window shows the outputs for each sky mote sensor nodes neighbor and become the most available node for other nodes.
according to the timeline and displays the DODAG message So they cause their neighbors to spend their resources on
details such as when the message is sent or received, and the processing wasteful packets [1]. Figure 6 shows the situations
node identification (ID) information. The Cooja simulation before and after HF attack in the simulation.
generates raw packet capture ‘‘.pcap’’ files, then these files The average number of DIO, DIS and DAO message trans-
can be converted into Comma Separated Values ‘‘.csv’’ files missions increases as the node’s degree or rank increases.

VOLUME 8, 2020 183683

 S. Cakir et al.: RPL Attack Detection and Prevention in the IoT Networks Using a GRU Based Deep Learning

The time complexity of the proposed method has been

computed and presented as follows:

FIGURE 6. The situations a) before b) after HF attack.

As network size grows, transmission time increases due to

the multiplicative effect of a greater hop count between the
root and any other node. If the HF malicious node is in the
first rank, for example, 40 × 8 = 320 bits of data will be
transferred for a packet of 40 bytes. In addition, the bandwidth
is equal to 10 Kbyte = 10240 bits. It is assumed that the value
of h for a packet of 40 bytes (for sky mote) is 320 / 10240 =
0.031 s [43].

IV. PROPOSED MODEL

Attacks on routing protocols can cause great damage to
resource-restricted networks, just like any other attack type.
In this study, a model for detection and identification of
attacks is proposed for a resource-constrained IoT environ-
ment. The overall architecture of the proposed model is
illustrated in Fig. 7.
The architecture of the proposed model consists of three
parts: network simulation, data preprocessing and attack
detection. Firstly, the network is simulated by the Cooja
simulator based on the scenario incorporating root, normal
and malicious nodes. CPU, LPM, Tx, Rx and TE values
of each node are calculated (see Section III). The message
packets from the nodes are captured and filtered based on
their contents. Secondly, all the data with relation to the result
of the simulation are recorded in a ‘‘.csv’’ file. The data on
the selected features (ID number, CPU, LPM, Tx, Rx, and TE)
and operation time are stored in datasets named ‘‘SSNx’’, (an
Excel file) depending on the scenario. Finally, the data set is
normalized in the range of [0, 1] to improve the performance
and is analyzed by GRU, Support Vector Machine (SVM),
and LR machine learning methods. The output obtained
indicates whether the node is normal or malicious depending
on value range of Rx determined by statistical operations.
Thus the packets of the attacking nodes will be dropped
from the network when they are detected using the algorithm
below. In the literature, drop and quarantine processes have The time complexity of the GRU is O(NI (H 2 + HNo )),
been observed, so the drop process has been preferred. In this where NI is the number of features in inputs, H is the number
study, different combinations of features are also used to of hidden units, and No is the number of outputs [44]. The
determine the most effective method in the detection of HF time complexity of operations performed in Cooja simulation
attacks. has been computed as O(n). It is similar to [45] but higher
In terms of using CPU, LPM, Tx, Rx and TE power accuracy value is obtained in this study. While attacks can
calculations, and GRU deep learning method together, be detected with 99.5% accuracy in [1], it is achieved using
the proposed model will add novelty to the literature in the a single feature (Rx) and thus the computational load of the
detection of HF attacks, which are one of the effective attack algorithm is also reduced. The solutions for HF attacks have
types in IoT. been proposed in [19] but these are mainly cryptographic

183684 VOLUME 8, 2020

S. Cakir et al.: RPL Attack Detection and Prevention in the IoT Networks Using a GRU Based Deep Learning

FIGURE 7. The architecture of HF attack detection and prevention model.

HF Attack Prevention Algorithm mainly measures the time during which various components
Start are activated. Some features belonging to each node (CPU,
1st Step: Root node ‘‘R’’ broadcast the DIO LPM, Tx and Rx) can be requested from the server via
2nd Step: Other nodes ‘‘N’’ gets the message DIO DIO message within the network. These features are used
3rd Step: Other nodes ‘‘N’’ sends DAO to the root node ‘‘R’’ to determine TE value of each node in Contiki OS Cooja
4th Step: Root node ‘‘R’’ multicast the DAO-ACK to node Simulator. The feature values of the sensor nodes for
‘‘N’’ power consumptions will be collected and printed for every
If Can join the DODAG 10 seconds of the Contiki clock (clock_second × 10).
Else Cannot join the DODAG The RPL incurs control overheads (DIO, DAO, and DIS)
5th Step: DODAG will be constructed by repeating the steps during the DODAG construction. Each node transmits DIO
1-4 messages using the trickle timer based on the network status
6th Step: Root node ‘‘R’’ sends the DIO (to receive the CPU, and the frequency of DIO messages also depends on the
LPM, Tx, Rx, and TE values) network stability [44].
7th Step: Node ‘‘N’’ sends DAO (CPU, LPM, Tx, Rx, and TE In this study, GRU method has been applied manually
values) after the nodes have been created in the Cooja simulator.
8th Step: Node ‘‘R’’ sends DAO-ACK The obtained results have been optimized and the intrusion
If max(Rx) > Rx > min(Rx) detection threshold has been determined through the machine
Normal Nodes (makes an ‘‘N’’) learning methods (GRU, SVM, LR) used in the study. In the
Else Malicious node detected and DROP Packet (make as proposed method, the simulation and deep learning methods
‘‘M’’ Hello Flood (HF) node) do not create high computational loads as they run separately.
End
V. RESULTS AND DISCUSSION
In this study, dealing with the types of HF attacks, the power
and cause heavy computational complexity. So they are states of the nodes have been examined before and after
not suitable for constraint devices in IoT. As can be seen the attack. Time-dependent energy consumption values of
in Table 1, GRU deep learning method proposed in the study non-malicious (normal) and malicious nodes are presented
yields better performance values than that of the other studies graphically in Fig. 8 and Fig. 9, respectively.
carried out on HF attacks. As can be seen Fig. 8, the changes in LPM and Rx occurs
In this study, there will be no resource and energy at very large intervals, but in CPU and Tx at smaller intervals.
constraints on the nodes as the simulation and deep learning Fig. 9 shows that the energy usage of the malicious node in
operations are performed in different servers. The average the LPM varies at a certain level and especially in Rx, this is
number of DIO message transmissions increases as the node’s quite low compared to the non-attack situation. CPU energy
degree or rank increases. As network size grows, transmission usage is quite low in both graphs, but the change in malicious
time increases due to the multiplicative effect of a greater hop node is clearly seen.
count between the root and any other node. Packet Delivery Rate (PDR) and delay have also been
There is no modification in DIO, DIS or DAO messages, considered to evaluate the network performance. Networks
Contiki has a software-based power profiling system that with different number (2-4-8 and 16) of HF malicious nodes

VOLUME 8, 2020 183685

 S. Cakir et al.: RPL Attack Detection and Prevention in the IoT Networks Using a GRU Based Deep Learning

FIGURE 8. Energy consumption of non-malicious nodes.

FIGURE 11. Average end-to-end delay with number of malicious node.

In this study, GRU neural networks are used to accurately

detect HF attacks in all scenarios. The dataset containing
ID, CPU, LPM, Tx, Rx and TE data has been divided
into 2 subsets for training and test of GRU networks:
80% for training set and 20% for testing. GRU network
models have been developed using Keras in Python. Dropout
value is chosen as 20% to prevent overfitting and tangent
hyperbolic activation function is preferred. As a result of
the experimental evaluations to determine the best network
model and architecture for the GRU method used in attack
FIGURE 9. Energy consumption of malicious node. detection, the values given in Table 4 are determined.

TABLE 4. Network model characteristics.

have been created and then simulated 900000 ms. The
changes of PDR and delay based on the number of malicious
nodes have been computed and illustrated in Fig. 10 and
Fig. 11, respectively.

SSN1 dataset has been used to compare the performance

of GRU, SVM, and LR machine learning methods and the
size of the data set is 10519 x 6. GRU, SVM, and LR
are run separately 50 epochs for combinations of different
features, the accuracy rates changing by used features are
presented in Table 5. The best results are obtained with GRU
FIGURE 10. The changing of PDR with the number of malicious node. deep learning method for each combination and it has also
performed better than SVM and LR in most cases. When the
It is clear from the figures that when the number of accuracy rates obtained using one feature are compared, it is
HF malicious nodes is increased, the performance of the seen that the highest accuracy value is obtained with Rx and
network decreases (e.g. as increase in the time for all the worst performances for all methods are the ones the Tx is
packets to reach their destination and in the number of lost used only.
packets). In addition, the delay is less in the proposed study, As can be seen in Table 5, the highest accuracy (99.95%)
although there are more packets sent compared with that of has achieved by GRU using CPU, Tx, Rx and TE values.
Khosravi et al. [22]. This study estimating better results can The accuracy rate has decreased by 0.15 with the addition
be used for overcoming HF attacks. of LPM value (CPU, LPM, Tx, Rx, TE). Accuracy rates

183686 VOLUME 8, 2020

S. Cakir et al.: RPL Attack Detection and Prevention in the IoT Networks Using a GRU Based Deep Learning

TABLE 5. Performance comparison for different features. TABLE 6. Performance of GRU in different scenarios.

the model would be. The best result of ACC, MSE, MAE and
RMSE is reported in 3rd scenario. This also shows that the
model can accurately predict the attacks.
VI. CONCLUSION
Deep learning methods yield the most successful results
in IoT routing attack detection systems as in many areas.
In this study, GRU neural networks-based deep learning are
preferred due to their simple structure (e.g. adding new gates
obtained using the (Tx, Rx), (LPM, Tx, Rx), and (CPU,Tx, with fewer codes), ability to learn the model faster with less
Rx) combinations are equal to %99.81. When the CPU, LPM, data compared to LSTM. Different combinations of CPU,
Tx and Rx values are fed into the network as input, an increase LPM, Tx, Rx and TE power states used for the training of
of approximately 0.09 has occurred in the accuracy. GRU in order to detect HF attacks. The results obtained
The use of Rx values has provided high accuracy value, using GRU, SVM and LR methods are given comparatively
and Tx and LPM values have increased the performance in Table 5. Different scenarios have been created and the
less compared to Rx, respectively. 99.52% success rate has performance of GRU is compared for different number of
been achieved only with the Rx value rather than monitoring the normal/malicious nodes. As can be seen in Table 5 and
parameters (CPU, LPM, Tx, Rx and TE) for the nodes. Table 6, the highest accuracy rate of this study is 99.96%
Therefore, it can be said that Rx feature provides strong and GRU is more successful in terms of delay and PDR
superiority over other ones in order to drop the packets for attack detection (see Fig. 10 and Fig. 11). Certainly,
after detecting node. The minimum and maximum Rx values it is predicted that there could be a scalability problem
obtained from the dataset have been used to detect HF when the number of nodes is increased heavily. This is
attacks and malicious nodes as given in the algorithm (see identified as the subject of a further study. In addition,
Section IV). the proposed model may also give new insights and trigger
The SSN1, SSN2 and SSN3 datasets created as a result of new attempts on detection and prevention of routing attacks in
simulations made according to different scenarios are given IoT environments. GRU based deep learning method can be
as inputs to GRU, SVM and LR. Then the obtained results used with high performance to detect and prevent RPL attacks
using ACC (Accuracy), MSE (Mean Squared Error), MAE in IoT. In the future studies, the method proposed is planned to
(Mean Absolute Error) and RMSE (Root Mean Square Error) be used in the detection and prevention of other attack types.
evaluation metrics are presented comparatively in Table 6.
REFERENCES
As seen, the accuracy values have increased with the
[1] F. Y. Yavuz, D. Ünal, and E. Gül, ‘‘Deep learning for detection of routing
increase in the number of nodes for both of the feature sets. attacks in the Internet of Things,’’ Int. J. Comput. Intell. Syst., vol. 12, no. 1,
The best reported result is 99.96% and the differences in the pp. 39–58, Nov. 2018.
number of nodes do not cause major changes in detecting [2] E. Kfoury, J. Saab, P. Younes, and R. Achkar, ‘‘A self organizing map
intrusion detection system for RPL protocol attacks,’’ Int. J. Interdiscipl.
malicious nodes. The proposed method for HF detection has Telecommun. Netw., vol. 11, no. 1, pp. 30–43, Jan. 2019.
successful compared to the existing and related studies (see [3] P. Pongle and G. Chavan, ‘‘Real time intrusion and wormhole attack
Table 1) using GRU deep learning method regardless of the detection in Internet of Things,’’ Int. J. Comput. Appl., vol. 121, no. 9,
pp. 1–9, Jul. 2015.
number of nodes. [4] A. Mayzaud, R. Badonnel, and I. Chrisment, ‘‘A taxonomy of attacks
MSE, MAE and RMSE values are less in most cases, in RPL-based Internet of Things,’’ Int. J. Netw. Secur., vol. 18, no. 3,
by about 0.01, 0.05 and 0.05 in three scenarios with two pp. 459–473, May 2016.
[5] X. Yuan, C. Li, and X. Li, ‘‘DeepDefense: Identifying DDoS attack via
feature sets, respectively. Based on a rule of thumb, it can deep learning,’’ in Proc. IEEE Int. Conf. Smart Comput. (SMARTCOMP),
be said that the lower the value, the better the performance of May 2017, pp. 1–8.

VOLUME 8, 2020 183687

 S. Cakir et al.: RPL Attack Detection and Prevention in the IoT Networks Using a GRU Based Deep Learning

[6] G. Thamilarasu and S. Chawla, ‘‘Towards deep-learning-driven intrusion [28] O. Brun, Y. Yin, J. Augusto-Gonzalez, M. Ramos, and E. Gelenbe, ‘‘IoT
detection for the Internet of Things,’’ Sensors, vol. 19, no. 9, p. 1977, attack detection with deep learning,’’ in Proc. ISCIS Secur. Workshop,
Apr. 2019. Londra, U.K., Feb. 2018, Art. no. 02062091.
[7] R. Khan, S. U. Khan, R. Zaheer, and S. Khan, ‘‘Future Internet: The [29] A. Seker, B. Diri, and H. Balik, ‘‘A review about deep learning methods
Internet of Things architecture, possible applications and key challenges,’’ and applications,’’ Gazi J. Eng. Sci., vol. 3, no. 3, pp. 47–64, 2017.
in Proc. 10th Int. Conf. Frontiers Inf. Technol., Dec. 2012, pp. 257–260. [30] M. A. Hamid, M. Rashid, and C. S. Hong, ‘‘Routing security in sensor
[8] A. Riahi Sfar, E. Natalizio, Y. Challal, and Z. Chtourou, ‘‘A roadmap network: Hello flood attack and defense,’’ in Proc. IEEE ICNEWS,
for security challenges in the Internet of Things,’’ Digit. Commun. Netw., Jan. 2006, pp. 2–4.
vol. 4, no. 2, pp. 118–137, Apr. 2018. [31] C. Karlof and D. Wagner, ‘‘Secure routing in wireless sensor net-
[9] H. Xie, Z. Yan, Z. Yao, and M. Atiquzzaman, ‘‘Data collection for security works: Attacks and countermeasures,’’ Ad Hoc Netw., vol. 1, nos. 2–3,
measurement in wireless sensor networks: A survey,’’ IEEE Internet pp. 293–315, Sep. 2003.
Things J., vol. 6, no. 2, pp. 2205–2224, Apr. 2019. [32] A. Perrig, R. Szewczyk, J. D. Tygar, V. Wen, and D. E. Culler, ‘‘SPINS:
[10] J. Kim, J. Lee, J. Kim, and J. Yun, ‘‘M2M service platforms: Survey, issues, Security protocols for sensor networks,’’ Wireless Netw., vol. 8, no. 5,
and enabling technologies,’’ IEEE Commun. Surveys Tuts., vol. 16, no. 1, pp. 521–534, Sep. 2002.
pp. 61–76, 1st Quart., 2014. [33] Keras Documentation: About Keras, Accessed: Jan. 11, 2020. [Online].
[11] E. J. Hui and P. Thubert, Compression Format for IPv6 Datagrams over Available: https://keras.io/about/
IEEE 802.15.4-Based Networks, document RFC 6282, Internet Requests [34] Y. Bengio, P. Simard, and P. Frasconi, ‘‘Learning long-term dependencies
for Comments, 2011, pp. 1–24. with gradient descent is difficult,’’ IEEE Trans. Neural Netw., vol. 5, no. 2,
[12] IEEE Standard for Local and Metropolitan Area Networks—Part 15.4: pp. 157–166, Mar. 1994, doi: 10.1109/72.279181.
Low-Rate Wireless Personal Area Networks (WPANs), Standard IEEE Std [35] S. Hochreiter and J. Schmidhuber, ‘‘Long short-term memory,’’ Neural
802.15.4-2011, M. Standards Committee of the IEEE Computer Society Comput., vol. 9, no. 8, pp. 1735–1780, 1997.
2006. [36] R. Fu, Z. Zhang, and L. Li, ‘‘Using LSTM and GRU neural network
[13] L. Bartolozzi, T. Pecorella, and R. Fantacci, ‘‘Ns-3 RPL module: IPv6 methods for traffic flow prediction,’’ in Proc. 31st Youth Academic Annu.
routing protocol for low power and lossy networks,’’ in Proc. 5th Int. Conf. Conf. Chin. Assoc. Autom. (YAC), Nov. 2016, pp. 324–328.
Simul. Tools Techn., 2012, pp. 359–366. [37] M. Nguyen. (2018).Illustrated Guide to LSTM’s and GRU’s: A Step
[14] A. L. Colina, A. Vives, A. Bagula, M. Zennaro, and E. Pietrosemoli. by Step Explanation. Accessed: Jan. 10, 2020. [Online]. Available:
(2015). IoT in 5 Days. BookSheet. [Online]. Available: http://wireless.ictp. https://towardsdatascience.com/illustrated-guide-to-lstms-and-gru-s-a-
it/school_2015/book/book.pdf step-by-step-explanation-44e9eb85bf21
[15] A. U. Gawade and N. Shekokar, ‘‘Lightweight secure RPL: A need in [38] G. Drakos. (2019). What is a Recurrent Neural Networks (RNNS)
IoT,’’ in Proc. Int. Conf. Inf. Technol., Dec. 2017, pp. 214–219, doi: 10. and Gated Recurrent Unit GRUS. Accessed: Jan. 10, 2020. [Online].
1109/ICIT.2017.31 Available: https://medium.com/@george.drakos62/what-is-a-recurrent-
[16] R. Singh, J. Singh, and R. Singh, ‘‘Hello flood attack countermeasures in nns-and-gated-recurrent-unit-grus-ea71d2a05a69
wireless sensor networks,’’ Int. J. Comput. Sci. Mobile Appl., vol. 4, no. 5, [39] C. C. Chatterjee. (2019). Implementation of RNN, LSTM, and GRU.
pp. 1–9, May 2016. Accessed: Jan. 10, 2020. [Online]. Available: https://towardsdatascience.
[17] V. PalSingh, A. S. A. Ukey, and S. Jain, ‘‘Signal strength based hello com/implementation-of-rnn-lstm-and-gru-a4250bf6c090
flood attack detection and prevention in wireless sensor networks,’’ Int. [40] S. Kostadinov. (2017). Understanding GRU Networks. Accessed:
J. Comput. Appl., vol. 62, no. 15, pp. 1–6, Jan. 2013. Jan. 13, 2020. [Online]. Available: https://towardsdatascience.com/
[18] T. Sherasiya, H. Upadhyay, and H. B. Patel, ‘‘A survey: Intrusion detection understanding-gru-networks-2ef37df6c9be
system for Internet of Things,’’ Int. J. Comput. Sci. Eng., vol. 5, no. 2, [41] Contiki. (2015). Contiki: The Open Source Operating System for the Inter-
pp. 91–98, 2016. [Online]. Available: http://www.iaset.us/view_archives. net of Things. Accessed: Jan. 15, 2020 [Online]. Available: http://www.
php?year=2016&id=14&jtype=2&page=2 contiki-os.org/
[19] V. P. Singh, S. Jain, and J. Singhai, ‘‘Hello flood attack and its [42] S. Raza, L. Wallgren, and T. Voigt, ‘‘SVELTE: Real-time intrusion
countermeasures in wireless sensor networks,’’ Int. J. Comput. Sci., vol. 7, detection in the Internet of Things,’’ Ad Hoc Netw., vol. 11, no. 8,
no. 11, p. 23, May 2010. pp. 2661–2674, Nov. 2013.
[20] A. Verma and V. Ranga, ‘‘Addressing flooding attacks in IPv6-based low [43] S. Toklu and O. Ayhan Erdem, ‘‘BSC-MAC: Energy efficiency in wireless
power and lossy networks,’’ in Proc. IEEE Region Conf. (TENCON), sensor networks with base station control,’’ Comput. Netw., vol. 59,
Oct. 2019, pp. 552–557, doi: 10.1109/TENCON.2019.8929409. pp. 91–100, Feb. 2014.
[21] H. I. Ahmed, A. A. Nasr, S. Abdel-Mageid, and H. K. Aslan, [44] A. Musaddiq, Y. B. Zikria, Zulqarnain, and S. W. Kim, ‘‘Routing protocol
‘‘A survey of IoT security threats and defenses,’’ Int. J. Adv. Comput. for low-power and lossy networks for heterogeneous traffic network,’’
Res., vol. 9, no. 45, pp. 325–350, Oct. 2019. [Online]. Available: EURASIP J. Wireless Commun. Netw., vol. 2020, no. 1, p. 21, Dec. 2020.
https://search.proquest.com/docview/2307941033?accountid=25074, doi: [45] N. Müller, P. Debus, D. Kowatsch, and K. Böttinger, ‘‘Distributed
10.19101/IJACR.2019.940088. anomaly detection of single mote attacks in RPL networks,’’ in Proc.
[22] H. Khosravi, I. Alzahra University, R. Azmi, and M. Sharghi, ‘‘Adaptive 16th Int. Joint Conf. e-Bus. Telecommun., vol. 2, 2019, pp. 378–385, doi:
detection of hello flood attack in wireless sensor networks,’’ Int. J. Future 10.5220/0007836003780385.
Comput. Commun., vol. 5, no. 2, pp. 99–103, 2016.
[23] T. Sherasiya and H. Upadhyay, ‘‘Intrusion detection system for Internet
of Things,’’ Int. J. Advance Res. Innov. Ideas Edu., vol. 2, no. 3,
pp. 2244–2349, 2016.
[24] P. Kasinathan, C. Pastrone, M. A. Spirito, and M. Vinkovits, ‘‘Denial- SEMIH CAKIR was born in Zonguldak, Turkey,
of-service detection in 6LoWPAN based Internet of Things,’’ in Proc. in 1986. He received the B.S. degree (Hons.) in
IEEE 9th Int. Conf. Wireless Mobile Comput., Netw. Commun. (WiMob), computer and instructional teacher education from
Oct. 2013, pp. 600–607. Anadolu University, Eskisehir, in 2010, and the
[25] S. Shamshirband, N. B. Anuar, M. L. M. Kiah, V. A. Rohani, D. Petkovic, M.S. degree in computer engineering from Bilecik
S. Misra, and A. N. Khan, ‘‘Co-FAIS: Cooperative fuzzy artificial immune
Seyh Edebali University, Bilecik, Turkey, in 2012.
system for detecting intrusion in wireless sensor networks,’’ J. Netw.
He is currently pursuing the Ph.D. degree in
Comput. Appl., vol. 42, pp. 102–117, Jun. 2014, doi: 10.1016/j.jnca.2014.
03.012.
electrical, electronics, and computer engineering
[26] S. Shamshirband, A. Amini, N. B. Anuar, M. L. Mat Kiah, Y. W. Teh, with Düzce University, Düzce, Turkey. From
and S. Furnell, ‘‘D-FICCA: A density-based fuzzy imperialist competitive 2012 to 2017, he worked as an Instructor at
clustering algorithm for intrusion detection in wireless sensor networks,’’ Amasya University, Amasya, Turkey. Since 2017, he has been an Instructor
Measurement, vol. 55, pp. 212–226, Sep. 2014. and an Assistant Director of the Kdz. Eregli Vocational School, Zonguldak
[27] I. N. Aizenberg, N. N. Aizenberg, and J. Vandewalle, ‘‘Multiple-Valued Bulent Ecevit University. His research interests include the Internet of
threshold logic and multi-valued neurons,’’ in Multi-Valued Universal Things, cyber security, computer networks, deep learning, cloud computing,
Binary Neurons. Boston, MA, USA: Springer, 2000, pp. 25–80. and programming languages at the undergraduate degree.

183688 VOLUME 8, 2020

S. Cakir et al.: RPL Attack Detection and Prevention in the IoT Networks Using a GRU Based Deep Learning

SINAN TOKLU was born in Adana, Turkey, NESIBE YALCIN was born in Yozgat, Turkey,
in 1979. He received the B.Sc. degree in com- in 1987. She received the B.S. (Hons.) and M.S.
puter engineering from Eastern Mediterranean degrees in computer engineering from Selcuk
University in 2004, and the M.Sc. degree in University, Konya, in 2009 and 2012, respectively,
computer engineering and the Ph.D. degree in and the Ph.D. degree in computer and information
electrical–electronics education from Gazi Univer- engineering from Sakarya University, Turkey,
sity, Ankara, Turkey, in 2007 and 2013, respec- in 2017. From 2011 to 2017, she worked as
tively. From 2007 to 2010, he worked as Research a Research Assistant at Bilecik Seyh Edebali
Assistant at Gazi University. From 2010 to 2014, University, Turkey. Since 2018, she has been
he worked as a Software Developer at TEİAŞ, an Assistant Professor and the Co-Chair of the
Turkey. Since 2014, he has been an Assistant Professor with the Department Department of Computer Engineering, Bartın University. Her teaching areas
of Computer Engineering, Düzce University. His research interests include are, but not limited to, machine learning, artificial neural networks, data
the Internet of Things, WSN, deep learning, and smart city. mining, and heuristic optimization algorithms at both under and postgraduate
levels. Her research interests include the Internet of Things, artificial
intelligence applications, and mathematical modeling and simulation.

VOLUME 8, 2020 183689