💻 computer science

Rethinking IoT Intrusion Detection: Augmenting Routing Metrics with Radio Features

This paper demonstrates that augmenting standard RPL routing features with Transmit and Receive radio metrics significantly enhances the F1-score of an LSTM-based intrusion detection system for IoT networks, particularly in detecting Worst Parent attacks.

Original authors: Yichang Sun, Andreas Johnsson, Sourasekhar Banerjee

Published 2026-06-08

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yichang Sun, Andreas Johnsson, Sourasekhar Banerjee

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a smart city where hundreds of tiny, battery-powered devices (like smart thermostats or sensors) talk to each other to keep everything running smoothly. They use a special language called RPL to decide who talks to whom and how to send messages. This is the "routing" layer.

However, bad actors (hackers) can trick these devices into making bad decisions, causing traffic jams or draining their batteries. To stop them, we need a security guard, or an Intrusion Detection System (IDS), that watches the network and shouts, "Something is wrong!"

The Old Way: Listening Only to the "Traffic Report"

Previously, security guards only listened to the routing traffic. Imagine a traffic cop standing at a busy intersection, only counting how many cars pass through and what signs they hold up.

The Problem: If a hacker tricks the cars into taking a weird route, the cop sees the weird signs and knows something is up. But sometimes, the hacker is subtle. They might not change the signs much, but they are making the cars rev their engines loudly or honk excessively. The traffic cop, who is only looking at the signs, misses these clues.

The New Idea: Listening to the "Engine Noise"

This paper proposes a smarter security guard. Instead of just watching the traffic signs (routing data), the guard also puts on headphones to listen to the radio features—specifically, how much the devices are Transmitting (TX) (sending out signals) and Receiving (RX) (listening to signals).

Think of it like this:

Routing Features (The Old Way): Watching a car's speedometer and GPS.
Radio Features (The New Way): Listening to the engine revving and the radio static.

The researchers asked: If we teach our security guard to listen to both the GPS and the engine noise, will they catch the bad guys better?

How They Tested It

They built a digital simulation of a network with 5 to 20 devices. They taught a computer brain (called an LSTM, which is great at spotting patterns over time) to spot three specific types of hackers:

DIS-Flooding: Shouting so loudly everyone else has to shout back.
Local Repair: Constantly trying to fix a broken road that isn't actually broken.
Worst Parent: Trickery where a device pretends to be a helpful leader but is actually leading everyone into a trap.

They ran the simulation many times, sometimes with just the "traffic signs" (routing data) and sometimes with the "engine noise" (TX/RX data) added in.

What They Found

The results were clear: Adding the "engine noise" made the security guard much sharper.

The Big Win: When they added the radio features (TX and RX), the system's ability to catch hackers improved by about 4% overall.
The Best Detective: The "engine noise" was especially good at catching the Worst Parent attack. This is because that attack is very sneaky; it doesn't change the traffic signs much, but it does make the devices transmit and receive data strangely. The old system missed it; the new system caught it easily.
The Star Player: Interestingly, the Receive (RX) feature was the most important. It's like the security guard realizing that listening to what others are saying to a device is a bigger clue than what the device is saying itself.

The Takeaway

The paper concludes that by combining the "traffic signs" (routing data) with the "engine noise" (radio activity), we get a much more complete picture of what's happening in the network. It's like upgrading a security system from just checking IDs at the door to also checking if the person is sweating nervously or breathing heavily.

In short: To catch tricky hackers in IoT networks, don't just look at where the data is going; listen to how hard the devices are working to send and receive it.

Technical Summary: Rethinking IoT Intrusion Detection with Radio Features

Problem Statement
Machine learning-based Intrusion Detection Systems (IDS) for RPL-based IoT networks have traditionally relied exclusively on routing-layer features (e.g., RPL control message statistics like Rank, DIO, DIS, and DAO). The authors argue that this routing-centric view provides only a partial representation of network behavior. While previous studies have shown that RPL-oriented denial-of-service attacks significantly impact device-level resource consumption and radio activity (transmit/receive signals, CPU time, power), existing IDS models often fail to capture these lower-layer indicators. Consequently, the detection performance of current models remains sensitive to specific attack types, topologies, and network sizes, potentially missing subtle attacks that manipulate routing decisions without drastically altering control message volumes.

Methodology
The paper proposes an augmentation of the standard RPL feature set by incorporating node-level Transmit (TX) and Receive (RX) radio features. The study utilizes an LSTM-based classifier designed to capture temporal dependencies in sequential network data.

System Model: The framework simulates an RPL-based IoT network with a sink node, normal nodes forming a DODAG, and a single attacker. The sink passively aggregates two categories of features:
1. RPL Features (14 dimensions): Mean and standard deviation of seven routing-layer statistics (Rank, DIS sent/received, DIO sent/received, DAO received, and total messages).
2. Radio Features (4 dimensions): Mean and standard deviation of TX and RX activity counts.
Feature Augmentation: The baseline vector ( $x^RPL_t$ ) is concatenated with radio features to form an augmented vector ( $x^{aug}_t$ ), increasing the input dimension from 14 to 18.
Experimental Setup: The authors extended simulation scripts from Cooja/Contiki-NG to extract radio logs. They evaluated the approach across:
- Three Attack Types: DIS-Flooding, Local Repair, and Worst Parent.
- Three Behavioral Variants: Base, on-off, and gradual change.
- Four Network Sizes: 5, 10, 15, and 20 nodes.
- Total Configurations: 36 distinct experimental setups (3 attacks × 3 variants × 4 sizes).
Model Architecture: A binary classification LSTM model (hidden size 10, dropout 0.3) trained with binary cross-entropy loss and the AdamW optimizer. Input sequences were generated using a sliding window of size 10.

Key Contributions

Feature Expansion: The work extends the baseline RPL feature set by integrating TX and RX radio features, aiming to capture node-level communication behavior invisible to routing-layer statistics alone.
Ablation Study: The authors systematically compare five feature configurations (RPL-only, TX+RX-only, RPL+TX, RPL+RX, and Full Augmented) to isolate the discriminative power of radio features.
Comprehensive Evaluation: The study assesses the impact of these features across diverse attack behaviors and network scales, providing a granular view of how radio metrics influence detection performance.

Results
The evaluation, measured by F1-score, reveals that incorporating radio features generally improves detection performance, though the magnitude of improvement varies by attack type:

Overall Performance: The inclusion of TX and RX features improved the overall detection performance by up to approximately 4% in F1-score compared to using routing-layer features alone.
Attack-Specific Findings:
- DIS-Flooding: All configurations performed highly (F1 > 0.98). The TX+RX-only configuration achieved the highest score (0.990), suggesting the attack induces strong, consistent changes in both routing and radio activity.
- Local Repair: The TX+RX-only configuration significantly outperformed the RPL-only baseline (0.999 vs. 0.980). The study notes that removing RX caused a larger performance drop than removing TX, indicating RX is the more critical feature for detecting the burst of control messages generated by DODAG reconstruction cycles.
- Worst Parent: This attack showed the most notable gain from radio features. The RPL-only baseline yielded a low F1-score of 0.957, while the TX+RX-only configuration achieved 0.998. The full 18-feature set (0.970) performed worse than the radio-only set, suggesting that for this specific attack, RPL features may introduce redundancy or that the attack's impact is primarily visible in radio activity rather than control message statistics.
Feature Separability: Kolmogorov–Smirnov (KS) statistics confirmed that RX mean features achieved perfect separation (KS = 1.000) between normal and attack distributions across all attack types, while TX mean features also showed strong separation (KS 0.837–0.896).

Significance and Claims
The paper claims that relying solely on routing-layer features provides an incomplete view of attack impact, particularly for attacks like "Worst Parent" that subtly manipulate routing decisions. By demonstrating that TX and RX features provide discriminative signals not captured by RPL statistics, the authors argue that cross-layer approaches are essential for robust IDS in constrained IoT environments.

Specifically, the results indicate that receiver-side communication activity (RX) is a more discriminative signal than transmit activity (TX) for RPL-based attack detection. The authors modestly conclude that while their approach improves performance, future work is required to incorporate additional metrics (RSSI, LQI), conduct formal feature importance analysis, and evaluate the cross-attack generalizability of the trained models. The work does not claim to solve all detection challenges but highlights the tangible value of augmenting routing metrics with radio features in the current experimental pipeline.