Rethinking IoT Intrusion Detection: Augmenting Routing Metrics with Radio Features
For IoT security researchers, this work provides a modest improvement by augmenting existing routing features with radio features, but the gain is incremental.
The paper investigates whether adding radio-layer features (TX/RX) to routing-layer features improves intrusion detection in RPL-based IoT networks using an LSTM-based IDS. Results show up to ~4% improvement in F1-score, with the largest gain for the Worst Parent attack.
Machine learning-based intrusion detection systems (IDS) for RPL-based IoT networks often rely solely on routing layer features, which provide only a partial view of network behaviour. In this work, we investigate whether incorporating Transmit (TX) and Receive (RX) radio features alongside the standard RPL feature set can improve detection performance in an LSTM-based IDS. We evaluate the proposed approach across three different attack types, namely DIS-Flooding, Local Repair, and Worst Parent under varying network sizes. The results show that incorporating TX and RX improves the IDS's overall detection performance by up to ~4% in F1-score compared with using routing-layer features alone, with the most notable gain observed for the Worst Parent attack.