A Leakage-Safe Re-evaluation of Machine-Learning Intrusion Detection for RPL-Based IoT Networks

This is the authors' abstract. We don't add key points for this paper.

The Internet of Things (IoT) faces serious security challenges that limit its use in robotics and automation. Attackers try to disrupt network activity, alter sensitive data, and steal information. Conventional Intrusion Detection Systems (IDS) are hard to run in the resource-limited settings of IoT. This paper reports a leakage-safe re-evaluation of machine-learning IDS for RPL-based IoT networks, using the ROUT-4-2023 dataset. We first show that the very high accuracies commonly reported on this dataset are inflated by two evaluation problems. First, about 90% of the rows share identical behavioural feature values, so a random train/test split places near-identical rows in both sets. Second, standard splits ignore temporal drift within each simulation run. Under a leakage-safe protocol, using deduplication, out-of-fold stacking, and a held-out test set, our stacked DNN meta-classifier reaches about 83% accuracy on a random split and about 67% (multiclass) and 73% (binary) on a realistic temporal split. We then study which techniques genuinely improve these honest numbers. Replacing the unsupervised IPCA feature-selection step with label-aware feature selection gives the largest same-setting gain, raising temporal-split accuracy to about 86% (multiclass) and 88% (binary). We also report techniques that do not help, including deeper meta-classifiers, wider hyperparameter search, and unsupervised anomaly detection. Finally, we show a key limitation. When a detector is trained on some attack types and tested on an unseen attack type, accuracy collapses to near chance for every method tested. These results give a more realistic picture of ML-based RPL intrusion detection and a protocol for evaluating it honestly.