BEHAVIORAL AND TEMPORAL FACTORS IN MALICIOUS-NODE DETECTION FOR RPL-BASED 6LoWPAN NETWORKS: A CONTROLLED SYNTHETIC STUDY

This controlled synthetic study examines how forwarding evidence, topology-oriented evidence, temporal context, and classifier choice influence malicious-node identification in RPL-oriented 6LoWPAN settings. Node behavior is characterized using inter-arrival time, packet forwarding ratio, rank inconsistency, and parent change rate. Thirty paired runs are conducted with 600 independent node profiles and 20 observations per profile, using a common decision horizon and one test prediction per node. CNN-LSTM mean F1-score increases from 72.01 ± 7.57% with a single observation to 89.11 ± 4.64% with four observations and 94.84 ± 3.09% with eight observations. The improvement from four to eight observations is significant in the main experiment but not under later attack activation, indicating that the benefit of longer behavioral histories depends on attack timing. At four observations, Random Forest achieves a mean F1-score of 92.72 ± 2.59%, compared with 89.11 ± 4.64% for CNN-LSTM, although this advantage is not consistently reproduced across sensitivity scenarios. Combining forwarding and topology evidence significantly improves performance over forwarding evidence alone and remains robust across all sensitivity analyses. Attack-specific recall reaches 100.00% for blackhole, 79.33% for selectiveforwarding, and 76.67% for the wormhole-like topology-anomaly profile. > These findings characterize behavioral observability within the controlled generator rather than operational RPL detection rates and motivate subsequent validation using packet- and topology-level traces.