A Multiclass Machine Learning Framework for Detecting Routing Attacks in RPL-Based IoT Networks Using a Novel Simulation-Driven Dataset

Abstract

The use of resource-constrained Low-Power and Lossy Networks (LLNs), where the IPv6 Routing Protocol for LLNs (RPL) is the de facto routing standard, has increased due to the Internet of Things’ (IoT) explosive growth. Because of the dynamic nature of IoT deployments and the lack of in-protocol security, RPL is still quite susceptible to routing-layer attacks like Blackhole, Lowered Rank, version number manipulation, and Flooding despite its lightweight architecture. Lightweight, data-driven intrusion detection methods are necessary since traditional cryptographic countermeasures are frequently unfeasible for LLNs. However, the lack of RPL-specific control-plane semantics in current cybersecurity datasets restricts the use of machine learning (ML) for practical anomaly identification. In order to close this gap, this work models both static and mobile networks under benign and adversarial settings by creating a novel, large-scale multiclass RPL attack dataset using Contiki-NG’s Cooja simulator. To record detailed packet-level and control-plane activity including DODAG Information Object (DIO), DODAG Information Solicitation (DIS), and Destination Advertisement Object (DAO) message statistics along with forwarding and dropping patterns and objective-function fluctuations, a protocol-aware feature extraction pipeline is developed. This dataset is used to evaluate fifteen classifiers, including Logistic Regression (LR), Support Vector Machine (SVM), Decision Tree (DT), k-Nearest Neighbors (KNN), Random Forest (RF), Extra Trees (ET), Gradient Boosting (GB), AdaBoost (AB), and XGBoost (XGB) and several ensemble strategies like soft/hard voting, stacking, and bagging, as part of a comprehensive ML-based detection system. Numerous tests show that ensemble approaches offer better generalization and prediction performance. With overfitting gaps less than 0.006 and low cross-validation variance, the Soft Voting Classifier obtains the greatest accuracy of 99.47%, closely followed by XGBoost with 99.45% and Random Forest with 99.44%.

1. Introduction

One of the most revolutionary technological paradigms of the modern era is the Internet of Things, which allows billions of smart devices installed in smart homes, healthcare, industrial automation, transportation, agriculture, and large-scale urban infrastructures to be pervasively connected. With the help of sensors, actuators, and embedded intelligence, these devices continually gather, process, and share data to facilitate autonomous operations and real-time decision making. Interoperability frameworks like IPv6 over Low-Power Wireless Personal Area Networks (6LoWPAN), which provide effective header compression and adaptation procedures suited for resource-constrained situations, have become essential to enabling smooth communication among such restricted devices. The RPL is the de facto IPv6 routing standard for distributed IoT deployments, built on top of 6LoWPAN. To enable scalable many-to-one routing with low energy consumption, RPL builds a Destination-Oriented Directed Acyclic Graph (DODAG) using ICMPv6 control messages DIO, DIS, DAO, and DAO-ACK [1]. However, because of its lightweight architecture, it is naturally susceptible to manipulation by adversaries. Because RPL prioritizes low overhead above robust in-protocol security measures, the routing layer is vulnerable to a variety of attacks, including Flooding, wormhole assaults, version number manipulation, reduced rank, Blackhole/Sinkhole attacks, and selective forwarding. The reliability and continuity of IoT operations are severely threatened by these attacks, which can disrupt topology stability, change parent selection, deteriorate packet delivery, and even disconnect parts of the network [2].

Because Low-Power and Lossy Networks (LLNs) have limited processing power, memory, and battery life, traditional cryptographic countermeasures are frequently inappropriate for them. Because of this, anomaly-based intrusion detection methods, especially those based on machine learning (ML), have become popular as lightweight substitutes that can spot minute variations in routing behavior. Early identification of persistent routing attacks is made possible by machine learning’s ability to examine correlations between RPL control messages, packet-forwarding statistics, and topological changes. Nevertheless, despite its potential, a major obstacle to ML-based intrusion detection for RPL is the lack of practical, protocol-specific datasets. Key RPL semantics, such as objective-function dynamics, control-plane behavior, energy patterns, and LLN mobility effects, are absent from well-known cybersecurity datasets like KDDCUP99 [3], NSL-KDD [4], CICIDS [5], and TON_IoT [6], which concentrate on traditional Internet traffic. In the past, the use of machine learning models was investigated for Blackhole attack detection on small-scale simulated RPL networks [7]. Although this early research showed ML’s potential for LLN security, its reach was restricted to specific attack types and rather small datasets. By creating a fresh, large-scale, multi-attack RPL dataset and creating an extensive multiclass learning framework that can simultaneously identify multiple major routing assaults, our study builds on these foundations and greatly expands the scope and depth of analysis.

By simulating both static and mobile RPL networks under five traffic states, benign, Blackhole, Lowered Rank, version number manipulation, and Flooding attacks, this work creates a comprehensive dataset using the Cooja simulator (Contiki-NG). A unique Python-based log-parsing pipeline is used to extract extensive protocol-level and network-level information for every simulation instance, including DIO, DIS, DAO counts, packet-delivery statistics, forwarding patterns, control overhead, convergence time, and changes in the objective function. This dataset is then used to construct a unified multiclass classification framework that integrates both conventional machine learning models and advanced ensemble learning techniques to systematically evaluate their effectiveness in detecting routing-layer anomalies in RPL-based IoT networks.

It is important to emphasize that the primary objective of this work is to evaluate the upper-bound capability of machine learning-based intrusion detection when rich protocol-level RPL semantics are fully observable within a controlled simulation environment. Such an evaluation is essential for understanding intrinsic attack separability, feature relevance, and the discriminative power of protocol-aware signals. However, real-world IoT deployments may introduce additional challenges, including environmental noise, heterogeneous hardware platforms, partial or stealthy attack behaviors, and adversarial adaptation, all of which can reduce detection performance. Accordingly, this study aims to establish a reproducible analytical baseline and systematic evaluation framework for RPL security research, rather than to claim immediate real-world deployment readiness.

Main Contributions

The main contributions of this paper are summarized as follows:

• Novel Multi-Attack RPL Dataset: Extensive Cooja simulations are used to create a new dataset that captures benign traffic as well as the four main RPL attacks, namely Blackhole, Lowered Rank, version number manipulation, and Flooding in both static and mobile contexts.
• Protocol-Aware Feature Engineering: In order to provide a comprehensive picture of RPL network activity, a Python-based parsing engine extracts rich protocol-level and packet-level characteristics such RPL control messages, packet reception/forwarding/dropping rates, convergence time, and control overhead.
• Comprehensive Multiclass Detection Framework: For reliable multiclass attack prediction, the proposed framework evaluates a comprehensive suite of classifiers, including Logistic Regression, Support Vector Machine, Decision Tree, Random Forest, Gradient Boosting, eXtreme Gradient Boosting, Adaptive Boosting, K-Nearest Neighbors, and Extra Trees, along with advanced ensemble techniques such as Voting Ensemble, Stacking Ensemble, and Bagging Ensemble.
• Standardized Preprocessing and Evaluation: The framework incorporates label encoding, feature scaling, stratified train–test division, and k-fold cross-validation. Performance is assessed using accuracy, precision, recall, weighted $F_1$ score, and overfitting-gap analysis to evaluate generalization.
• End-to-End IDS Pipeline: A fully automated ML-based intrusion detection workflow is implemented from dataset construction to training, evaluation, and model ranking, providing a reproducible baseline for RPL security research.

2. Related Work

Due to the limitations of LLN devices and the lack of robust in-protocol protection measures in RPL, the security of 6LoWPAN-based IoT networks continues to be a significant research problem. According to RFC 6550 [8], RPL is very vulnerable to manipulation, rank inconsistencies, and malicious topology advertisement because it mainly depends on ICMPv6 control messages (DIS, DIO, DAO, DAO-ACK) for topology formation and maintenance. As a result, a substantial amount of research on routing attack detection, mitigation, and machine learning-based analysis in RPL-enabled IoT networks has surfaced. The changing RPL security landscape has been mapped by a number of review and survey studies. Al-Amiedy et al. [9] offered in-depth assessments of deep learning and machine learning techniques for identifying RPL attacks, highlighting the challenge of developing scalable IDS solutions for restricted nodes and the absence of standardized datasets. Similar studies of RPL vulnerabilities, attack taxonomies, and mitigation strategies were conducted by Avila et al. [10] and Choudhary et al. [11]. These studies highlighted recurring limitations in previous research, most notably (i) small topology sizes, (ii) narrow attack coverage, and (iii) lack of mobility or objective-function variations. Together, these surveys highlight a crucial research gap that still exists: the requirement for practical, protocol-aware datasets that can facilitate multiclass RPL intrusion detection.

The majority of detection systems rely on simulation-generated traces because there are no publicly accessible RPL datasets. Kfoury et al. [12] classified rank and Blackhole attacks using a self-organizing-map intrusion detection system, although the dataset was small and did not enable mobility. An ML-based model for identifying rank and wormhole assaults using Cooja-generated data was proposed by Zahra et al. [13], although it was limited to two attack types and did not investigate multiclass categorization. A trust-based method for detecting combined rank and Blackhole assaults was presented by Ioulianou et al. [14], although their model was not optimized for dynamic node mobility and needed extra hardware support. Despite their significance, these efforts are usually limited to binary or dual-attack detection, which limits their relevance to real-world IoT deployments where several forms of attacks may coexist. RPL protection based on deep learning has also drawn interest. Sawafi et al. [15] developed a hybrid DL IDS that targets rank and wormhole assaults, while Deepavathi et al. [16] introduced DLP4DA-RPL, a DL-based system for detecting DIO/DAO manipulation. Even though these models perform well, they need a lot of training data, use a lot of memory, and frequently have poor generalization because there are not many different types of RPL datasets. Because of this, DL techniques are difficult to implement in real-world scenarios where battery limits and computing cost must be minimized.

More targeted or cross-layer IDS systems have been investigated by other researchers. A cross-layer intrusion detection system that addresses Sinkhole and rank attacks was proposed by Canbalaban et al. [17]. Although their work shows protocol awareness, it is nevertheless constrained by its modest topological size and absence of mobility modeling. Mehmood [18] did not build an IDS, but he did emphasize the Cooja simulator’s potential for producing repeatable IoT traffic and performance data. With an emphasis on enhancing routing quality rather than identifying intrusions, Lmkaiti et al. [19] examined safe RPL routing through metaheuristic optimization. Current general-purpose IoT datasets, such as ToN_IoT [20], UNSW-NB15, and CICIDS, provide extensive traffic traces but are not useful for protocol-level attack detection since they do not contain RPL control-plane communications. Several studies closest to this work are the authors’ earlier contributions. In refs. [2,7], Blackhole attack behavior was analyzed and an SVM-based binary classifier was developed for small LLN topologies. While demonstrating the feasibility of ML for RPL security, these studies were limited to a single attack type, lacked multiclass capability, and did not incorporate mobility, objective-function variation, or multi-topology datasets.

Table 1. Comparative analysis of related works on RPL attack detection.

Ref.	Dataset Type	Simulator/ Source	Topology Size	Attacks Considered	Accuracy/ Result	Limitation/Research Gap
[12]	Self-generated	Cooja	10–20 nodes	Rank, Blackhole	92–96%	No mobility; limited attack set; SOM-based IDS difficult to scale
[13]	Self-generated	Cooja	15–30 nodes	Rank, Wormhole	94.5%	Only two attacks; no multiclass capability; no mobility
[14]	Simulation	Cooja + Trust Metrics	20 nodes	Rank, Blackhole	95% (trust accuracy)	Requires additional hardware support; not ML-based; no mobility
[16]	Self-generated	Cooja	15 nodes	DIO/DAO manipulation	Up to 98%	High DL overhead; limited topology size; no multiclass dataset
[15]	Self-generated	Cooja	25 nodes	Rank, Wormhole	95–97%	High DL complexity; limited feature diversity; no mobility
[17]	Simulation	Cooja	12 nodes	Sinkhole, Rank	Not clearly reported	Limited scalability; binary detection; no mobility
[19]	Simulation	Contiki-NG	Variable	Various routing attacks	Routing improvement	Focuses on mitigation; does not perform IDS or ML-based detection
[11]	Self-generated	Cooja	Variable	IoT anomaly traffic	97%	Not RPL-specific; lacks routing-layer semantics
[20]	Existing dataset (ToN_IoT)	Real IoT testbed	Large-scale	Generic IoT attacks	Benchmark dataset	No RPL control-plane data; unsuitable for RPL attack detection
[7]	Self-generated	Cooja	20 nodes	Blackhole	87%	Binary classification only; no mobility; single attack
[21]	Self-generated/Logs	5G Testbed	Not topology-based	DDoS (Healthcare IoT)	High detection rate (TCN)	Not RPL-specific; targets 5G networks; no routing semantics
[22]	Self-generated	Cooja	15–25 nodes	Rank, Version Number	Routing stability improved	Uses protocol modifications; not ML-based; limited attacks
[23]	Self-generated	Cooja	50 nodes (AMI-IoT)	Rank, Blackhole, Wormhole, Sybil	High accuracy (Ensemble IDS)	Blockchain + ensemble overhead; high computation for LLN nodes
[24]	Survey/Review	Multiple sources	Not applicable	RPL attack taxonomy	Comprehensive review	No dataset or IDS implementation
[25]	Self-generated	Cooja (Spec-based IDS)	10–20 nodes	DIS, DIO manipulation	Effective rule-based detection	Rule-based only; limited scalability; no learning capability
[26]	Self-generated	Cooja	30 nodes	Rank, Blackhole, Selective Forwarding	High accuracy	Limited attack coverage; not multiclass; no mobility
[27]	Self-generated	Cooja	25 nodes	Flooding (Inundation)	Lightweight mitigation	Focuses on mitigation; no ML-based detection; single attack
Proposed Work	Self-generated (Multiclass)	Cooja	20+ nodes	Benign, Blackhole, Decreased Rank, Version Number, Flooding	99.47%	Simulation-based evaluation; real-world testbed validation identified as future work

provides a comparative summary of existing RPL attack detection approaches and highlights the research gaps addressed by the proposed study. Most prior works focus on single or binary attack scenarios, rely on small static topologies, or employ rule-based or protocol-modification approaches that lack generalization capability. Several machine learning-based studies report promising accuracy but remain limited by narrow attack coverage, absence of mobility modeling, or lack of rigorous overfitting and generalization analysis. In contrast, the proposed work introduces a protocol-aware, multiclass intrusion detection framework evaluated on a large, self-generated dataset encompassing both static and mobile RPL networks. Unlike existing approaches, the framework jointly analyzes multiple routing attacks using ensemble learning, incorporates extensive generalization and statistical significance analysis, and emphasizes interpretability through feature-importance evaluation. While the current evaluation is simulation-based, the proposed dataset and end-to-end methodology establish a comprehensive and reproducible baseline for future real-world RPL security research.

3. Methodology

The entire process required to design, develop, and assess the suggested multiclass attack detection framework for RPL-based IoT networks is described in the methodology utilized in this work. The method covers the entire process, starting with building a realistic network model, simulating various hostile and operational scenarios, and methodically gathering protocol-level traffic traces. The development of datasets, feature extraction, and labeling necessary for machine learning are based on these gathered traces. After that, a thorough preprocessing pipeline is used, and a variety of ensemble-based and classical models are created and trained for multiclass attack classification. A different test dataset and a number of reliable evaluation measures are then used to evaluate the trained models’ performance. The stages involved in this methodology collectively form an integrated pipeline that enables accurate detection and classification of routing attacks in RPL networks, and each phase is detailed in the subsections that follow.

3.1. Network Modeling and Scenario Design

The Cooja network simulator running on the Contiki operating system was used in a number of controlled simulations to produce the various traffic patterns needed for multiclass RPL attack detection. Cooja was selected for modeling IoT deployments under both benign and aggressive scenarios because it can mimic real sensor hardware, replicate low-power wireless communication behavior, and natively support the RPL Routing Protocol. Contiki-NG was used to run the simulations on an Oracle VirtualBox system with 8 GB of RAM and 1 TB of disk space. Every simulated node functioned as a Z1 mote, accurately simulating radio settings, memory, computation, and power consumption. Building baseline benign topologies was the first step in the network modeling approach.

To obtain representative network behaviors for multiclass attack detection, several controlled topologies were designed. The first category consisted of small-scale deployments using 11 nodes, whereas the second category comprised larger and more heterogeneous 21-node networks. Each topology incorporated one sink (root) node, while the remaining motes acted as RPL clients generating upward traffic toward the DAG root. For every network size, two variants were created: (1) a benign configuration without any adversarial behavior, and  (2) an attack-injected configuration containing malicious nodes. Furthermore, mobility was introduced in selected topologies to simulate dynamic low-power IoT environments. The mobility-enabled scenarios were crucial for observing how routing inconsistencies evolve when nodes periodically change their position, thereby influencing link stability and triggering RPL reconfigurations. Figure 1 illustrates the six simulation scenarios used for dataset construction. A server in the topology is the yellow-colored nodes, attaker is the pink-colored node, and the remianing green-colored nodes are all client nodes. The first row presents the 11-node networks under benign, attack-injected, and mobile conditions. The second row presents analogous scenarios for the larger 21-node topologies. These visual depictions highlight differences in link density, routing convergence, and parent selection factors that influence packet transmission patterns and are captured later during the feature extraction phase.

3.2. RPL Network Models and Attack Behaviors

Routing Protocol for Low-Power and Lossy Networks (RPL) creates a Destination-Oriented Directed Acyclic Graph (DODAG) to support multi-hop routing in constrained IoT deployments. Under normal operation, nodes periodically exchange DIO, DAO, and DIS messages to compute ranks, select parents, and maintain routing stability. However, the openness of RPL and its lack of strict authentication mechanisms make it vulnerable to several control-plane and data-plane attacks. In this work, four high-impact routing attacks Blackhole, Decreased Rank, DODAG Version/Consistency Manipulation, and Flooding are simulated to generate a comprehensive dataset for multiclass attack detection. The attack behavior is emulated in the Cooja simulator by modifying core RPL routines and control-message processing functions in Contiki-NG. Each attack scenario is executed on both 11-node and 21-node topologies under static and mobile conditions. The following subsections describe the attack models and present the corresponding pseudocode used to realize these behaviors in the simulation environment.

(1) 

Blackhole Attack Model

The Blackhole attack targets the data-forwarding plane. A malicious node advertises itself as an optimal parent by responding to route requests with highly favorable metrics. Once selected by neighboring nodes, the attacker drops all forwarded data packets, creating routing voids and significant packet loss, represented in Algorithm 1.

Topology Effects:

• Legitimate nodes reroute their traffic through the malicious parent.
• All multi-hop packets entering the attacker are silently dropped.
• Severe reliability degradation and subtree disconnection occur.

Algorithm 1 Blackhole attack pseudocode

1: Input: Incoming RREQ packets 2: Output: Dropped data packets, false route advertisement 3: Initialize malicious_node 4: while network is active do 5:     for each received RREQ do 6:         Create fake RREP with: 7:             – Very high sequence number 8:             – Minimal hop count 9:         Send fake RREP to the source 10:     end for 11:     for each received data_packet do 12:         Drop data_packet                  ▷ Optional: forward few packets to avoid detection 13:     end for 14: end while

(2) 

Decreased Rank Attack Model

The Decreased Rank attack compromises RPL’s topology construction logic by advertising a manipulated, unusually low rank. Because RPL prefers parents with minimal rank, neighboring nodes switch to the attacker, forming large, unstable subtrees rooted at the malicious node, represented in Algorithm 2.

Topology Effects:

• Widespread parent switching and DODAG instability.
• Formation of routing loops due to invalid low ranks.
• Congestion and increased control traffic from frequent repairs.

Algorithm 2 Decreased Rank attack pseudocode

1: Input: DIO messages from neighbors 2: Output: Fake low-rank advertisements 3: Initialize malicious_node 4: while network is active do 5:     for each received DIO do 6:         Extract legitimate_rank 7:         fake_rank ← legitimate_rank $-\mathsf{\Delta }$ 8:         if fake_rank < minimum_rank then 9:            fake_rank ← minimum_rank 10:         end if 11:         Broadcast modified DIO containing fake_rank 12:     end for 13: end while

(3) 

DODAG Version/Consistency Attack Model

The DODAG Inconsistency attack manipulates RPL control fields, particularly the DODAG version number and the rank/metric consistency parameters in DIO or DAO messages. By artificially increasing the version number or injecting invalid routing information, the attacker triggers repeated global repairs, represented in Algorithm 3.

Topology Effects:

• Continuous parent reselection and unsteady routing tables.
• Surge in control traffic due to repeated DIO broadcasts.
• Elevated network energy consumption.

Algorithm 3 DODAG Inconsistency attack pseudocode

1: Input: DIO and DAO control messages 2: Output: Routing instabilities, parent switching 3: Initialize malicious_node 4: while network is active do 5:     for each received DIO do 6:         Extract rank information 7:         if attacker aims to force reconstruction then 8:            Set rank ← invalid value 9:         else 10:            version_number ← version_number $+1$ 11:         end if 12:         Forward modified DIO 13:     end for 14:     for each received DAO do 15:         Modify routing/path information 16:         Forward corrupted DAO upward 17:     end for 18: end while

(4) 

Flooding Attack Model

The Flooding attack exploits the DIS solicitation mechanism. A malicious node repeatedly broadcasts DIS messages at extremely high frequency. Since RPL nodes respond to DIS with DIOs, the entire neighborhood becomes overloaded with control traffic, represented in Algorithm 4.

Topology Effects:

• Channel congestion due to excessive DIS/DIO exchanges.
• Sharp reduction in throughput and packet delivery.
• Rapid battery depletion in constrained motes.

Algorithm 4 Flooding attack pseudocode (with timer modification)

1: Input: DIS constants, RPL timer parameters 2: Output: Maximum-frequency DIS flooding 3: Set DIS_Interval $\leftarrow 0$ 4: Set DIS_Delay $\leftarrow 0$ 5: Enable continuous DIS triggering 6: function handle_periodic_timer 7:     rpl_purge_routes() 8:     rpl_calculate_ranks() 9:     if RPL_DIS_SEND is enabled then 10:         next_dis ← next_dis $+1$ 11:         $i\leftarrow 0$ 12:         while $i<20$ do 13:            dis_output(NULL) 14:            $i\leftarrow i+1$ 15:         end while 16:         if RPL_get_any_dag() = NULL and next_dis ≥ RPL_DIS_INTERVAL then 17:            next_dis $\leftarrow 0$ 18:            dis_output(NULL) 19:         end if 20:     end if 21:     Reset periodic timer using ctimer_reset(&periodic_timer) 22: end function 23: Neighbor nodes respond with frequent DIOs 24: Control-plane congestion and energy depletion increase

The detailed attack implementations above enabled the generation of realistic and diverse adversarial behaviors in RPL networks. The resulting datasets, consisting of benign and four attack-specific traffic profiles, provide the foundation for training the proposed multiclass attack detection framework.

3.3. Traffic Monitoring and Feature Extraction

The Contiki-NG/Cooja simulator was used to conduct numerous simulations in order to produce a broad and comprehensive dataset appropriate for multiclass attack detection. In all 11-node and 21-node network topologies, over 100 separate runs were carried out. To ensure adequate temporal depth for capturing routing behavior, protocol interactions, mobility influence, and adversarial effects, each simulation ran for 1800 s (30 min), specified in

Table 2. Simulation parameters used in Contiki-NG/Cooja.

Parameter	Value
Simulator	Contiki-NG/Cooja
Simulation time	1800 s
Mote type	Z1
Voltage	3 V
TX current	17.4 mA
RX current	18.8 mA
CPU (Active)	10 mA
CPU (LPM)	0.023 mA
Tx range	50 m
Int range	100 m
Data analysis	Python 3.8

. For every topology, both static and mobile situations were assessed. While nodes in mobile situations moved dynamically based on the mobility parameters specified in

Table 3. Mobility criteria used in mobile simulations.

Criteria	Value
Nodes	11, 21
Resolution	0.5 s
Min pace	1.0 m/s
Max pace	10 m/s
Min halt	2 s
Max halt	600 s
Max X-axis	180 m
Max Y-axis	150 m

, nodes in static settings stayed stable throughout the simulation. The mobility model was selected to mimic real-world IoT deployments, in which nodes may roam in semi-structured or indoor contexts, resulting in variations in parent selection patterns and link quality.

Cooja uses the Mote Output interface to log all radio operations, routing events, and communication during runtime. Second-by-second execution traces, including neighbor updates, radio broadcasts, ICMPv6 control messages (DIO, DAO, and DIS), and application-level traffic, are provided by this output. These logs serve as the foundation for feature extraction and packet-level analysis. Every packet or event sequence was combined into flow-based records in order to create useful supervised learning features. The amount of DIO/DIS/DAO packets, packet forwarding count, packet drops, preferred-parent changes, ETX fluctuation, and power consumption metrics were among the parameters that were extracted. Table 2 and Table 3 summarize the simulation parameters and mobility configuration used in all experiments. A representative visualization of the Mote Output logs generated during the simulation is shown in Figure 2, illustrating the continuous stream of control and data events monitored throughout each run.

3.4. Dataset Construction and Labeling

The parameters extracted in the previous Section 3.3 form the foundation of the dataset used for multiclass RPL attack classification. Each Cooja simulation generates real-time mote logs that record detailed information about RPL control messages, packet transmissions, radio events, forwarding behavior, and Energest-based energy reports. These unstructured Mote Output logs were then processed using a custom Python-based parsing framework. The parser systematically extracts and converts raw text records into structured numerical features representing both per-node behavior and global network dynamics. Through this automated processing pipeline, the system derives key RPL control-plane statistics (DIO, DIS, DAO, and DAO-ACK counts), packet-level information including sent, received, forwarded, and dropped packets, server-side packet reception patterns, routing control overhead, network convergence time, packet delivery and loss ratios, latency metrics, throughput, and total energy consumption computed from Energest reports.

A representative excerpt of the processed output is illustrated in Figure 3, demonstrating how the parser translates raw log entries into meaningful metrics used for dataset creation. Each simulation run produces a consolidated feature vector that captures the overall behavior of the network under a specific operating condition (benign or attack-injected). By aggregating the vectors across all simulation runs, the final dataset consists of 30,240 labeled samples covering a comprehensive set of scenarios, including two topology sizes, static and mobile configurations, OF0 and MRHOF objective functions, and five traffic states: benign, Blackhole, Decreased Rank, DODAG Inconsistency, and Flooding. The final dataset consists of 30,240 samples, evenly distributed across five traffic classes, with 6048 samples per class (20% benign and 80% attack traffic). This balanced design was intentionally adopted to prevent classifier bias during model comparison. While real-world IoT deployments typically exhibit benign dominant traffic, balanced datasets are commonly used in early-stage IDS research to evaluate intrinsic discriminative capability. Future extensions will investigate class-imbalanced scenarios using cost-sensitive learning and resampling techniques.

Table 4. Selected features used for dataset construction.

No.	Feature	Description
1	IDs	Unique identifier assigned to each node in the simulation.
2	DIOs	Number of DIO messages transmitted by the node.
3	DISs	Number of DIS solicitation messages sent.
4	DAOs	Count of DAO route update advertisements generated.
5	Precv	Total number of packets successfully received by the node.
6	Pforw	Total number of packets forwarded toward the RPL root.
7	Pdrop	Number of packets dropped due to buffering or routing inconsistencies.
8	Psent	Total data packets transmitted by the node.
9	Network	Simulation mobility condition (Static/Mobile).
10	OF	Objective function used in the run (OF0 or MRHOF).
11	Attack	Assigned traffic class (0 = benign, 1–4 = attack categories).

presents the final feature set selected for the multiclass machine learning framework. The selected attributes include RPL control-message counts, packet-level statistics, simulation context parameters (mobility type and objective function), and computed performance indicators such as routing convergence time and control overhead. The attack label associated with each simulation scenario is appended as the final column. A visual snippet of the constructed dataset, shown in Figure 4, illustrates how these features are structured and stored for subsequent machine learning analysis. Feature selection was guided by RPL protocol semantics rather than automated dimensionality reduction. Only features directly influenced by routing behavior and attack dynamics were retained. Control-plane metrics (DIO, DIS, DAO counts) capture topology manipulation, while packet-level features (Psent, Precv, Pforw, Pdrop) represent data-plane disruptions.This protocol-driven selection minimizes feature-label leakage, improves interpretability, and ensures that the learned patterns correspond to realistic attack mechanisms rather than simulator artifacts.

The constraints of popular public intrusion-detection datasets like DARPA, KDDCUP99, NSL-KDD, and CICIDS are the driving force for the creation of this dataset. These datasets lack the IoT-specific routing-layer behavior required for RPL security research because they were primarily created for conventional Internet environments. They do not record mobility-related behavior in limited wireless networks, objective function dynamics, or RPL control-plane interactions (DIO, DIS, and DAO messages). Moreover, they lack accurate depictions of RPL-specific routing attacks. On the other hand, the dataset created in this work combines energy measurements, realistic mobility conditions, comprehensive packet-flow patterns, and protocol-accurate RPL control-plane properties. The resulting dataset comprises 30,240 labeled samples, offering a realistic, fine-grained, and semantically rich representation of RPL-based IoT behavior. Importantly, the dataset is perfectly balanced across all five traffic classes, with 6048 samples per class. This improves machine learning models’ ability to detect numerous RPL routing attacks and helps them generalize more well under a variety of operational settings.

3.5. Multiclass Learning Framework

This work proposes a robust multiclass classification system that can differentiate between normal traffic and four key routing threats (Blackhole, Lowered Rank, DODAG Version, and Flooding) to ensure reliable routing in RPL-based IoT networks. The suggested framework combines a variety of conventional models and sophisticated ensemble learners rather than relying solely on one machine learning method. A comprehensive and equitable comparison of algorithms is made possible by this unified model-selection approach, which eventually determines the best model given the features and difficulties of the suggested dataset.

• Feature Space and Problem Formulation

Let $\mathcal{D}={\left\{({\mathbf{x}}_i,y_i)\right\}}_{i=1}^N$ denote the dataset, where each feature vector ${\mathbf{x}}_i\in {\mathbb{R}}^d$ is constructed from protocol-level parameters such as DIOs, DISs, DAOs, packet reception ($P_{\mathrm{recv}}$), packet forwarding ($P_{\mathrm{forw}}$), packet drops ($P_{\mathrm{drop}}$), and normalized network OF encodings. The target variable $y_i\in \{0,1,2,3,4\}$ corresponds to the five classes

$$\{0:\mathrm{Benign},1:\mathrm{Blackhole},2:\mathrm{Decreased}\mathrm{Rank},3:\mathrm{Version}\mathrm{Number}\mathrm{Attack},4:\mathrm{Flooding}\mathrm{Attack}\}.$$

The multiclass classification objective is formulated as

$$\widehat{f}=arg\underset{f\in \mathcal{F}}{min}{\displaystyle \frac{1}{N}}\sum _{i=1}^N\mathcal{L}\left(y_i,f\left({\mathbf{x}}_i\right)\right),$$

where $\mathcal{L}$ is the categorical cross-entropy loss.

• Model Architecture

The proposed framework evaluates two major families of classifiers to identify the most effective model for detecting attacks. The first family comprises classical base learners, including linear and nonlinear models that capture a broad spectrum of decision boundaries. In addition to these individual models, the framework incorporates an ensemble-based design to enhance robustness and generalization. The ensemble component includes a voting-based meta-classifier that aggregates RF, XGB, and GB through both hard and soft voting, expressed as

$${\widehat{y}}_{\mathrm{soft}}=arg\underset{k}{max}\sum _{m=1}^M{w}_m{p}_m(y=k\mid \mathbf{x}),$$

a stacking ensemble that employs a two-level architecture wherein the predictions of the base models form the meta-features

$${\mathbf{z}}_i=\left[f_1\left({\mathbf{x}}_i\right),f_2\left({\mathbf{x}}_i\right),\dots ,f_M\left({\mathbf{x}}_i\right)\right],$$

and the final decision is obtained from a meta-classifier g such that

$$\widehat{y}=g\left({\mathbf{z}}_i\right),$$

and a bagging framework is constructed over RF and DT to reduce variance in the learned model.

• Data Preprocessing Pipeline

All samples undergo a unified preprocessing pipeline to ensure consistency and mitigate dataset-induced bias. Missing values are handled using median-based imputation, while categorical attributes such as network identifiers and objective functions are encoded using label encoding. To normalize feature scales, standardization is applied according to

$$x^{\prime }={\displaystyle \frac{x-\mu }{\sigma }}.$$

The dataset is then divided into training and testing subsets using an 80–20 stratified split, ensuring proportional representation of all five classes.

• Model Training and Evaluation

Each model $f_m$ is trained by minimizing its expected loss, defined as

$$f_m=arg\underset{f\in {\mathcal{F}}_m}{min}\mathbb{E}\left[\mathcal{L}(y,f(\mathbf{x}\left)\right)\right].$$

Model performance is evaluated using accuracy, weighted precision, weighted recall, and weighted $F_1$ score to account for class imbalance. Furthermore, k-fold cross validation is used to assess generalization, with $k=5$ for individual base learners and $k=3$ for ensemble models. The cross-validation score for a model m is given by

$${\mathrm{CV}}_m={\displaystyle \frac{1}{k}}\sum _{j=1}^k\mathrm{Acc}\left(f_m^{\left(j\right)}\right).$$

To quantify overfitting, the variance gap between training and testing accuracy is computed as

$$G_m=A_{\mathrm{train}}-A_{\mathrm{test}},$$

where a larger value of $G_m$ indicates reduced generalization capability for model m.

Algorithm 5 summarizes the full workflow implemented in this study.

Algorithm 5 Multiclass RPL attack detection pipeline

Require:  Dataset $\mathcal{D}$, feature set $\mathbf{X}$, target Y 1: Load dataset $\mathcal{D}$ 2: Impute missing values using median strategy 3: Encode categorical variables using LabelEncoder 4: Split dataset into train/test using stratified sampling 5: Standardize features using: $$x^{\prime }=(x-\mu )/\sigma$$ 6: Initialize model set: $$\mathcal{M}=\{\mathrm{LR},\mathrm{SVM},\mathrm{RF},\mathrm{XGB},\mathrm{GB},\mathrm{DT},\mathrm{KNN},\mathrm{AB},\mathrm{ET},\mathrm{Voting},\mathrm{Stacking},\mathrm{Bagging}\}$$ 7: for each model m in $\mathcal{M}$ do 8:     Train m on ${\mathbf{X}}_{\mathrm{train}},Y_{\mathrm{train}}$ 9:     Predict $\widehat{y}$ on ${\mathbf{X}}_{\mathrm{test}}$ 10:     Compute metrics: accuracy, precision, recall, $F_1$ 11:     Perform cross-validation and store ${\mathrm{CV}}_m$ 12:     Compute overfitting gap: $G_m=A_{\mathrm{train}}-A_{\mathrm{test}}$ 13: end for 14: Rank models based on weighted $F_1$ and ${\mathrm{CV}}_m$ 15: return Best model $m^{*}$ with minimum $G_m$ and maximum performance

3.6. Justification of Design Choices and Evaluation Strategy

The methodological design of this study is explicitly aligned to evaluate the upper-bound effectiveness of machine learning-based intrusion detection for RPL networks under fully observable protocol conditions. Protocol-aware feature selection was guided by RPL control-plane semantics, ensuring that extracted attributes (DIO, DIS, DAO statistics, packet forwarding and dropping patterns, and objective-function dynamics) directly reflect routing behavior and attack mechanisms rather than simulator artifacts. Evaluation metrics were selected to jointly assess predictive performance and generalization. Accuracy and weighted $F_1$ score quantify multiclass detection capability, while cross-validation accuracy and train–test overfitting gaps explicitly measure robustness and variance sensitivity. Stratified train–test splitting and k-fold cross-validation ensure balanced class representation and mitigate sampling bias. Simulation-based validation using multiple topology sizes, mobility conditions, and objective functions enables controlled isolation of attack-induced behavior while maintaining reproducibility. Collectively, these methodological choices establish a coherent and systematic pipeline that directly supports the study’s goal of analyzing intrinsic attack separability and model robustness in RPL-based IoT networks.

4. Results and Discussion

All machine learning and ensemble models trained on the suggested multiclass RPL attack dataset are rigorously evaluated for performance in this section. Generalization behavior, overfitting sensitivity, learning-curve dynamics, ensemble versus individual model comparisons, feature-level interpretability, class-wise confusion, and ROC analysis are all included in the evaluation. This study demonstrates that ensemble learning techniques constantly provide excellent accuracy and robustness in spotting a variety of RPL attacks under actual IoT network conditions during these extensive tests.

4.1. Train–Test Generalization and Overfitting Behavior

The training and testing accuracies of all assessed models are compared in Figure 5. Training and testing results are tightly linked in a well-generalized model. The virtually overlapping curves of ensemble models, especially Soft Voting, XGBoost, Random Forest, and Gradient Boosting, exhibit great generalization with minimal overfitting. This behavior results from ensembles’ capacity to integrate several decision boundaries, which lowers variance and minimizes sensitivity to local noise in the dataset. On the other hand, there are discernible differences between training and testing accuracy for particular classifiers like Decision Tree and K-Nearest Neighbors. Because these models frequently lack built-in regularization and are more susceptible to sample-level noise, they are more likely to overfit high-dimensional or imbalanced inputs.

Figure 6 quantifies the train–test gap for each classifier. Gaps less than 0.05 show a reasonable bias–variance tradeoff, while gaps greater than 0.10 suggest significant overfitting. The stability of nearly all ensemble techniques is reinforced by the fact that they fall well below this barrier. Even in the midst of extremely nonlinear attack-generated patterns, their variance-reduction mechanisms bagging in Random Forest, boosting in Gradient Boosting and XGBoost, and probability aggregation in Voting Ensembles allow them to maintain consistent predictive behavior.

4.2. Learning-Curve Insights

Figure 7 presents the learning curves for four models considered in this work, namely the Voting Ensemble, Decision Tree, Random Forest, and Logistic Regression. Due to its increased bias and intrinsic linear modeling limitations, Logistic Regression shows early convergence with little improvement from more data. Decision Tree’s propensity to memorize sample-specific patterns when not regularized is confirmed by its characteristic overfitting behavior, which combines flawless training accuracy with a smaller validation curve. The importance of ensemble diversity is demonstrated by Random Forest and the Voting Ensemble. With narrow, steadily convergent curves, both models exhibit progressive performance improvement as the training set expands. Both the Voting Ensemble’s consensus-driven probability averaging and Random Forest’s bootstrap aggregation (bagging) significantly reduce noise sensitivity and guarantee steady convergence even in the face of overlapping attack features.

4.3. Comprehensive Performance Evaluation

Accuracy, F1-score, overfitting gap, and cross-validation statistics for the best models are compiled in

Table 5. Performance comparison of top machine learning models for RPL attack classification.

Model	Type	Test Accuracy	F1-Score	Overfitting Gap	CV Accuracy	CV Std
Voting Classifier (Soft)	Ensemble	0.9947	0.9947	0.0052	0.9935	0.00025
XGBoost	Individual	0.9945	0.9945	0.0055	0.9938	0.00044
Random Forest	Individual	0.9944	0.9944	0.0056	0.9933	0.00070
Voting Classifier (Hard)	Ensemble	0.9942	0.9942	0.0058	0.9933	0.00025
Bagging Classifier (DT)	Ensemble	0.9942	0.9942	0.0057	0.9922	0.00088
Gradient Boosting	Individual	0.9940	0.9940	0.0009	0.9924	0.00051
Stacking Classifier	Ensemble	0.9939	0.9939	0.0061	0.9946	0.00031

. The Soft Voting Classifier shows remarkably low cross-validation variance and the greatest test accuracy (0.9947), indicating very steady behavior across folds. Following closely behind with accuracies of 0.9945 and 0.9944, respectively, are XGBoost and Random Forest. These models work well because they can take advantage of hierarchical correlations in RPL control-plane metrics, capture nonlinear feature interactions, and generalize effectively across different attack intensities.

Figure 8 consolidates multiple evaluation components, including feature importance, confusion matrices, ROC curves, and cross-validation behavior. Feature-importance analysis from Random Forest reveals that packet-level indicators such as Precv, Pforw, DIOs, and Pdrop carry high discriminative value. These features correspond directly to expected protocol-level deviations during Blackhole (high Pdrop), Flooding (abnormal DIO/DAO bursts), and Rank manipulation attacks (unstable forwarding or increased control-message exchange).The confusion matrix of the best-performing model shows nearly perfect separation across all five classes, with minor confusion observed between the Decreased Rank and DODAG Version attacks. This behavior is technically expected since both attacks modify routing-state information in similar ways, leading to partially overlapping patterns in control-plane statistics. While these features provide strong interpretability, their dominance also implies that detection performance is closely tied to the visibility of protocol deviations, which may be reduced in encrypted, lossy, or adversarially adaptive environments.

4.4. Confusion Matrices of the Top Three Models

Figure 9 illustrates confusion matrices of the top three models: Soft Voting, XGBoost, and Random Forest. All models achieve high per-class prediction rates, with Soft Voting providing the most balanced classification across all attack categories. XGBoost excels in detecting Flooding and Blackhole attacks, likely due to its gradient-boosted tree structure that captures high-frequency or burst-like patterns. Random Forest shows slightly higher confusion between Rank-related attacks, reflecting sensitivity to subtle topological variations that may appear statistically similar.

4.5. Computational Cost Analysis

To assess the feasibility of deploying the proposed intrusion detection system in practical IoT environments, the computational cost of the top-performing models was analyzed in terms of training time, inference latency, and memory footprint. All experiments were conducted on a workstation with an Intel i7 CPU and 16 GB RAM. Tree-based ensemble models such as Random Forest and XGBoost exhibited higher training costs due to model complexity and ensemble depth; however, training is performed offline and does not affect runtime deployment. During inference, all top models achieved sub-millisecond prediction latency per sample, making them suitable for gateway-level or edge-assisted intrusion detection.The Soft Voting ensemble demonstrated the best tradeoff between accuracy and runtime efficiency, as inference involves only probability aggregation of pre-trained base models. Memory consumption remained within acceptable limits (<50 MB), suggesting feasibility for fog or edge-based deployment rather than resource-constrained sensor nodes.

4.6. Discussion on High Accuracy and Potential Limitations

Although classification accuracies exceeding 99% may raise concerns about overfitting, the observed performance is justified by strong protocol-level attack signatures and extensive overfitting analysis. First, RPL routing attacks generate strong protocol-level signatures (e.g., abnormal DIO/DAO rates, rank inconsistencies, and packet drop patterns), which are inherently separable when protocol-aware features are used. Second, extensive overfitting analysis, including learning curves, train–test gap evaluation, and cross-validation stability, indicates that the models generalize well and do not memorize the dataset. Nonetheless, it is acknowledged that simulation-based datasets cannot fully capture the stochasticity, noise, and hardware imperfections of real-world deployments. Therefore, while the reported performance demonstrates the upper bound of ML-based RPL attack detection under controlled conditions, future validation on testbeds and heterogeneous traffic conditions remains necessary.

4.7. Generality, Feature Dominance, and Scope Limitations

The near-perfect class separability observed in this study is primarily attributed to the strong and explicit protocol-level signatures produced by RPL routing attacks under controlled simulation settings. Features such as packet drops, abnormal DIO/DIS rates, and forwarding inconsistencies are directly affected by attack logic and therefore exhibit high discriminative power. While this behavior validates the effectiveness of protocol-aware feature engineering, it also raises the possibility of feature dominance and partial feature–label determinism. In particular, a small subset of control-plane and packet-level metrics contributes disproportionately to classification decisions, which may simplify detection under fully active attack scenarios but reduce robustness against stealthy or intermittent adversaries. In real-world deployments, attackers may intentionally minimize observable deviations to evade detection, resulting in weaker separability than observed here. Furthermore, the current evaluation does not include validation across unseen topologies, heterogeneous radio environments, or noisy traffic conditions. Consequently, the reported results should be interpreted as an upper bound on detection performance under idealized observability assumptions rather than as a direct proxy for real-world accuracy.

4.8. Summary of Key Findings

Experimental results demonstrate the clear superiority of ensemble learning methods for multiclass RPL attack detection. Key findings include the following:

• High classification accuracy exceeding 99% for all top models, indicating strong separability across attack categories.
• Very small overfitting gaps (<0.006) for the best models, confirming excellent generalization behavior.
• Low cross-validation variance, indicating robust performance across multiple data partitions and attack intensities.
• Consistent ROC–AUC scores above 0.95 for all classes, demonstrating reliable separability even under overlapping attack dynamics.
• Clear interpretability through feature-importance analysis, validating that the models use meaningful RPL control-plane metrics rather than spurious correlations.
• Statistical significance of model performance was verified using paired t-tests on cross-validation accuracy scores. The Soft Voting ensemble exhibited statistically significant improvements ($p<0.05$) over individual base learners such as Logistic Regression and Decision Tree. In contrast, performance differences among Soft Voting, XGBoost, and Random Forest were not statistically significant, indicating that ensemble learning primarily enhances stability and robustness rather than yielding overfitted performance gains.

Overall, the results strongly indicate that ensemble methods, particularly Soft Voting, XGBoost, Random Forest, and Gradient Boosting, are well-suited for detecting complex, nonlinear, and overlapping RPL attack patterns in IoT networks. Their robustness, stability, and interpretability make them promising candidates for real-time intrusion detection in resource-constrained environments.

5. Conclusions

This work addresses the lack of protocol-aware datasets for RPL security research by introducing a large-scale, multiclass intrusion detection framework grounded in detailed simulation-driven analysis. The proposed dataset captures benign behavior and four major RPL routing attacks across static and mobile topologies, directly enabling comprehensive multiclass evaluation. Experimental results demonstrate that this dataset supports strong class separability, with ensemble-based models achieving classification accuracies above 99%, overfitting gaps below 0.006, and consistently low cross-validation variance. The protocol-aware feature engineering strategy contributes directly to these results by exposing attack-specific control-plane and packet-level signatures, as confirmed by feature-importance analysis. The comprehensive evaluation framework spanning individual classifiers and ensemble techniques shows that Soft Voting, XGBoost, and Random Forest provide the most stable and generalizable performance, validating the effectiveness of ensemble learning for RPL attack detection. Together, these findings quantitatively substantiate each stated contribution, from dataset construction to model evaluation and ranking.

It is important to distinguish between limitations intrinsic to the simulation-based evaluation and those associated with real-world deployment. At the simulation level, this study assumes full visibility of RPL control-plane semantics, idealized radio conditions, and well-defined attack behaviors, which together yield an upper-bound estimate of detection performance. These assumptions are appropriate for analyzing intrinsic feature relevance and attack separability but may not fully capture environmental noise, hardware imperfections, or partial observability. In real-world deployments, additional constraints arise, including encrypted or obfuscated control traffic, heterogeneous hardware platforms, dynamic interference, and stealthy or adaptive adversaries that deliberately minimize protocol deviations. Such factors are expected to reduce detection accuracy relative to the results reported here. Accordingly, the proposed framework is positioned as a reproducible analytical baseline rather than a deployment-ready solution, with future work targeting validation under heterogeneous, noisy, and adversarially adaptive conditions.