{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,24]],"date-time":"2026-03-24T15:42:52Z","timestamp":1774366972303,"version":"3.50.1"},"reference-count":47,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2024,9,3]],"date-time":"2024-09-03T00:00:00Z","timestamp":1725321600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,9,3]],"date-time":"2024-09-03T00:00:00Z","timestamp":1725321600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100004071","name":"Khon Kaen University","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100004071","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>The Internet of Things (IoT) has gained popularity and is widely used in modern society. The growth in the sizes of IoT networks with more internet-connected devices has led to concerns regarding privacy and security. In particular, related to the routing protocol for low-power and lossy networks (RPL), which lacks robust security functions, many IoT devices in RPL networks are resource-constrained, with limited computing power, bandwidth, memory, and battery life. This causes them to face various vulnerabilities and potential attacks, such as DIO neighbor suppression attacks. This type of attack specifically targets neighboring nodes through DIO messages and poses a significant security threat to RPL-based IoT networks. Recent studies have proposed methods for detecting and mitigating this attack; however, they produce high false-positive and false-negative rates in detection tasks and cannot fully protect RPL networks against this attack type. In this paper, we propose a novel fuzzy logic-based intrusion detection scheme to secure the RPL protocol (FLSec-RPL) to protect against this attack. Our method is built of three key phases consecutively: (1) it tracks attack activity variables to determine potential malicious behaviors; (2) it performs fuzzy logic-based intrusion detection to identify malicious neighbor nodes; and (3) it provides a detection validation and blocking mechanism to ensure that both malicious and suspected malicious nodes are accurately detected and blocked. To evaluate the effectiveness of our method, we conduct comprehensive experiments across diverse scenarios, including Static-RPL and Mobile-RPL networks. We compare the performance of our proposed method with that of the state-of-the-art methods. The results demonstrate that our method outperforms existing methods in terms of the detection accuracy, F1 score, power consumption, end-to-end delay, and packet delivery ratio metrics.<\/jats:p>","DOI":"10.1186\/s42400-024-00223-x","type":"journal-article","created":{"date-parts":[[2024,9,3]],"date-time":"2024-09-03T02:02:13Z","timestamp":1725328933000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":13,"title":["FLSec-RPL: a fuzzy logic-based intrusion detection scheme for securing RPL-based IoT networks against DIO neighbor suppression attacks"],"prefix":"10.1186","volume":"7","author":[{"given":"Chenset","family":"Kim","sequence":"first","affiliation":[]},{"given":"Chakchai","family":"So-In","sequence":"additional","affiliation":[]},{"given":"Yanika","family":"Kongsorot","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5289-1149","authenticated-orcid":false,"given":"Phet","family":"Aimtongkham","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2024,9,3]]},"reference":[{"key":"223_CR1","doi-asserted-by":"crossref","unstructured":"Aharoni R (2021) Geometric sequences. In: Algebra for parents. World Scientific, pp 221\u2013226","DOI":"10.1142\/9789811209239_0015"},{"key":"223_CR2","first-page":"1","volume":"942","author":"JS Akosa","year":"2017","unstructured":"Akosa JS (2017) Predictive accuracy: a misleading performance measure for highly imbalanced data. SAS Glob Forum 942:1\u201312","journal-title":"SAS Glob Forum"},{"key":"223_CR3","doi-asserted-by":"crossref","unstructured":"Alexander R, Brandt A, Vasseur JP et al (2012) RPL: IPv6 routing protocol for low-power and lossy networks","DOI":"10.17487\/rfc6550"},{"key":"223_CR4","doi-asserted-by":"publisher","first-page":"2347","DOI":"10.1109\/COMST.2015.2444095","volume":"17","author":"A Al-Fuqaha","year":"2015","unstructured":"Al-Fuqaha A, Guizani M, Mohammadi M et al (2015) Internet of things: a survey on enabling technologies, protocols, and applications. IEEE Commun Surv Tutor 17:2347\u20132376. https:\/\/doi.org\/10.1109\/COMST.2015.2444095","journal-title":"IEEE Commun Surv Tutor"},{"key":"223_CR5","doi-asserted-by":"publisher","first-page":"69","DOI":"10.1016\/0169-2070(92)90008-W","volume":"8","author":"JS Armstrong","year":"1992","unstructured":"Armstrong JS, Collopy F (1992) Error measures for generalizing about forecasting methods: empirical comparisons. Int J Forecast 8:69\u201380. https:\/\/doi.org\/10.1016\/0169-2070(92)90008-W","journal-title":"Int J Forecast"},{"key":"223_CR6","doi-asserted-by":"publisher","first-page":"1","DOI":"10.3390\/app10186472","volume":"10","author":"K Avila","year":"2020","unstructured":"Avila K, Jabba D, Gomez J (2020) Security aspects for Rpl-based protocols: a systematic review in IoT. Appl Sci 10:1\u201320. https:\/\/doi.org\/10.3390\/app10186472","journal-title":"Appl Sci"},{"key":"223_CR7","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3494524","volume":"55","author":"AO Bang","year":"2022","unstructured":"Bang AO, Rao UP, Kaliyar P, Conti M (2022) Assessment of routing attacks and mitigation techniques with RPL control messages: a survey. ACM Comput Surv 55:1\u201336. https:\/\/doi.org\/10.1145\/3494524","journal-title":"ACM Comput Surv"},{"key":"223_CR8","first-page":"1","volume-title":"Exponential smoothing for predicting demand","author":"R Brown","year":"1956","unstructured":"Brown R, Robert G (1956) Exponential smoothing for predicting demand. Arthur D. Little Inc., Cambridge, pp 1\u201315"},{"key":"223_CR9","doi-asserted-by":"publisher","unstructured":"Dunkels A, Gr\u00f6nvall B, Voigt T (2004) Contiki\u2014a lightweight and flexible operating system for tiny networked sensors. In: Proceedings of the conference on local comput networks, LCN, pp 455\u2013462. https:\/\/doi.org\/10.1109\/LCN.2004.38","DOI":"10.1109\/LCN.2004.38"},{"key":"223_CR10","unstructured":"Dunkels A, Eriksson J, Finne N, Tsiftes N (2011) Powertrace: network-level power profiling for low-power wireless networks low-power wireless"},{"key":"223_CR11","unstructured":"Fail2ban.org (2017) Fail2ban. https:\/\/www.fail2ban.org\/wiki\/index.php\/Main_Page. Accessed 21 Feb 2023"},{"key":"223_CR12","doi-asserted-by":"crossref","unstructured":"Farzaneh B, Montazeri MA, Jamali S (2019) An anomaly-based IDS for detecting attacks in RPL-based internet of things. In: 2019 5th international conference on web research, ICWR 2019. IEEE, pp 61\u201366","DOI":"10.1109\/ICWR.2019.8765272"},{"key":"223_CR13","doi-asserted-by":"publisher","first-page":"2419","DOI":"10.1007\/s11235-011-9564-7","volume":"52","author":"G Han","year":"2013","unstructured":"Han G, Xu H, Duong TQ et al (2013) Localization algorithms of wireless sensor networks: a survey. Telecommun Syst 52:2419\u20132436. https:\/\/doi.org\/10.1007\/s11235-011-9564-7","journal-title":"Telecommun Syst"},{"key":"223_CR14","unstructured":"Heckert NA, Filliben JJ (2003) NIST\/SEMATECH e-handbook of statistical methods; chapter 6: process or product and monitoring control"},{"key":"223_CR15","doi-asserted-by":"publisher","DOI":"10.5772\/36321","volume-title":"A Mamdani type fuzzy logic controller","author":"I Iancu","year":"2012","unstructured":"Iancu I (2012) A Mamdani type fuzzy logic controller. InTech"},{"key":"223_CR16","doi-asserted-by":"publisher","first-page":"154","DOI":"10.1016\/j.compeleceng.2018.09.007","volume":"72","author":"K Kabilan","year":"2018","unstructured":"Kabilan K, Bhalaji N, Selvaraj C et al (2018) Performance analysis of IoT protocol under different mobility models. Comput Electr Eng 72:154\u2013168. https:\/\/doi.org\/10.1016\/j.compeleceng.2018.09.007","journal-title":"Comput Electr Eng"},{"key":"223_CR17","doi-asserted-by":"crossref","unstructured":"Karie NM, Sahri NM, Haskell-Dowland P (2020) IoT threat detection advances, challenges and future directions. In: 2020 workshop on emerging technologies for security in IoT (ETSecIoT), pp 22\u201329","DOI":"10.1109\/ETSecIoT50046.2020.00009"},{"key":"223_CR18","doi-asserted-by":"publisher","unstructured":"Korniyenko B, Galata L (2019) Implementation of the information resources protection based on the CentOS operating system. In: 2019 IEEE 2nd Ukrainian conference on electrical and computer engineering UKRCON 2019\u2014Proceedings, pp 1007\u20131011. https:\/\/doi.org\/10.1109\/UKRCON.2019.8879981","DOI":"10.1109\/UKRCON.2019.8879981"},{"key":"223_CR19","doi-asserted-by":"crossref","unstructured":"Kushalnagar N, Montenegro G, Schumacher C (2007) IPv6 over low-power wireless personal area networks (6LoWPANs): overview, assumptions, problem statement, and goals","DOI":"10.17487\/rfc4919"},{"key":"223_CR20","doi-asserted-by":"publisher","first-page":"320","DOI":"10.1016\/j.jksuci.2017.04.001","volume":"30","author":"H Lamaazi","year":"2018","unstructured":"Lamaazi H, Benamar N, Jara AJ (2018) RPL-based networks in static and mobile environment: a performance assessment analysis. J King Saud Univ Comput Inf Sci 30:320\u2013333. https:\/\/doi.org\/10.1016\/j.jksuci.2017.04.001","journal-title":"J King Saud Univ Comput Inf Sci"},{"key":"223_CR21","first-page":"1","volume":"71","author":"WJ Lammers","year":"2005","unstructured":"Lammers WJ, Babbie E (2005) Experimental design: multiple independent variables. Fundam Behav Res 71:1\u201317","journal-title":"Fundam Behav Res"},{"key":"223_CR22","doi-asserted-by":"publisher","first-page":"1","DOI":"10.3390\/info7020025","volume":"7","author":"A Le","year":"2016","unstructured":"Le A, Loo J, Chai KK, Aiash M (2016) A specification-based IDS for detecting attacks on RPL-based network topology. Information 7:1\u201320. https:\/\/doi.org\/10.3390\/info7020025","journal-title":"Information"},{"key":"223_CR23","doi-asserted-by":"crossref","unstructured":"Le A, Loo J, Luo Y, Lasebae A (2013) The impacts of internal threats towards Routing Protocol for Low power and lossy network performance. In: 2013 IEEE symposium on computers and communications (ISCC). IEEE, pp 000789\u2013000794","DOI":"10.1109\/ISCC.2013.6755045"},{"key":"223_CR24","doi-asserted-by":"crossref","unstructured":"Levis P, Clausen TH, Gnawali O et al (2011) The trickle algorithm. RFC Ed., pp 1\u201313","DOI":"10.17487\/rfc6206"},{"key":"223_CR25","doi-asserted-by":"publisher","first-page":"146","DOI":"10.1016\/j.jhydrol.2006.05.007","volume":"331","author":"AK Lohani","year":"2006","unstructured":"Lohani AK, Goel NK, Bhatia KKS (2006) Takagi-Sugeno fuzzy inference system for modeling stage-discharge relationship. J Hydrol 331:146\u2013160. https:\/\/doi.org\/10.1016\/j.jhydrol.2006.05.007","journal-title":"J Hydrol"},{"key":"223_CR26","doi-asserted-by":"publisher","first-page":"164","DOI":"10.4236\/jcc.2015.35021","volume":"03","author":"S Madakam","year":"2015","unstructured":"Madakam S, Ramaswamy R, Tripathi S (2015) Internet of things (IoT): a literature review. J Comput Commun 03:164\u2013173. https:\/\/doi.org\/10.4236\/jcc.2015.35021","journal-title":"J Comput Commun"},{"key":"223_CR27","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2021.102939","volume":"61","author":"F Medjek","year":"2021","unstructured":"Medjek F, Tandjaoui D, Djedjig N, Romdhani I (2021) Multicast DIS attack mitigation in RPL-based IoT-LLNs. J Inf Secur Appl 61:102939. https:\/\/doi.org\/10.1016\/j.jisa.2021.102939","journal-title":"J Inf Secur Appl"},{"key":"223_CR28","unstructured":"Medjek F, Tandjaoui D, Romdhani I, Djedjig N (2018) Security and privacy in smart sensor networks. IGI Global"},{"key":"223_CR29","doi-asserted-by":"publisher","first-page":"365","DOI":"10.1007\/s11277-019-06166-8","volume":"106","author":"P Mohammadi","year":"2019","unstructured":"Mohammadi P, Ghaffari A (2019) Defending against flooding attacks in mobile ad-hoc networks based on statistical analysis. Wirel Pers Commun 106:365\u2013376. https:\/\/doi.org\/10.1007\/s11277-019-06166-8","journal-title":"Wirel Pers Commun"},{"key":"223_CR30","first-page":"41","volume":"4","author":"I Muakhori","year":"2020","unstructured":"Muakhori I, Sunardi FA (2020) Security of dynamic domain name system servers against DDOS attacks using Iptable and Fail2ba. J Mantik 4:41\u201349","journal-title":"J Mantik"},{"key":"223_CR31","doi-asserted-by":"publisher","first-page":"379","DOI":"10.1109\/JIOT.2019.2948149","volume":"7","author":"S Murali","year":"2020","unstructured":"Murali S, Jamalipour A (2020) A lightweight intrusion detection for Sybil attack under mobile RPL in the internet of things. IEEE Internet Things J 7:379\u2013388. https:\/\/doi.org\/10.1109\/JIOT.2019.2948149","journal-title":"IEEE Internet Things J"},{"key":"223_CR32","doi-asserted-by":"publisher","first-page":"2524","DOI":"10.1109\/LCOMM.2017.2738629","volume":"21","author":"P Perazzo","year":"2017","unstructured":"Perazzo P, Vallati C, Anastasi G, Dini G (2017) DIO suppression attack against routing in the internet of things. IEEE Commun Lett 21:2524\u20132527. https:\/\/doi.org\/10.1109\/LCOMM.2017.2738629","journal-title":"IEEE Commun Lett"},{"key":"223_CR33","doi-asserted-by":"publisher","unstructured":"Pongle P, Chavan G (2015) A survey: attacks on RPL and 6LoWPAN in IoT. In: 2015 international conference on pervasive computing: advance communication technology and application for society ICPC 2015, pp1\u20136. https:\/\/doi.org\/10.1109\/PERVASIVE.2015.7087034","DOI":"10.1109\/PERVASIVE.2015.7087034"},{"key":"223_CR34","doi-asserted-by":"publisher","first-page":"4937","DOI":"10.1109\/JIOT.2020.2971463","volume":"7","author":"C Pu","year":"2020","unstructured":"Pu C (2020) Sybil attack in RPL-based internet of things: analysis and defenses. IEEE Internet Things J 7:4937\u20134949. https:\/\/doi.org\/10.1109\/JIOT.2020.2971463","journal-title":"IEEE Internet Things J"},{"key":"223_CR35","doi-asserted-by":"publisher","first-page":"1582","DOI":"10.1109\/COMST.2018.2885894","volume":"21","author":"A Raoof","year":"2019","unstructured":"Raoof A, Matrawy A, Lung CH (2019) Routing attacks and mitigation methods for RPL-based internet of things. IEEE Commun Surv Tutorials 21:1582\u20131606. https:\/\/doi.org\/10.1109\/COMST.2018.2885894","journal-title":"IEEE Commun Surv Tutorials"},{"key":"223_CR36","doi-asserted-by":"publisher","first-page":"2661","DOI":"10.1016\/j.adhoc.2013.04.014","volume":"11","author":"S Raza","year":"2013","unstructured":"Raza S, Wallgren L, Voigt T (2013) SVELTE: real-time intrusion detection in the internet of things. Ad Hoc Netw 11:2661\u20132674. https:\/\/doi.org\/10.1016\/j.adhoc.2013.04.014","journal-title":"Ad Hoc Netw"},{"key":"223_CR37","doi-asserted-by":"publisher","first-page":"389","DOI":"10.1016\/B978-0-12-398364-0.00016-4","volume-title":"Metaheuristic applications in structures and infrastructures","author":"G Saeed","year":"2013","unstructured":"Saeed G (2013) 16\u2014Structural optimization for frequency constraints. In: Gandomi AH, Yang X-S, Talatahari S, Alavi AH (eds) Metaheuristic applications in structures and infrastructures. Elsevier, Oxford, pp 389\u2013417"},{"key":"223_CR38","doi-asserted-by":"publisher","DOI":"10.1016\/j.adhoc.2023.103118","volume":"142","author":"G Sharma","year":"2023","unstructured":"Sharma G, Grover J, Verma A (2023) QSec-RPL: detection of version number attacks in RPL based mobile IoT using Q-learning. Ad Hoc Netw 142:103118. https:\/\/doi.org\/10.1016\/j.adhoc.2023.103118","journal-title":"Ad Hoc Netw"},{"key":"223_CR39","unstructured":"Strang G, Herman EJ (2022) 6.8: exponential growth and decay\u2014mathematics LibreTexts. https:\/\/math.libretexts.org\/Bookshelves\/Calculus\/Calculus_(OpenStax)\/06%3A_Applications_of_Integration\/6.08%3A_Exponential_Growth_and_Decay. Accessed 1 May 2023"},{"key":"223_CR40","doi-asserted-by":"publisher","first-page":"187","DOI":"10.1007\/978-981-10-8237-5_18","volume":"706","author":"A Thomas","year":"2018","unstructured":"Thomas A, Gireesh Kumar T, Mohan AK (2018) Neighbor attack detection in internet of things. Adv Intell Syst Comput 706:187\u2013196. https:\/\/doi.org\/10.1007\/978-981-10-8237-5_18","journal-title":"Adv Intell Syst Comput"},{"key":"223_CR41","doi-asserted-by":"crossref","unstructured":"Tsao T, Alexander R, Dohler M et al (2015) A security threat analysis for the routing protocol for low-power and lossy networks (RPLs)","DOI":"10.17487\/rfc7416"},{"key":"223_CR42","first-page":"311","volume":"18","author":"JW Tukey","year":"2003","unstructured":"Tukey JW, Hoaglin DC (2003) John W. Tukey and data analysis. Stat Sci 18:311\u2013318","journal-title":"Stat Sci"},{"key":"223_CR43","doi-asserted-by":"publisher","first-page":"5666","DOI":"10.1109\/JSEN.2020.2973677","volume":"20","author":"A Verma","year":"2020","unstructured":"Verma A, Ranga V (2020a) Security of RPL based 6LoWPAN networks in the internet of things: a review. IEEE Sens J 20:5666\u20135690. https:\/\/doi.org\/10.1109\/JSEN.2020.2973677","journal-title":"IEEE Sens J"},{"key":"223_CR44","doi-asserted-by":"publisher","first-page":"43","DOI":"10.1007\/s11235-020-00674-w","volume":"75","author":"A Verma","year":"2020","unstructured":"Verma A, Ranga V (2020b) CoSec-RPL: detection of copycat attacks in RPL based 6LoWPANs using outlier analysis. Telecommun Syst 75:43\u201361. https:\/\/doi.org\/10.1007\/s11235-020-00674-w","journal-title":"Telecommun Syst"},{"key":"223_CR45","doi-asserted-by":"publisher","first-page":"1479","DOI":"10.1007\/s00607-020-00862-1","volume":"103","author":"A Verma","year":"2021","unstructured":"Verma A, Ranga V (2021) The impact of copycat attack on RPL based 6LoWPAN networks in Internet of Things. Computing 103:1479\u20131500. https:\/\/doi.org\/10.1007\/s00607-020-00862-1","journal-title":"Computing"},{"key":"223_CR46","doi-asserted-by":"publisher","first-page":"43665","DOI":"10.1109\/ACCESS.2020.2977476","volume":"8","author":"I Wadhaj","year":"2020","unstructured":"Wadhaj I, Ghaleb B, Thomson C et al (2020) Mitigation mechanisms against the DAO attack on the routing protocol for low power and lossy networks (RPL). IEEE Access 8:43665\u201343675. https:\/\/doi.org\/10.1109\/ACCESS.2020.2977476","journal-title":"IEEE Access"},{"key":"223_CR47","unstructured":"Zoliteria (2010) Z1 datasheet. https:\/\/zolertia.sourceforge.net\/wiki\/images\/e\/e8\/Z1_RevC_Datasheet.pdf. Accessed 12 May 2023"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00223-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-024-00223-x\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00223-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,9,3]],"date-time":"2024-09-03T02:03:19Z","timestamp":1725328999000},"score":1,"resource":{"primary":{"URL":"https:\/\/cybersecurity.springeropen.com\/articles\/10.1186\/s42400-024-00223-x"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,9,3]]},"references-count":47,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2024,12]]}},"alternative-id":["223"],"URL":"https:\/\/doi.org\/10.1186\/s42400-024-00223-x","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,9,3]]},"assertion":[{"value":"12 June 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"20 February 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"3 September 2024","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that there is no competing interest regarding the publication of this manuscript.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"27"}}