{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,18]],"date-time":"2026-06-18T17:56:41Z","timestamp":1781805401342,"version":"3.54.5"},"reference-count":34,"publisher":"Public Library of Science (PLoS)","issue":"6","license":[{"start":{"date-parts":[[2026,6,18]],"date-time":"2026-06-18T00:00:00Z","timestamp":1781740800000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["www.plosone.org"],"crossmark-restriction":false},"short-container-title":["PLoS One"],"abstract":"<jats:p>The increasing adoption of Internet of Things (IoT) devices introduces significant security challenges, particularly in networks based on the Routing Protocol for Low-Power and Lossy Networks (RPL), where resource constraints limit the effectiveness of conventional security solutions. This work presents an optimized deep learning framework for detecting and classifying RPL-based routing attacks. The framework integrates Chaotic Pied Kingfisher Optimization (Ch-PKO) for feature selection with a Zero-parameter Channel Attention Bidirectional Long Short-Term Memory (ZCAtt-BiLSTM) model for classification. Data preprocessing includes cleaning, one-hot encoding, and Pareto scaling to improve data quality and learning stability. The approach is evaluated on the IoT-RPL dataset, covering Blackhole, Flooding, DODAG Version Number, and Decreased Rank attacks. Experimental results show strong performance, achieving 99.305% accuracy, 98.57% F1-score, 0.61% false discovery rate, and 97.949% MCC. Comparative analysis indicates improved performance over baseline models. However, the evaluation is based on simulated data, and the training process introduces additional computational cost, which may affect real-time deployment.<\/jats:p>","DOI":"10.1371\/journal.pone.0350844","type":"journal-article","created":{"date-parts":[[2026,6,18]],"date-time":"2026-06-18T17:41:04Z","timestamp":1781804464000},"page":"e0350844","update-policy":"https:\/\/doi.org\/10.1371\/journal.pone.corrections_policy","source":"Crossref","is-referenced-by-count":0,"title":["Optimized feature selection and zero-parameter channel attention BiLSTM for RPL-attack classification in IoT networks"],"prefix":"10.1371","volume":"21","author":[{"given":"Sudha Rani","family":"Unnam","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8938-2452","authenticated-orcid":true,"given":"Kareemulla","family":"Shaik","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"340","published-online":{"date-parts":[[2026,6,18]]},"reference":[{"key":"pone.0350844.ref001","doi-asserted-by":"crossref","first-page":"103331","DOI":"10.1016\/j.adhoc.2023.103331","article-title":"An ensemble learning framework for the detection of RPL attacks in IoT networks based on the genetic feature selection approach","volume":"152","author":"M Osman","year":"2024","journal-title":"Ad Hoc Networks"},{"issue":"1","key":"pone.0350844.ref002","doi-asserted-by":"crossref","DOI":"10.1049\/cmu2.70067","article-title":"CID\u2010RPL: clone ID attack detection using deep neural network for RPL\u2010Based IoT networks","volume":"19","author":"F Al\u2010Quayed","year":"2025","journal-title":"IET Commun"},{"key":"pone.0350844.ref003","first-page":"1324","article-title":"An intrusion detection system against RPL based routing attacks for IoT networks","volume":"34","author":"MH Shivanajappa","year":"2024","journal-title":"Indones J Electr Eng Comput Sci"},{"key":"pone.0350844.ref004","doi-asserted-by":"crossref","first-page":"27","DOI":"10.1007\/978-3-031-90723-4_3","article-title":"Ensemble learning based intrusion detection system for RPL based IoT networks","volume-title":"Demystifying AI and ML for Cyber\u2013Threat Intelligence","author":"A Chougule","year":"2025"},{"key":"pone.0350844.ref005","doi-asserted-by":"crossref","first-page":"171","DOI":"10.1016\/j.ject.2025.06.003","article-title":"A resource-efficient ensemble machine learning framework for detecting rank attacks in RPL-based IoT networks","volume":"4","author":"S Kalyani","year":"2026","journal-title":"J Economy Tech"},{"issue":"17","key":"pone.0350844.ref006","doi-asserted-by":"crossref","first-page":"5834","DOI":"10.3390\/s24175834","article-title":"FL-DSFA: securing RPL-Based IoT networks against selective forwarding attacks using federated learning","volume":"24","author":"R Khan","year":"2024","journal-title":"Sensors (Basel)"},{"key":"pone.0350844.ref007","article-title":"Intrusion detection using hybrid pearson correlation and GS PSO optimized random forest technique for RPL based IoT","author":"W Yang","year":"2025","journal-title":"IEEE Access"},{"issue":"11","key":"pone.0350844.ref008","doi-asserted-by":"crossref","first-page":"2226","DOI":"10.3390\/electronics13112226","article-title":"Performance evaluation of mobile RPL-based IoT networks under hello flood attack","volume":"13","author":"A Hkiri","year":"2024","journal-title":"Electronics"},{"key":"pone.0350844.ref009","doi-asserted-by":"crossref","first-page":"864","DOI":"10.1007\/s42979-024-03200-w","article-title":"Enhancing security in IoT networks through RDAD for attack detection in rpl enabled environments.","author":"K Sridhar","year":"2024","journal-title":"SN Comp Sci"},{"issue":"2","key":"pone.0350844.ref010","doi-asserted-by":"crossref","first-page":"259","DOI":"10.1007\/s10836-024-06106-w","article-title":"Simulation-based analysis of RPL routing attacks and their impact on IoT network performance","volume":"40","author":"R Bokka","year":"2024","journal-title":"J Electron Test"},{"key":"pone.0350844.ref011","doi-asserted-by":"crossref","first-page":"030018","DOI":"10.1063\/5.0257329","article-title":"A framework for generating a multi-class dataset for IoT attacks using Cooja simulator","author":"MJ Kathem","year":"2025","journal-title":"AIP Conference Proceedings"},{"issue":"1","key":"pone.0350844.ref012","first-page":"1","article-title":"SoS RPL: securing internet of things against sinkhole attack using RPL protocol based node rating and ranking mechanism","volume":"1","author":"M Fotohi","year":"2023","journal-title":"J Internet Things"},{"key":"pone.0350844.ref013","article-title":"Reliable RPL: a reliability aware RPL protocol using trust based blockchain system for internet of things","author":"AD Aguru","year":"2024","journal-title":"IEEE Transactions on Reliability"},{"key":"pone.0350844.ref014","doi-asserted-by":"crossref","unstructured":"Wakili A, Bakkali S. Enhancing IOT routing security and efficiency: towards Ai enabled Rpl protocol. 2024. https:\/\/ssrn.com\/abstract=4907433","DOI":"10.2139\/ssrn.4907433"},{"issue":"2","key":"pone.0350844.ref015","doi-asserted-by":"crossref","first-page":"21","DOI":"10.3390\/jsan12020021","article-title":"Hybrid Deep Learning-Based Intrusion Detection System for RPL IoT Networks","volume":"12","author":"Y Al Sawafi","year":"2023","journal-title":"JSAN"},{"issue":"9","key":"pone.0350844.ref016","doi-asserted-by":"crossref","DOI":"10.1007\/s10462-024-10907-y","article-title":"RPL-based attack detection approaches in IoT networks: review and taxonomy","volume":"57","author":"N Alfriehat","year":"2024","journal-title":"Artif Intell Rev"},{"key":"pone.0350844.ref017","doi-asserted-by":"crossref","first-page":"110356","DOI":"10.1016\/j.cie.2024.110356","article-title":"A methodical examination of single and multi-attacker flood attacks using RPL-based approaches","volume":"194","author":"S Gonen","year":"2024","journal-title":"Comp Indus Eng"},{"key":"pone.0350844.ref018","doi-asserted-by":"crossref","first-page":"94081","DOI":"10.1109\/ACCESS.2023.3310242","article-title":"Passive rule-based approach to detect sinkhole attack in RPL-based internet of things networks","volume":"11","author":"S Al-Sarawi","year":"2023","journal-title":"IEEE Access"},{"issue":"18","key":"pone.0350844.ref019","doi-asserted-by":"crossref","first-page":"10366","DOI":"10.3390\/app131810366","article-title":"A lightweight mitigation approach against a new inundation attack in RPL-based IoT networks","volume":"13","author":"M Rouissat","year":"2023","journal-title":"Appl Sci"},{"key":"pone.0350844.ref020","doi-asserted-by":"crossref","first-page":"129077","DOI":"10.1109\/ACCESS.2023.3331030","article-title":"Mitigating denial of service attacks in RPL-based IoT environments: trust-based approach","volume":"11","author":"F Azzedin","year":"2023","journal-title":"IEEE Access"},{"issue":"18","key":"pone.0350844.ref021","doi-asserted-by":"crossref","first-page":"26333","DOI":"10.1007\/s11227-024-06453-7","article-title":"HADTF: a hybrid autoencoder\u2013decision tree framework for improved RPL-based attack detection in IoT networks based on enhanced feature selection approach","volume":"80","author":"M Osman","year":"2024","journal-title":"J Supercomput"},{"issue":"12","key":"pone.0350844.ref022","doi-asserted-by":"crossref","first-page":"16979","DOI":"10.1007\/s11227-024-06118-5","article-title":"A novel RPL defense mechanism based on trust and deep learning for internet of things","volume":"80","author":"K Ahmadi","year":"2024","journal-title":"J Supercomput"},{"issue":"10","key":"pone.0350844.ref023","article-title":"Detecting the RPL version number attack in IoT networks using deep learning models","volume":"14","author":"A Krari","year":"2023","journal-title":"Int J Adv Comp Sci Appl"},{"issue":"4","key":"pone.0350844.ref024","doi-asserted-by":"crossref","first-page":"637","DOI":"10.22247\/ijcna\/2023\/223317","article-title":"IoBTSec-RPL: a novel RPL attack detecting mechanism using hybrid deep learning over battlefield iot environment","volume":"10","author":"K Kowsalyadevi","year":"2023","journal-title":"IJCNA"},{"issue":"4","key":"pone.0350844.ref025","article-title":"Blocollab: a blockchain aided deep learning model for hybrid and collaborative routing attack detection and mitigation in RPL","volume":"17","author":"OA Abdulkareem","year":"2024","journal-title":"Int J Intelligent Eng Syst"},{"issue":"2","key":"pone.0350844.ref026","doi-asserted-by":"crossref","first-page":"13","DOI":"10.14445\/23497157\/IJRES-V10I2P103","article-title":"Securing IoT networks: RPL attack detection with deep learning GRU networks","volume":"10","author":"R Bokka","year":"2023","journal-title":"IJRES"},{"key":"pone.0350844.ref027","doi-asserted-by":"crossref","first-page":"241","DOI":"10.1007\/978-981-99-9718-3_10","article-title":"Machine learning based intelligent RPL attack detection system for IoT networks","author":"A Kannan","year":"2024","journal-title":"Computational intelligence methods and applications. Springer Nature Singapore"},{"issue":"1","key":"pone.0350844.ref028","doi-asserted-by":"crossref","DOI":"10.1007\/s10791-025-09852-3","article-title":"Federated hybrid deep learning for multi-attack detection and classification in RPL-based 6LoWPAN networks","volume":"28","author":"WB Alemayew","year":"2025","journal-title":"Discov Computing"},{"issue":"3","key":"pone.0350844.ref029","doi-asserted-by":"crossref","first-page":"1040","DOI":"10.21123\/2411-7986.5251","article-title":"Implementing a secure RPL routing protocol for IoT networks using lightweight authentication technique","volume":"23","author":"HA Nassrullah","year":"2026","journal-title":"Baghdad Science Journal"},{"key":"pone.0350844.ref030","article-title":"Intrusion detection using hybrid pearson correlation and GS-PSO optimized random forest technique for RPL-based IoT","author":"W Yang","year":"2025","journal-title":"IEEE Access"},{"key":"pone.0350844.ref031","unstructured":"Mendeley Data: Dataset 4rcbbry2sc. Accessed 2023 October 1. https:\/\/data.mendeley.com\/datasets\/4rcbbry2sc\/1"},{"key":"pone.0350844.ref032","doi-asserted-by":"crossref","first-page":"112854","DOI":"10.1016\/j.jpba.2019.112854","article-title":"Evaluation of statistical techniques to normalize mass spectrometry based urinary metabolomics data","volume":"177","author":"T Cook","year":"2020","journal-title":"J Pharm Biomed Anal"},{"issue":"25","key":"pone.0350844.ref033","first-page":"15455","article-title":"Pied kingfisher optimizer: a new bio inspired algorithm for solving numerical optimization and industrial engineering problems","volume":"36","author":"A Bouaouda","year":"2024","journal-title":"Neural Comput Appl"},{"issue":"06","key":"pone.0350844.ref034","article-title":"Optimization-based feature selection and classification with modified activation-tuned deep BiLSTM for attack detection in IoT","volume":"26","author":"A Kumar","year":"2025","journal-title":"Int J Image Grap"}],"container-title":["PLOS One"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0350844","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,18]],"date-time":"2026-06-18T17:41:12Z","timestamp":1781804472000},"score":1,"resource":{"primary":{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0350844"}},"subtitle":[],"editor":[{"given":"Shicheng","family":"Li","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"editor"}]}],"short-title":[],"issued":{"date-parts":[[2026,6,18]]},"references-count":34,"journal-issue":{"issue":"6","published-online":{"date-parts":[[2026,6,18]]}},"URL":"https:\/\/doi.org\/10.1371\/journal.pone.0350844","relation":{},"ISSN":["1932-6203"],"issn-type":[{"value":"1932-6203","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,18]]}}}