{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T22:20:01Z","timestamp":1775082001744,"version":"3.50.1"},"reference-count":27,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2026,1,7]],"date-time":"2026-01-07T00:00:00Z","timestamp":1767744000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>The use of resource-constrained Low-Power and Lossy Networks (LLNs), where the IPv6 Routing Protocol for LLNs (RPL) is the de facto routing standard, has increased due to the Internet of Things\u2019 (IoT) explosive growth. Because of the dynamic nature of IoT deployments and the lack of in-protocol security, RPL is still quite susceptible to routing-layer attacks like Blackhole, Lowered Rank, version number manipulation, and Flooding despite its lightweight architecture. Lightweight, data-driven intrusion detection methods are necessary since traditional cryptographic countermeasures are frequently unfeasible for LLNs. However, the lack of RPL-specific control-plane semantics in current cybersecurity datasets restricts the use of machine learning (ML) for practical anomaly identification. In order to close this gap, this work models both static and mobile networks under benign and adversarial settings by creating a novel, large-scale multiclass RPL attack dataset using Contiki-NG\u2019s Cooja simulator. To record detailed packet-level and control-plane activity including DODAG Information Object (DIO), DODAG Information Solicitation (DIS), and Destination Advertisement Object (DAO) message statistics along with forwarding and dropping patterns and objective-function fluctuations, a protocol-aware feature extraction pipeline is developed. This dataset is used to evaluate fifteen classifiers, including Logistic Regression (LR), Support Vector Machine (SVM), Decision Tree (DT), k-Nearest Neighbors (KNN), Random Forest (RF), Extra Trees (ET), Gradient Boosting (GB), AdaBoost (AB), and XGBoost (XGB) and several ensemble strategies like soft\/hard voting, stacking, and bagging, as part of a comprehensive ML-based detection system. Numerous tests show that ensemble approaches offer better generalization and prediction performance. With overfitting gaps less than 0.006 and low cross-validation variance, the Soft Voting Classifier obtains the greatest accuracy of 99.47%, closely followed by XGBoost with 99.45% and Random Forest with 99.44%.<\/jats:p>","DOI":"10.3390\/fi18010035","type":"journal-article","created":{"date-parts":[[2026,1,7]],"date-time":"2026-01-07T09:34:12Z","timestamp":1767778452000},"page":"35","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["A Multiclass Machine Learning Framework for Detecting Routing Attacks in RPL-Based IoT Networks Using a Novel Simulation-Driven Dataset"],"prefix":"10.3390","volume":"18","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-4829-5189","authenticated-orcid":false,"given":"Niharika","family":"Panda","sequence":"first","affiliation":[{"name":"Department of Computer Science and Engineering, Amrita School of Computing, Amrita Vishwa Vidyapeetham, Bengaluru 560035, India"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6147-7142","authenticated-orcid":false,"given":"Supriya","family":"Muthuraman","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Amrita School of Computing, Amrita Vishwa Vidyapeetham, Bengaluru 560035, India"}]}],"member":"1968","published-online":{"date-parts":[[2026,1,7]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"118","DOI":"10.1186\/s13638-022-02200-9","article-title":"Efficient data transmission using trusted third party in smart home environments","volume":"2022","author":"Panda","year":"2022","journal-title":"EURASIP J. Wirel. Commun. Netw."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Panda, N., and Supriya, M. (2022, January 7\u20139). Blackhole attack impact analysis on low power lossy networks. Proceedings of the 2022 IEEE 3rd Global Conference for Advancement in Technology (GCAT), Bengaluru, India.","DOI":"10.1109\/GCAT55367.2022.9971814"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A.A. (2009, January 8\u201310). A detailed analysis of the KDD CUP 99 data set. Proceedings of the 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, Ottawa, ON, Canada.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"ref_4","first-page":"446","article-title":"A study on NSL-KDD dataset for intrusion detection system based on classification algorithms","volume":"4","author":"Dhanabal","year":"2015","journal-title":"Int. J. Adv. Res. Comput. Commun. Eng."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"132911","DOI":"10.1109\/ACCESS.2020.3009843","article-title":"CICIDS-2017 dataset feature analysis with information gain for anomaly detection","volume":"8","author":"Stiawan","year":"2020","journal-title":"IEEE Access"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"142206","DOI":"10.1109\/ACCESS.2021.3120626","article-title":"Intrusion detection system using machine learning for vehicular ad hoc networks based on ToN-IoT dataset","volume":"9","author":"Gad","year":"2021","journal-title":"IEEE Access"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Panda, N., and Supriya, M. (2023). Blackhole attack prediction in wireless sensor networks using support vector machine. Advances in Signal Processing, Embedded Systems and IoT: Proceedings of Seventh ICMEET-2022, Springer Nature.","DOI":"10.1007\/978-981-19-8865-3_30"},{"key":"ref_8","unstructured":"Winter, T., Thubert, P., Brandt, A., Hui, J., Kelsey, R., Levis, P., Pister, K., Struik, R., Vasseur, J.P., and Alexander, R. (2025, November 23). RPL: IPv6 Routing Protocol for Low-Power and Lossy Networks (No. rfc6550). Available online: https:\/\/datatracker.ietf.org\/doc\/html\/rfc6550."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Al-Amiedy, T.A., Anbar, M., Belaton, B., Kabla, A.H.H., Hasbullah, I.H., and Alashhab, Z.R. (2022). A systematic literature review on machine and deep learning approaches for detecting attacks in RPL-based 6LoWPAN of internet of things. Sensors, 22.","DOI":"10.3390\/s22093400"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Avila, K., Jabba, D., and Gomez, J. (2020). Security aspects for RPL-based protocols: A systematic review in IoT. Appl. Sci., 10.","DOI":"10.3390\/app10186472"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"365","DOI":"10.3844\/jcssp.2024.365.378","article-title":"Generating IoT specific anomaly datasets using COOJA Simulator (Contiki-OS) and performance evaluation of deep learning model coupled with aquila optimizer","volume":"20","author":"Choudhary","year":"2024","journal-title":"J. Comput. Sci."},{"key":"ref_12","first-page":"30","article-title":"A self organizing map intrusion detection system for RPL protocol attacks","volume":"11","author":"Kfoury","year":"2019","journal-title":"Int. J. Interdiscip. Telecommun. Netw. (IJITN)"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Zahra, F., Jhanjhi, N.Z., Brohi, S.N., Khan, N.A., Masud, M., and AlZain, M.A. (2022). Rank and wormhole attack detection model for RPL-based internet of things using machine learning. Sensors, 22.","DOI":"10.3390\/s22186765"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"124","DOI":"10.3390\/jcp2010009","article-title":"A trust-based intrusion detection system for RPL networks: Detecting a combination of rank and blackhole attacks","volume":"2","author":"Ioulianou","year":"2022","journal-title":"J. Cybersecur. Priv."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Al Sawafi, Y., Touzene, A., and Hedjam, R. (2023). Hybrid deep learning-based intrusion detection system for RPL IoT networks. J. Sens. Actuator Netw., 12.","DOI":"10.3390\/jsan12020021"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"22880","DOI":"10.1109\/JSEN.2025.3558364","article-title":"DLP4DA-RPL: A Distributed Lightweight Protocol for Detection and Avoidance of Discarded DIO and DAO Attacks on RPL Routing Protocol in IoT","volume":"25","author":"Deepavathi","year":"2025","journal-title":"IEEE Sens. J."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Canbalaban, E., and Sen, S. (2020, January 19\u201321). A cross-layer intrusion detection system for RPL-based Internet of Things. Proceedings of the International Conference on Ad-Hoc Networks and Wireless, Bari, Italy.","DOI":"10.1007\/978-3-030-61746-2_16"},{"key":"ref_18","unstructured":"Mehmood, T. (2017). Cooja network simulator: Exploring the infinite possible ways to compute the performance metrics of iot based smart devices to understand the working of iot based compression & routing protocols. arXiv."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Lmkaiti, M., Lachgar, M., Larhlimi, I., Moudni, H., and Mouncif, H. (2025). Secure Optimization of RPL Routing in IoT Networks: Analysis of Metaheuristic Algorithms in the Face of Attacks. Int. J. Adv. Comput. Sci. Appl., 16, (4).","DOI":"10.14569\/IJACSA.2025.01604113"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"485","DOI":"10.1109\/JIOT.2021.3085194","article-title":"ToN_IoT: The role of heterogeneity and the need for standardization of features and attack types in IoT network intrusion data sets","volume":"9","author":"Booij","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"12709","DOI":"10.1109\/ACCESS.2025.3531659","article-title":"TCN-Based DDoS detection and mitigation in 5G Healthcare-IoT: A frequency monitoring and dynamic threshold approach","volume":"13","author":"Akhi","year":"2025","journal-title":"IEEE Access"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Almusaylim, Z.A., Jhanjhi, N.Z., and Alhumam, A. (2020). Detection and mitigation of RPL rank and version number attacks in the internet of things: SRPL-RP. Sensors, 20.","DOI":"10.20944\/preprints202007.0476.v1"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"73","DOI":"10.1080\/19393555.2023.2218852","article-title":"Securing AMI-IoT networks against multiple RPL attacks using ensemble learning IDS and light-chain based prediction detection and mitigation mechanisms","volume":"33","year":"2024","journal-title":"Inf. Secur. J. Glob. Perspect."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"248","DOI":"10.1007\/s10462-024-10907-y","article-title":"RPL-based attack detection approaches in IoT networks: Review and taxonomy","volume":"57","author":"Alfriehat","year":"2024","journal-title":"Artif. Intell. Rev."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Le, A., Loo, J., Chai, K.K., and Aiash, M. (2016). A specification-based IDS for detecting attacks on RPL-based network topology. Information, 7.","DOI":"10.3390\/info7020025"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Garcia Ribera, E., Martinez Alvarez, B., Samuel, C., Ioulianou, P.P., and Vassilakis, V.G. (2022). An intrusion detection system for RPL-based IoT networks. Electronics, 11.","DOI":"10.3390\/electronics11234041"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Rouissat, M., Belkheir, M., Alsukayti, I.S., and Mokaddem, A. (2023). A lightweight mitigation approach against a new inundation attack in RPL-based IoT networks. Appl. Sci., 13.","DOI":"10.3390\/app131810366"}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/18\/1\/35\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,7]],"date-time":"2026-01-07T09:41:26Z","timestamp":1767778886000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/18\/1\/35"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1,7]]},"references-count":27,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,1]]}},"alternative-id":["fi18010035"],"URL":"https:\/\/doi.org\/10.3390\/fi18010035","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,7]]}}}