RRFSE: RNN biased random forest and SVM ensemble for RPL DDoS in IoT-WSN environment

Abstract

Distributed Denial of Service (DDoS) attacks have significantly impacted network performance and stability in Internet of Things (IoT) Wireless Sensor Networks (WSNs) that utilize the Routing Protocol for Low-Power and Lossy Networks (RPL). These attacks cause severe network degradation or failure by flooding network nodes with malicious traffic, which interferes with communication. This study presents an ensemble of machine-learning techniques to detect DDoS attacks in RPL-based IoT-WSN systems, including an RNN-biased Random Forest (RF) and Support Vector Machine (SVM) classifier. The Recurrent Neural Network (RNN) is used to identify attack sequences by capturing temporal patterns in network data. A Random Forest classifier integrates these temporal features and employs many decision trees to improve detection accuracy. An SVM is used to greatly enhance the detecting process. It differentiates between attack and legitimate traffic using robust decision boundaries. The ensemble model improves overall performance in detecting DDoS attacks with greater accuracy, fewer false positives, and improved flexibility in changing attack plans by utilizing the advantages of each technique. Despite the resource limitations present in IoT-WSN environments, experimental results show that this ensemble technique is effective in real-time detection. This approach offers an effective defense against DDoS attacks for Internet of Things networks, guaranteeing dependable communication in networks with limited power and resources.