International Conference on Computer and Knowledge Engineering

Home / 15th International Conference on Computer and Knowledge Engineering

DTranIDS: A Two-Tiered Intrusion Detection System for RPL-based IoT Networks based on Decision Tree and Transformer Models

Authors :

Mohammad Fazeli¹ Mohsen Raji² Mohammad Mahdi Fazeli³

1- School of Electrical and Computer Engineering, University of Shiraz, Iran 2- School of Electrical and Computer Engineering, University of Shiraz, Iran 3- School of Electrical and Computer Engineering, University of Shiraz, Iran

Keywords :

IoT Security،RPL attacks،Anomaly Detection،Anomaly Detection،Decision Tree،Transformer،Two-Tiered Model،Intrusion Detection System

Abstract :

RPL (Routing Protocol for Low-Power and Lossy Networks) has emerged as the de facto standard for IoT routing, offering robust, energy-efficient, and scalable communication. However, its susceptibility to it unique cyber-security attacks demands robust security enhancements to ensure reliable deployment. Although Intrusion Detection Systems (IDS) offer a proactive defense mechanism to mitigate RPL's inherent vulnerabilities, traditional IDS solutions are often too resource-intensive for IoT environments. Therefore, there is a critical need for lightweight-yet-accurate IDS frameworks specifically designed for RPL-based networks. In this paper, we propose a novel two-tier intrusion detection system, DTranIDS, designed to effectively identify and classify RPL-specific attacks in IoT environments. In the first tier, a Decision Tree classifier rapidly filters incoming data to determine whether a given instance is benign or malicious. In the second tier, a Transformer-based model is employed to precisely classify the specific type of detected attack. The proposed model is evaluated using the ROUT-4-2023 dataset, which includes four common RPL routing attacks: Blackhole, Flooding, Version Number, and Decreased Rank. Experimental results demonstrate that DTranIDS achieves an overall accuracy of 97%, with precision, recall, and F1-score values all around 96%, significantly outperforming several state-of-the-art IoT intrusion detection methods (which typically achieve 88–91% accuracy). Moreover, DTranIDS show its efficiency in fast intrusion detection (about 0.4 s), indicating that DTranIDS is well-suited for real-world, resource-constrained IoT environments, offering both real-time intrusion detection and detailed attack classification capabilities to aid cybersecurity analysts.