CNN-BiLSTM-Based Classification of RPL Attacks in IoT Smart Grid Networks (Industry Track)

Problem and motivation

RPL-based smart-grid and industrial IoT networks have constrained devices, evolving routing attacks, and highly imbalanced traffic classes. A detector must distinguish normal traffic from attacks and retain enough temporal structure to classify the attack family.

Method and contribution

The pipeline aggregates one-second PCAP frames into flow features derived from the five-tuple and applies missing-value backfill, duplicate removal, Gini-style feature processing, and SMOTE balancing before a 70/30 split. The network uses convolutional filters followed by pooling and batch normalization, then a bidirectional LSTM with NADAM optimization; the reported configuration uses 64 convolutional kernels of size 122. Evaluation combines a Contiki-NG simulated RPL/IIoT scenario with N-BaIoT device traffic and compares the model with seven deep-learning or traditional classifiers.

Findings and evidence

For the simulated RPL scenario, the reported results are approximately 91.87% accuracy, 89.91% precision, 90.70% recall, and 89.98% F1. On the N-BaIoT setting, the paper reports approximately 90.12% accuracy, 89.87% precision, 90.21% recall, and 89.97% F1. Training is reported over roughly 600 epochs; these results support the proposed cascade/classifier under the selected data and split, not universal performance on unseen deployments.

Limitations and future directions

Limitations: The evaluation depends on simulated RPL traffic and the N-BaIoT corpus, with dataset-specific preprocessing, balancing, and train/test assumptions. The reported classifier is not validated against all routing implementations, encrypted traffic, concept drift, or adversarial evasion, and training cost is material for constrained IoT nodes.

Future work: Test cross-dataset and time-based splits, additional RPL attacks and real deployments, lightweight/continual models for edge devices, calibrated abstention for unseen attacks, and robustness against poisoning and evasion.

Sources and identifiers

• Published version published
• DBLP record public_source_record

When to cite this paper

Cite this paper when using CNN-BiLSTM models for imbalanced RPL or IoT intrusion traffic.

• Five-tuple flow preprocessing, SMOTE, and the reported CNN-BiLSTM architecture.
• The combined simulated RPL and N-BaIoT evaluation.
• The reported accuracy, precision, recall, and F1 values for the two settings.
• A labeled-dataset baseline for IoT attack classification, not a guarantee on unseen attacks.

Citation

@inproceedings{ezzatiJivan2023cnnbilstm,
  author = {Yue Guan and Morteza Noferesti and Naser Ezzati-Jivan},
  title = {CNN-BiLSTM-Based Classification of RPL Attacks in IoT Smart Grid Networks (Industry Track)},
  year = {2023},
  booktitle = {ACM/IFIP/USENIX Middleware 2023 Industry Track},
  pages = {29-34},
  publisher = {ACM},
  doi = {10.1145/3626562.3626832},
  url = {https://doi.org/10.1145/3626562.3626832}
}

Guan, Y., Noferesti, M., & Ezzati-Jivan, N. (2023). CNN-BiLSTM-Based Classification of RPL Attacks in IoT Smart Grid Networks (Industry Track). In ACM/IFIP/USENIX Middleware 2023 Industry Track (pp. 29-34). https://doi.org/10.1145/3626562.3626832

Y. Guan, M. Noferesti, and N. Ezzati-Jivan, "CNN-BiLSTM-Based Classification of RPL Attacks in IoT Smart Grid Networks (Industry Track)," in ACM/IFIP/USENIX Middleware 2023 Industry Track, pp. 29-34, 2023, doi: 10.1145/3626562.3626832