{
  "schema_version": "0.6.0",
  "paper_id": "cnn-bilstm-rpl-attacks-iot-smart-grid",
  "page_url": "https://threadslab.org/research-publications/papers/cnn-bilstm-rpl-attacks-iot-smart-grid/",
  "title": "CNN-BiLSTM-Based Classification of RPL Attacks in IoT Smart Grid Networks (Industry Track)",
  "title_variants": [],
  "authors": [
    "Yue Guan",
    "Morteza Noferesti",
    "Naser Ezzati-Jivan"
  ],
  "author_details": [
    {
      "name": "Yue Guan",
      "orcid": "https://orcid.org/0009-0008-9603-4171",
      "profile_url": "https://dblp.org/pid/54/7820.html"
    },
    {
      "name": "Morteza Noferesti",
      "orcid": "https://orcid.org/0009-0000-5507-1461",
      "profile_url": "https://dblp.org/pid/82/10462.html"
    },
    {
      "name": "Naser Ezzati-Jivan",
      "orcid": "https://orcid.org/0000-0003-1435-6297",
      "profile_url": "https://threadslab.org/"
    }
  ],
  "publication": {
    "year": 2023,
    "venue": "ACM/IFIP/USENIX Middleware 2023 Industry Track",
    "type": "industry-track paper",
    "publication_date": "2023-12-11",
    "online_date": "2023-12-11",
    "print_date": "2023-12-11",
    "volume": null,
    "issue": null,
    "pages": "29-34",
    "article_number": null,
    "publisher": "ACM",
    "issn": [],
    "isbn": [],
    "crossref_type": "proceedings-article"
  },
  "publication_type": "industry-track paper",
  "status": "published_metadata_record",
  "canonical_source_url": "https://doi.org/10.1145/3626562.3626832",
  "source_record_id": "cnn-bilstm-based-classification-of-rpl-attacks-in-iot-smart-grid-networks-industry-track-c3af27dc70",
  "identifiers": {
    "doi": "10.1145/3626562.3626832"
  },
  "abstract": null,
  "abstract_source": "OpenAlex abstract metadata reviewed; publisher abstract not reproduced because reuse permission was not established.",
  "abstract_available": false,
  "scholar_eligibility": {
    "eligible": false,
    "basis": "not-eligible",
    "note": "The page is a discovery record; it does not claim Google Scholar article-host eligibility."
  },
  "description": "The paper applies a CNN-BiLSTM intrusion classifier to RPL/IoT traffic, combining convolutional feature extraction with bidirectional sequence modeling after imbalance-aware flow preprocessing.",
  "evidence_level": "full-text-reviewed",
  "evidence": {
    "source_basis": "full-text-reviewed",
    "coverage": "material paper sections",
    "summary_origin": "AI-assisted catalog editorial summary",
    "review_status": "catalog-reviewed; paper-author approval pending",
    "verified_on": "2026-08-26",
    "sources": [
      {
        "note": "Local PDF reviewed, including preprocessing, CNN-BiLSTM configuration, datasets, split, and metric tables"
      },
      {
        "note": "ACM DOI record: https://doi.org/10.1145/3626562.3626832"
      },
      {
        "note": "ACM publication record: https://dl.acm.org/doi/10.1145/3626562.3626832"
      }
    ]
  },
  "summary": {
    "core_contribution": "The paper applies a CNN-BiLSTM intrusion classifier to RPL/IoT traffic, combining convolutional feature extraction with bidirectional sequence modeling after imbalance-aware flow preprocessing.",
    "problem": "RPL-based smart-grid and industrial IoT networks have constrained devices, evolving routing attacks, and highly imbalanced traffic classes. A detector must distinguish normal traffic from attacks and retain enough temporal structure to classify the attack family.",
    "method": "The pipeline aggregates one-second PCAP frames into flow features derived from the five-tuple and applies missing-value backfill, duplicate removal, Gini-style feature processing, and SMOTE balancing before a 70/30 split. The network uses convolutional filters followed by pooling and batch normalization, then a bidirectional LSTM with NADAM optimization; the reported configuration uses 64 convolutional kernels of size 122. Evaluation combines a Contiki-NG simulated RPL/IIoT scenario with N-BaIoT device traffic and compares the model with seven deep-learning or traditional classifiers.",
    "findings": "For the simulated RPL scenario, the reported results are approximately 91.87% accuracy, 89.91% precision, 90.70% recall, and 89.98% F1. On the N-BaIoT setting, the paper reports approximately 90.12% accuracy, 89.87% precision, 90.21% recall, and 89.97% F1. Training is reported over roughly 600 epochs; these results support the proposed cascade/classifier under the selected data and split, not universal performance on unseen deployments.",
    "limitations": "The evaluation depends on simulated RPL traffic and the N-BaIoT corpus, with dataset-specific preprocessing, balancing, and train/test assumptions. The reported classifier is not validated against all routing implementations, encrypted traffic, concept drift, or adversarial evasion, and training cost is material for constrained IoT nodes.",
    "future_work": "Test cross-dataset and time-based splits, additional RPL attacks and real deployments, lightweight/continual models for edge devices, calibrated abstention for unseen attacks, and robustness against poisoning and evasion."
  },
  "tags": [
    "iot-security",
    "deep-learning-systems",
    "machine-learning",
    "anomaly-detection"
  ],
  "keywords": [
    "RPL attacks",
    "IoT smart grid",
    "CNN-BiLSTM",
    "routing attacks",
    "intrusion detection",
    "Middleware 2023"
  ],
  "versions": [
    {
      "id": "published-version",
      "label": "Published version",
      "relation": "version-of-record",
      "title": "CNN-BiLSTM-Based Classification of RPL Attacks in IoT Smart Grid Networks (Industry Track)",
      "url": "https://doi.org/10.1145/3626562.3626832",
      "pdf_url": null,
      "status": "published",
      "canonical_for_citation": true
    },
    {
      "id": "dblp-record",
      "label": "DBLP record",
      "relation": "source-record",
      "title": "CNN-BiLSTM-Based Classification of RPL Attacks in IoT Smart Grid Networks (Industry Track)",
      "url": "https://dblp.org/rec/conf/middleware/GuanNE23",
      "pdf_url": null,
      "status": "public_source_record",
      "canonical_for_citation": false
    }
  ],
  "access": {
    "status": "published_metadata_record",
    "note": "DBLP, DOI metadata, and the author publication record verify the item. No abstract or full text was accessible, so no model, dataset, or result claim is made.",
    "license": null
  },
  "resources": {
    "code": null,
    "data": null,
    "slides": null,
    "demo": null
  },
  "citation_guidance": {
    "when_to_cite": "Cite this paper when using CNN-BiLSTM models for imbalanced RPL or IoT intrusion traffic.",
    "points": [
      "Five-tuple flow preprocessing, SMOTE, and the reported CNN-BiLSTM architecture.",
      "The combined simulated RPL and N-BaIoT evaluation.",
      "The reported accuracy, precision, recall, and F1 values for the two settings.",
      "A labeled-dataset baseline for IoT attack classification, not a guarantee on unseen attacks."
    ],
    "canonical_version_id": "published-version"
  },
  "provenance": {
    "metadata_verified_on": "2026-08-26",
    "metadata_source": [
      "Local PDF reviewed, including preprocessing, CNN-BiLSTM configuration, datasets, split, and metric tables",
      "ACM DOI record: https://doi.org/10.1145/3626562.3626832",
      "ACM publication record: https://dl.acm.org/doi/10.1145/3626562.3626832"
    ],
    "summary_written_by": "AI-assisted",
    "summary_verified_by": "full-text-grounded catalog review; author approval pending",
    "linked_preprint_record": null,
    "author_order_note": null
  },
  "batch": {
    "phase": 2,
    "batch_label": "expanded forty-paper release",
    "status": "included_in_expanded_catalog",
    "selected_at": "2026-08-28"
  }
}