Machine Learning-Based Detection of Combined Sinkhole and Blackhole Attacks in IoT Networks

Abstract

Internet of Things (IoT) networks are highly defenseless to routing-layer attacks, particularly sinkhole and blackhole. In a sinkhole attack, a malicious node displays false routing information to attract traffic. While the blackhole attack is used to discard packets once received. By combining these attacks, severe disruption and data loss happen arise as they both attract and drop traffic. Detecting such merged threats is challenging because most available datasets contain only normal traffic or single attacks. This results in class imbalance and reduces the performance of traditional machine learning models.This research paper proposes an end-to-end intrusion detection pipeline tailored to RPL (Routing Protocol for Low-Power and Lossy Networks)-based IoT networks, to tackle this challenge. Through the use of Contiki OS and the Cooja simulator, we created a dataset that covers normal, sinkhole, and blackhole traffic. This dataset was enriched with protocol-specific features such as DIO and DAO indicators. We also implemented the Synthetic Minority Oversampling Technique (SMOTE) to balance the dataset. The six machine learning algorithms evaluated include three supervised (Random Forest, XGBoost, SVM) and three unsupervised (Isolation Forest, One-Class SVM, Autoencoder).The Random Forest model that was trained on the balanced dataset came out on top after all the experiments were completed. It achieved a perfect 100% recall, 99.8% accuracy and precision, and an F1 score of 0.998. In other words, it detected nearly every attacks without sending out unnecessary alerts. The performance is also more in line with what is anticipated in actual deployments because, in contrast to earlier research, this is the first to identify a combined sinkhole–blackhole attack in RPL-based IoT networks.