Rethinking IoT Intrusion Detection: Augmenting Routing Metrics with Radio Features Yichang Sun, Andreas Johnsson, and Sourasekhar Banerjee,
arXiv:2606.07282v1 [cs.CR] 5 Jun 2026
Uppsala University, Department of Information Technology, Sweden Email: {yichang.sun.3197, andreas.johnsson, sourasekhar.banerjee}@it.uu.se
Abstract—Machine learning-based intrusion detection systems (IDS) for RPL-based IoT networks often rely solely on routinglayer features, which provide only a partial view of network behaviour. In this work, we investigate whether incorporating Transmit (TX) and Receive (RX) radio features alongside the standard RPL feature set can improve detection performance in an LSTM-based IDS. We evaluate the proposed approach across three different attack types, namely DIS-Flooding, Local Repair, and Worst Parent under varying network sizes. The results show that incorporating TX and RX improves the IDS’s overall detection performance by up to ∼ 4% in F1-score compared with using routing-layer features alone, with the most notable gain observed for the Worst Parent attack. Index Terms—Internet of Things, Network Intrusion Detection Systems, RPL, LSTM, Compute and Radio Metrics
I. I NTRODUCTION The Internet of Things (IoT) has become a key enabler of modern digital infrastructure across smart homes, healthcare, and industrial systems. Many such deployments operate over low-power and lossy networks, where the IPv6 Routing Protocol for Low-Power and Lossy Networks (RPL) provides scalable and efficient routing. However, RPL remains vulnerable to a broad range of routing attacks that can disrupt topology formation, degrade packet delivery, increase control overhead, and exhaust node resources. This problem motivates the need for robust intrusion detection systems (IDS) in IoT networks [1], [2]. Machine learning-based IDS has shown promising results by learning traffic patterns associated with normal and malicious behaviour [3], with LSTM models being particularly effective due to their ability to capture temporal dependencies in sequential network data. Prior works [4]–[6] have demonstrated that RPL control traffic statistics collected at the sink node can be used to train effective IDS models, though detection performance remains sensitive to attack type, topology, and network size. However, existing approaches largely rely on routing-layer features alone [3], [6]. Previous studies [7] have also shown that RPL-oriented denial-of-service attacks can substantially affect device-level communication and resource-consumption behaviour, including transmit (TX) and receive (RX) signal activity, CPU time, and power draw [7], [8]. Many RPL-based attacks affect not only routing behaviour, but also radio activity, meaning this routing-centric view may provide an incomplete representation of attack impact. Moreover, cross-layer intrusion detection approaches have begun to show that incorporating lower-layer
Fig. 1. Proposed LSTM-based IDS framework for RPL-based IoT networks
features alongside routing statistics can improve detection performance in RPL-based IoT networks [9]. Motivated by the observation that existing IDS approaches [5], [6] rely primarily on routing-layer features, this paper investigates whether extending the RPL feature set with Transmit (TX) and Receive (RX) radio features can improve intrusion detection performance. TX and RX capture node-level communication behaviour that routing-layer statistics alone cannot observe. For example, DIS-Flooding forces neighbouring nodes to reset their trickle timers and respond with DIO broadcasts. That increases the RX count at those nodes beyond normal operational levels. Since these attack-induced changes in radio activity evolve over time, we employ an LSTM-based classifier to capture temporal dependencies in sequential network data. Contributions: We extend the baseline RPL feature set [5], [6] with TX and RX radio features and evaluate their impact on LSTM-based intrusion detection in RPL-based IoT networks. We further compare multiple feature configurations across three attack types, three behavioural variants (base, on-off, and gradual change), and different network sizes (5, 10, 15, 20) to assess the contribution of radio features relative to the RPLonly baseline within the current experimental pipeline. II. S YSTEM M ODEL AND P ROBLEM F ORMULATION In Figure 1, we illustrate the proposed LSTM-based IDS framework for an RPL-based IoT network. It consists of N nodes: a set of normal IoT nodes forming a DODAG, a single sink node at the root responsible for data collection, and one attacker injecting malicious behaviour into the network. The sink node passively aggregates two categories of features from the network. The first category comprises RPL features, including Rank, DIS, DIO, and DAO control message statistics
Accepted to Swedish National Computer Networking Workshop (SNCNW) 2026
that capture routing-layer behaviour. The second category consists of radio features, comprising TX and RX activity that reflect node-level communication patterns. The IDS processes these combined features to classify network behaviour as either Normal or Under Attack. The problem can therefore be formulated as follows. At each time step t, the sink node observes a feature vector composed of RPL control traffic statistics: xRPL = [Rank, DIS, DIO, DAO, · · · ] t We extend this baseline representation by incorporating radio features: RPL xaug ∥ TXt , RXt ] t = [xt where ∥ denotes concatenation. Given a sequence X = [x1 , . . . , xT ], an LSTM-based classifier fθ is trained to map the input to a label y ∈ {0, 1}, corresponding to normal behaviour or not. The objective is to find an augmented feature representation that maximizes the detection performance of the LSTM-based IDS: x∗t = arg maxaug P(fθ (X), y) xt ∈xt
where y is the true label, and P denotes detection performance measured by F1-score across attack types, their behavioural variants, and network sizes. III. E XPERIMENTAL S ETUP Datasets: We extend the publicly available simulation scripts from [10], which originally collect only RPL control traffic statistics, by incorporating additional scripts to extract TX and RX radio features from the Cooja/Contiki-NG [11] environment. In the current implementation, these radio features are derived from log outputs that capture node-level radio activity during the simulation. Using this extended pipeline, we simulate three RPL-based attack types, namely DIS-Flooding, Local Repair, and Worst Parent, each evaluated under three behavioural variants, i.e., base, on–off, and gradual change, across network sizes of 5, 10, 15, and 20 nodes. For each configuration, 20 independent simulation runs are performed, each producing one CSV file containing the recorded RPL and radio statistics. These logs are subsequently processed into window-level features for IDS training and evaluation. Features: The RPL feature vector xRPL ∈ R14 is constructed t from the mean (µ) and standard deviation (σ) of seven routinglayer statistics observed at the sink node: s r xRPL = µRank , σRank , µsDIS , σDIS , µrDIS , σDIS , t s s r r r r µDIO , σDIO , µDIO , σDIO , µDAO , σDAO , µtots , σtots where superscripts s and r denote message sent and received counts respectively, and tots denotes the total number of messages observed at the sink node. To extend this representation, we incorporate radio features intended to reflect node-level transmission and reception activity: xradio = µTX , σTX , µRX , σRX ∈ R4 t
The full augmented feature vector is formed by concatenating the RPL and radio feature sets: RPL xaug ∥ xradio ] ∈ R18 t = [ xt t
Model: We employ an LSTM-based model for binary classification of network behaviour into normal (0) and attack (1) classes. Given an input sequence X = [x1 , x2 , . . . , xT ] ∈ RT ×d , where T is the window length and d is the input dimension, the LSTM computes a hidden state at each time step: ht = LSTM(xt , ht−1 ) The final hidden state hT ∈ RH is passed through a fully connected output layer with a sigmoid activation to produce the attack probability: p̂ = σ(WhT + b),
p̂ ∈ (0, 1)
where W and b are learnable parameters and σ(·) is the sigmoid function. The predicted class is obtained as y ∗ = 1[p̂ > 0.5], corresponding to either normal or attack traffic. The input dimension d depends on the feature configuration: d = 14 for the RPL-only baseline and d = 18 for the augmented setting. The model is configured with a hidden size of H = 10, a dropout rate of 0.3, and is trained using the binary cross-entropy loss: N
L=−
1 X yi log(p̂i ) + (1 − yi ) log(1 − p̂i ) N i=1
where yi ∈ {0, 1} is the true label and p̂i is the predicted probability of the attack class for sample i. IDS learning and evaluation: An independent LSTM model is trained and evaluated for each experimental configuration, defined by a combination of attack type, behavioural variant, and network size. This results in a total of 3 × 3 × 4 = 36 configurations, covering three attack types (DIS-Flooding, Local Repair, and Worst Parent), three behavioural variants (base, on–off, and gradual change), and four network sizes (N ∈ {5, 10, 15, 20}). The sequential input samples are generated using a slidingwindow approach with a window size of 10 and a step size of 3. The model is trained using the AdamW optimizer with a learning rate of 0.001 and the binary cross-entropy loss. The batch size is set to 128, and training runs for 50 epochs. The best model checkpoint is selected based on the lowest validation loss. The IDS is evaluated by the F1-Score. IV. R ESULTS A. Radio Feature Analysis Figure 2 shows the kernel density distributions of the mean and standard deviation of TX and RX under normal and attack conditions for the base variant of three RPL-based IoT attacks (DIS-Flooding, Local Repair, and Worst Parent) in a 20-node network. The Kolmogorov–Smirnov (KS) statistic [12] quantifies the separation between normal and attack distributions, with a higher value indicating greater separability.
Accepted to Swedish National Computer Networking Workshop (SNCNW) 2026
(a) DIS-Flooding
(b) Local Repair
(c) Worst Parent Fig. 2. Feature distributions of TX and RX (mean and std) under normal and attack conditions for three RPL-based attacks in a 20-node network (base variant), averaged over 20 independent simulation runs. The Kolmogorov– Smirnov (KS) statistic quantifies the separation between normal and attack distributions, where a higher value indicates greater statistical divergence between the two classes.
Across all three attack types, RX mean consistently achieves a perfect KS score of 1.000, indicating complete distributional separation between normal and attack traffic. TX mean also exhibits strong separation, with KS values ranging from 0.837 (Worst Parent) to 0.896 (DIS-Flooding). The standard deviation features, TX std and RX std, show comparatively lower but still substantial KS values, ranging from 0.732 to 0.820. The KS statistic ranges from 0 to 1, where a value closer to 1.0 indicates greater statistical divergence between the normal and attack class distributions. Since all evaluated TX and RX features achieve KS scores above 0.7, the normal and attack distributions are well-separated, reflecting how attack conditions shift wireless transmission and reception activity at the node level beyond normal operational levels. This strong distributional separability suggests that incorporating TX and RX into IDS training will provide the LSTM classifier with discriminative signals that are not captured by RPL controlmessage statistics alone. B. Effect of TX and RX Features on IDS Performance To systematically evaluate the contribution of TX and RX features to IDS detection performance, we design an ablation study comparing five feature configurations. The baseline configuration uses only RPL features, comprising 14 features constructed from the mean and standard deviation of seven routing-layer statistics: Rank, DIO sent, DIO received, DIS sent, DIS received, DAO received, and total messages. The remaining four configurations are: (i) All features (RPL + TX + RX, 18 features), which evaluates the full augmented feature set; (ii) TX and RX only (4 features), which isolates the
discriminative power of radio features alone; (iii) All except RX (RPL + TX, 16 features), which assesses the individual contribution of TX; and (iv) All except TX (RPL + RX, 16 features), which assesses the individual contribution of RX. Together, these configurations allow us to determine whether TX and RX provide complementary information to RPL features, and whether one radio feature is more informative than the other. Each configuration is evaluated across three attack types, three behavioural variants (base, on–off, and gradual change), and four network sizes (N ∈ {5, 10, 15, 20}), resulting in 12 experimental configurations per attack type. The mean F1score is aggregated across all variants and network sizes for each attack type, given in Figure 3. For DIS-Flooding (Figure 3a), the TX and RX-only configuration achieves the highest score of 0.990, marginally outperforming the full feature set (0.986), the RPL-only baseline (0.984), and the two ablation configurations (0.986 and 0.985). The narrow performance gap across all configurations suggests that DIS-Flooding induces strong and consistent changes in both routing and radio activity, making it highly detectable regardless of the feature set used. For Local Repair (Figure 3b), the TX and RX-only configuration achieves the highest F1-score of 0.999, substantially outperforming the full feature set (0.983), the RPL-only baseline (0.980), and the two ablation configurations (0.976 and 0.982). Notably, removing RX causes a larger performance drop (0.976) than removing TX (0.982), indicating that RX contributes more discriminative information than TX for this attack type. Local Repair attacks trigger repeated DODAG reconstruction cycles that generate bursts of control message transmissions, elevating reception activity at neighbouring nodes beyond normal levels — a pattern that RX captures more effectively than RPL statistics alone. For Worst Parent (Figure 3c), the TX and RX-only configuration again achieves the highest F1-score of 0.998, while the RPL-only baseline yields the lowest score of 0.957, indicating that routing-layer features alone are insufficient for detecting this attack. Removing RX causes a drop to 0.967, while removing TX yields a higher score of 0.975, confirming that RX is the more dominant radio feature for Worst Parent detection. The full 18-feature set scores 0.970, which is lower than the TX and RX-only configuration, suggesting that combining RPL and radio features introduces some redundancy that slightly reduces detection performance for this attack type. Unlike RPL features, which capture routing protocollevel responses to attacks, TX and RX directly reflect nodelevel communication activity, providing a more immediate and sensitive signal. Attacks such as Worst Parent subtly manipulate routing decisions without strongly affecting RPL statistics, yet their impact on packet transmission and reception is directly measurable through TX and RX. V. R ELATED W ORK Machine learning-based IDS has been widely studied for RPL-based IoT networks, where sink-collected RPL controltraffic statistics serve as effective security signals. Kaveh et al. [4], [5] demonstrated that attack variations and topology
Accepted to Swedish National Computer Networking Workshop (SNCNW) 2026
(a) DIS-Flooding
(b) Local Repair
(c) Worst Parent
Fig. 3. Mean F1 scores of different feature configurations for each attack type: DIS-Flooding, Local Repair, and Worst Parent. Each value is computed over the complete dataset for the corresponding attack type, including all CSV files generated across all attack variants and network sizes.
changes significantly affect IDS generalizability, showing that models trained on one attack variation may perform poorly under another. Complementing this, Violettas et al. in [13] proposed ASSET, a softwarized IDS for RPL networks combining anomaly-based and specification-based detection with centralized monitoring and attacker identification, highlighting the value of cross-layer visibility in constrained IoT environments. From a broader attack coverage perspective, Garcia Ribera et al. [14] designed a hybrid IDS that targets multiple RPL attacks, including Blackhole, DIS, and version number attacks, and notably analysed detection overhead in terms of CPU usage and transmission/reception activity [14]. Prajapati et al. in [2], [15] proposed a taxonomy of attack categories and discussed defence mechanisms, datasets, and open challenges. Despite these advances, existing studies rely predominantly on routing-layer features, providing only a partial view of network activity. In [9], the authors showed that incorporating link-layer features alongside routing statistics can reduce false positives and improve detection in RPL-based IoT networks. However, radio-level features such as TX and RX have not been systematically incorporated into learning-based IDS models. Our work addressed this gap and evaluated its impact on LSTM-based intrusion detection. VI. C ONCLUSIONS AND F UTURE S COPE In this paper, we augmented the RPL feature set with Transmit (TX) and Receive (RX) radio features and evaluated their impact on LSTM-based IDS performance across three attack types, three behavioural variants, and network sizes of 5 to 20 nodes. The TX and RX-only configuration achieves the highest F1-score across all three attack types, and the All except TX configuration consistently outperforms the All except RX configuration, confirming that receiver-side communication activity is a more discriminative signal for RPL-based attack detection. These results demonstrate that TX and RX provide discriminative information beyond RPL routing-layer statistics, making them effective features for building IDS. As future work, we plan to incorporate RSSI and LQI features, conduct feature importance analysis, and evaluate the cross-attack generalizability of the trained models.
ACKNOWLEDGMENT This research has been supported by the Swedish Governmental Agency for Innovation Systems (VINNOVA) through the project Robust IoT Security: Intrusion Detection Leveraging Contributions from Multiple Systems (2023-02982). R EFERENCES [1] A. Raoof et al., “Routing attacks and mitigation methods for RPL-based Internet of Things,” IEEE Communications Surveys & Tutorials, vol. 21, no. 2, pp. 1582–1606, 2018. [2] A. K. Prajapati et al., “A comprehensive survey on rpl routing-based attacks, defences and future directions in internet of things,” Computers and Electrical Engineering, vol. 123, p. 110071, 2025. [3] S. W. Azumah et al., “A deep lstm based approach for intrusion detection iot devices network in smart home,” in IEEE 7th World Forum on Internet of Things (WF-IoT). IEEE, 2021, pp. 836–841. [4] A. Kaveh et al., “Impact of attack variations and topology on iot intrusion detection model generalizability,” in 2024 IEEE 21st International Conference on Mobile Ad-Hoc and Smart Systems (MASS). IEEE, 2024, pp. 364–370. [5] A. Kaveh et al., “Factors influencing lstm model generalizability for iot intrusion detection,” in 2025 IEEE 11th International Conference on Network Softwarization (NetSoft). IEEE, 2025, pp. 537–545. [6] S. Banerjee et al., “Quantifying catastrophic forgetting in iot intrusion detection systems,” arXiv preprint arXiv:2603.00363, 2026. [7] P. Przybocki et al., “An analysis into physical and virtual power draw characteristics of embedded wireless sensor network devices under dos and rpl-based attacks,” Sensors, vol. 23, no. 5, p. 2605, 2023. [8] R. Smith et al., “Battery draining attacks against edge computing nodes in iot networks,” Cyber-Physical Systems, 2020. [9] E. Canbalaban et al., “A cross-layer intrusion detection system for rplbased internet of things,” in Ad-Hoc, Mobile, and Wireless Networks. Springer, 2020, pp. 214–227. [10] https://github.com/uu-core/IoT-Attacks-IDS, accessed: 2026-04-23. [11] N. Finne et al., “Multi-trace: Multi-level data trace generation with the cooja simulator,” in 17th International Conference on Distributed Computing in Sensor Systems (DCOSS). IEEE, 2021, pp. 390–395. [12] F. Massey Jr et al., “The kolmogorov-smirnov test for goodness of fit,” Journal of the American statistical Association, vol. 46, no. 253, pp. 68–78, 1951. [13] G. Violettas et al., “A softwarized intrusion detection system for the rpl-based internet of things networks,” Future Generation Computer Systems, vol. 125, pp. 698–714, 2021. [14] G. Ribera et al., “An intrusion detection system for rpl-based iot networks,” Electronics, vol. 11, no. 23, p. 4041, 2022. [15] A. O. Bang et al., “Assessment of routing attacks and mitigation techniques with RPL control messages: A survey,” ACM Computing Surveys (CSUR), vol. 55, no. 2, pp. 1–36, 2022.
Accepted to Swedish National Computer Networking Workshop (SNCNW) 2026