OEAD: An Online Ensemble-based Anomaly Detection technique for RPL network

Abstract

Routing Protocol for Low-Power and Lossy Networks (RPL) is a widely used routing protocol in low-power and lossy networks especially when convergecast traffic is predominant. RPL routing protocol can be widely used in applications (such as smart grids, smart homes, or smart city applications) that use convergecast traffic in which nodes transmit data to a central node in a multi-hop fashion for monitoring and control purposes. However, the RPL routing protocol is prone to several attacks, and such anomalous conditions are to be identified at the earliest to prevent a network failure. Most of the recent works for anomaly detection rely on supervised machine learning techniques. A supervised network can thus only identify the categories on which it has been trained prior. Due to the wide variety of attacks to which the networks are prone, the supervised techniques are of limited use in practical applications. In this work, we propose an Online unsupervised Ensemble-based Anomaly Detection (OEAD) technique for anomaly detection. This online model can be adapted and retrained using the latest and representative traffic that reflects the current network conditions. A drift detector unit to identify significant changes in the network traffic is utilized in OEAD architecture which can update the ML model on the detection of drift in the network. The proposed OEAD technique is tested on a publicly available RADAR dataset and the results indicate that the proposed technique is promising for anomaly detection in real-time applications.