Intrusion Detection Using Hybrid Pearson Correlation and GS-PSO Optimized Random Forest Technique for RPL-Based IoT

RPL (Routing Protocol for Low-Power and Lossy Networks) is a standardized routing protocol of IoT proposed by IETF (Internet Engineering Task Force) Working Group. The escalating surge of cyberattacks targeting IoT systems has exposed critical security vulnerabilities in RPL-based networks. Attackers exploit routing spoofing, resource depletion tactics, and topology manipulation strategies, while inherent constraints of resource-limited devices and scalability challenges in mass deployments amplify these risks. This critical security gap therefore necessitates the deployment of lightweight IDS (Intrusion Detection Systems) to achieve real-time anomaly detection and monitoring However, the current IDS for RPL-based IoT has certain limitations such as routing attacks dataset lack coverage of a sufficient variety of routing attacks and detection methods involve significant computational overhead. To address these problems, we have conducted the following research work. First, a novel routing attacks dataset that covers four RPL routing attack types is constructed through simulation on the Cooja IoT platform. And we develop feature extraction algorithms for dataset to extract 24 features implementing in IDS model training. Second, we propose an efficient routing detection method that accelerates model training speed by using Hybrid Pearson Correlation and GS-PSO(Grid Search-Particle Swarm Optimization) Optimized Random Forest Technique. The Pearson correlation can effectively extract key data features for different routing attacks. And the hybrid GS-PSO algorithm can optimize the hyperparameters of IDS model and enhance the accuracy of the detection mechanism while significantly reducing computational overhead. Finally, we demonstrate our IDS model has higher detection accuracy and lower computation time compared to other existing models through simulation experiments.