Vol.:(0123456789) Wireless Personal Communications https://doi.org/10.1007/s11277-019-06485-w 1 3 Evaluation of Network Intrusion Detection Systems for RPL Based 6LoWPAN Networks in IoT Abhishek Verma 1  · Virender Ranga 1 © Springer Science+Business Media, LLC, part of Springer Nature 2019 Abstract Over the past few years, Internet of Things security has attracted the attention of many researchers due to its challenging and constrained nature. Particularly in the development of Network Intrusion Detection Systems which act as frst line of defence for the networks. Due to the lack of reliable Internet of Things based datasets, intrusion detection approaches are sufering from uniform and accurate performance advancements. Existing benchmark datasets like KDD99, NSL-KDD cup 99 are obsolete and unft for the evaluation of Net- work Intrusion Detection Systems developed for RPL based 6LoWPAN networks. To address this issue, the RPL-NIDDS17 dataset has recently been generated. This dataset consists seven types of modern routing attack patterns along with normal trafc patterns. In the proposed dataset we consider twenty two attributes that comprise of fow, basic, time type of features and two additional labelling attributes. In this study, we have shown the efectiveness of RPL-NIDDS17 by statistically analysing the probability distribution of features, correlation between features. Complexity analysis of the developed dataset is done by evaluating fve machine learning techniques on the dataset. Evaluation results are shown in terms of two prominent metrics accuracy and false alarm rate, and compared with the results of KDD99, UNSW-NB15, WSN-DS datasets. The experimental results are pre- sented to show the suitability of our proposed RPL-NIDDS17 dataset for the evaluation of Network Intrusion Detection Systems in Internet of Things. Keywords Internet of Things · RPL · 6LoWPAN · Network Intrusion Detection · Anomaly · Signature · Machine learning 1 Introduction According to IDC [1], by 2020 there will be projected 30 billion connected “things” world- wide. With this much of increase in the number of IoT devices ,network trafc from them will also increase drastically. In recent years, a lot of security attacks on the IoT networks * Abhishek Verma abhiverma866@gmail.com Virender Ranga virender.ranga@nitkkr.ac.in 1 Department of Computer Engineering, National Institute of Technology, Kurukshetra, India