A spatio-temporal graph learning framework with attention mechanism for secure RPL in mobile IoT

Abstract

Mobility‑aware IoT networks operate under rapidly shifting topologies, where even authorized nodes can perform stealthy routing attacks that bypass standard cryptographic defenses. These threats are compounded by dynamic connectivity patterns, fluctuating link qualities, and heterogeneous node behaviors, creating a high‑dimensional, non‑stationary security landscape. We introduce a temporal–spatial trust framework that represents the network as a continuously evolving dynamic graph, embedding per‑node behavioral states together with aggregated neighborhood patterns across structural, mobility, and traffic domains. These high‑context sequences feed into a multi‑layer GRU‑based Sequence‑to‑Sequence architecture equipped with multi‑head attention, enabling concurrent modeling of local temporal fluctuations and long‑range spatial dependencies. A composite trust scoring mechanism integrates model‑inferred anomalies with deterministic protocol checks and peer‑reported reputation, regulated by hyper‑parameter‑optimized fusion weights. Trust scores are embedded into RPL’s rank metric and filtered through a hysteresis‑governed parent selection policy to ensure both rapid threat isolation and topological stability. Extensive simulations in Contiki-NG, leveraging real-world urban mobility traces from the Microsoft GeoLife dataset and the RADAR benchmark, demonstrate robustness against five specific threats (Rank, Blackhole, Sybil, Sinkhole, and Selective Forwarding). Results indicate up to 96 % detection accuracy, a 38 % reduction in detection latency, and 20–40 % lower control overhead, all while maintaining a runtime memory footprint under 10 KB. By combining dynamic graph‑based context encoding, attention‑driven sequence learning, and multi‑source trust fusion, the proposed approach offers a deployable, high‑fidelity, and scalable security enhancement for RPL in next‑generation IoT environments.