HADTF: a hybrid autoencoder–decision tree framework for improved RPL-based attack detection in IoT networks based on enhanced feature selection approach

The Internet of Things (IoT) is evolving rapidly, increasing demand for safeguarding data against routing attacks. While achieving complete security for RPL protocols remains an ongoing challenge, this paper introduces an innovative hybrid autoencoder–decision tree framework (HADTF) designed to detect four types of RPL attacks: decreased rank, version number, DIS flooding, and blackhole attacks. The HADTF comprises three key components: enhanced feature extraction, feature selection, and a hybrid autoencoder–decision tree classifier. The enhanced feature extraction module identifies the most pertinent features from the raw data collected, while the feature selection component carefully curates’ optimal features to reduce dimensionality. The hybrid autoencoder–decision tree classifier synergizes the strengths of both techniques, resulting in high accuracy and detection rates while effectively minimizing false positives and false negatives. To assess the effectiveness of the HADTF, we conducted evaluations using a self-generated dataset. The results demonstrate impressive performance with an accuracy of 97.41%, precision of 97%, recall of 97%, and F1-score of 97%. These findings underscore the potential of the HADTF as a promising solution for detecting RPL attacks within IoT networks.