In routing protocol for low power and lossy networks (RPL) security, intrusion detection (ID) plays a vital role, especially given its susceptibility to attacks, particularly those carried out by insider threats. While numerous studies in the literature have proposed ID systems (IDSs) utilizing diverse techniques, the placement of such systems within RPL topology remains largely unexplored. This study aims to address this gap by rigorously evaluating three ID architectures, considering central and distributed placement, across multiple criteria, including effectiveness, cost, privacy, and security. The findings underscore the significant impact of attacker position and the proximity of IDS to attackers on detection outcomes. Hence, alongside the evaluation of traditional ID architectures, this study explores the use of federated learning (FL) for improving ID within RPL networks. FL’s decentralized model training approach effectively addresses the impact of attacker position on IDS performance by ensuring the collection of relevant information from nodes regardless of their proximity to potential attackers. Moreover, this approach not only mitigates security concerns but also minimizes communication overhead among ID nodes. Consequently, FL reduces the need for extensive data transfer, thus mitigating the impact of packet loss and latency inherent in lossy networks. Additionally, the study investigates the effect of local data sharing on FL performance, clarifying the balance between effectiveness and security.

In recent years, Internet of Things (IoT) security has attracted significant interest by researchers due to new characteristics of IoT such as heterogeneity of devices, resource constraints, and new types of attacks targeting IoT. Intrusion detection, which is an indispensable part of a security system, is also included in these studies. In order to explore the complex characteristics of IoT, machine learning methods, which rely on long training time to generate intrusion detection models, are proposed in the literature. Furthermore, these systems need to learn a new/fresh model from scratch when the environment changes. This study explores the use of transfer learning in order to generate intrusion detection algorithms for such dynamically changing IoT. Transfer learning is an approach that stores knowledge learned from a problem domain/task and applies that knowledge to another problem domain/task. Here, it is employed in the following two settings: transferring knowledge for generating suitable intrusion algorithms for new devices, transferring knowledge for detecting new types of attacks. In this study, Routing Protocol for Low-Power and Lossy Network (RPL), a routing protocol for resource-constrained wireless networks, is used as an exemplar protocol and specific attacks against RPL are targeted. The experimental results show that the transfer learning approach gives better performance than the traditional approach. Moreover, the proposed approach significantly reduces learning time, which is an important factor for putting devices/networks in operation in a timely manner. Even though transfer learning has been considered a potential candidate for improving IoT security, to the best of our knowledge, this is the first application of transfer learning under these two settings in RPL-based IoT networks.