A Signature-based Intrusion Detection System for the Internet of Things - Paper

Aug 24, 2026

Internet of Things (IoT) enables applications across home automation, industrial control, and agriculture, yet it remains exposed to attacks exemplified by the Mirai botnet. Resource limits on typical IoT devices make conventional security mechanisms hard to deploy, motivating intrusion detection that can handle both external threats and internally compromised devices. The work designs a signature-based IDS with centralized and distributed modules, implemented using the Cooja simulator. Simulated DoS variants exploiting the RPL protocol—“Hello” flooding and version number modification—demonstrate impacts on device reachability and power consumption.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages7

Reading Time18 min

AccessFree to download

Abstract

Introduction

IoT growth and security challenges

Intrusion detection approaches

Proposed signature-based IDS and hybrid placement

[eprints@whiterose.ac.uk](eprints@whiterose.ac.uk)[ ](eprints@whiterose.ac.uk)[https://eprints.whiterose.ac.uk](https://eprints.whiterose.ac.uk) Universities of Leeds, Sheffield and York Deposited via The University of York. White Rose Research Online URL for this paper: [https://eprints.whiterose.ac.uk/id/eprint/133312/](https://eprints.whiterose.ac.uk/id/eprint/133312/) Conference or Workshop Item: Ioulianou, Philokypros, Vasilakis, Vasileios, Moscholios, Ioannis et al. (Accepted: 2018) A Signature-based Intrusion Detection System for the Internet of Things. In: Information and Communication Technology Form, 11-13 Jul 2018. (In Press) Reuse Items deposited in White Rose Research Online are protected by copyright, with all rights reserved unless indicated otherwise. They may be downloaded and/or printed for private study, or other acts as permitted by national copyright laws. The publisher or other rights holders may allow further reproduction and re-use of the full text version. This is indicated by the licence information on the White Rose Research Online record for the item. Takedown If you consider content in White Rose Research Online to be in breach of UK law, please notify us by emailing [eprints@whiterose.ac.uk](eprints@whiterose.ac.uk) including the URL of the record and the reason for the withdrawal request. A Signature-based Intrusion Detection System for the Internet of Things Philokypros P. Ioulianou∗ , Vassilios G. Vassilakis∗ , Ioannis D. Moscholios†, Michael D. Logothetis‡ ∗ Dept. of Computer Science, University of York, York, United Kingdom †Dept. of Informatics & Telecommunications, University of Peloponnese, Tripolis, Greece ‡Dept. of Electrical & Computer Engineering, University of Patras, Patras, Greece Abstract—Internet of Things (IoT) is envisioned as a transformative approach with a wide range of applications in various sectors such as home automation, industrial control, and agriculture. It promises innovative business models and improved user experience. However, as evidenced by recent attacks such as the Mirai botnet, IoT networks and systems remain very vulnerable and require stronger protection mechanisms. Furthermore, due to processing, memory, and power constraints of typical IoT devices, traditional Internet security mechanisms are not always feasible or appropriate. In this work, we are concerned with designing an Intrusion Detection System (IDS) for protecting IoT networks from external threats as well as internal compromised devices. Our proposed design adopts a signature-based intrusion detection approach and involves both certralised and distributed IDS modules. Using the Cooja simulator, we have implemented a Denial of Service (DoS) attack scenario on IoT devices. This scenario exploits the RPL protocol, which is widely used for routing in low-power networks, including IoT networks. In particular, we have implemented two variants of DoS attacks, namely “Hello” ﬂooding and version number modiﬁcation. As shown by simulation results, these attacks may impact the reachability of certain IoT devices and their power consumption. I. INTRODUCTION The rapid growth of smart devices led to an Internetconnected world called “Internet of Things”(IoT) [1] . In the literature, these devices are usually referred to as “things”, IoT devices, smart devices, sensors, or motes. IoT devices are typically resource-constrained (low processing power, small batteries, limited memory), but can connect to the Internet, exchange data, and perform limited computations. Some known IoT application domains are smart home, industrial control, health monitoring, and smart grid [2, 3] . However, apart from the obvious beneﬁts, IoT brought new security and privacy challenges. According to a recent report by Gemalto [4], securing smart devices is not a priority for manufacturers. This enables the attackers to target IoT devices with weak security measures. A recent example of a cyber attac

FAQs

How does the proposed system detect attacks in IoT networks?

The proposed IDS adopts a signature-based intrusion detection approach and uses both centralized and distributed IDS modules. It is implemented in the Cooja simulator and tested against DoS scenarios targeting the RPL routing protocol.

Aug 24, 2026

Uploaded by Chloe Bennett