Machine learning-based intrusion detection systems (IDS) for RPL-based IoT networks often rely solely on routing layer features, which provide only a partial view of network behaviour. In this work, we investigate whether incorporating Transmit (TX) and Receive (RX) radio features alongside the standard RPL feature set can improve detection performance in an LSTM-based IDS. We evaluate the proposed approach across three different attack types, namely DIS-Flooding, Local Repair, and Worst Parent under varying network sizes. The results show that incorporating TX and RX improves the IDS's overall detection performance by up to ~4% in F1-score compared with using routing-layer features alone, with the most notable gain observed for the Worst Parent attack.

翻译：基于机器学习的入侵检测系统（IDS）在基于RPL的物联网网络中通常仅依赖路由层特征，这只能提供网络行为的部分视图。本研究探讨了在基于LSTM的入侵检测系统中，将发送（TX）和接收（RX）无线电特征与标准RPL特征集相结合是否能提升检测性能。我们针对三种不同类型的攻击——即DIS洪泛攻击、本地修复攻击和最差父节点攻击——在不同网络规模下评估了所提方法。结果表明，与仅使用路由层特征相比，纳入TX和RX特征使入侵检测系统的整体检测性能（F1分数）提升高达约4%，其中在最差父节点攻击中观察到最显著的增益。