Work

AD2EF-Net: an adaptive dropout artificial neural network with behavior-aware feature engineering for version number attack detection in RPL-based IoT networks

Year: 2026

Type: article

Abstract: Internet of Things (IoT) networks commonly employ the Routing Protocol for Low-Power and Lossy Networks (RPL), where Version Number (VN) attacks can trigger unnecessary global repairs and persistent routing instability. This paper presents AD2EF-Net, an ANN-based VN-attack detection framework that integrates SHAP-guided offline analysis, behavior-aware feature engineering, intersection-consensus feature selection, and a self-tuning adaptive-dropout mechanism. To avoid information leakage, the revised experimental protocol performs the stratified 60/20/20 train/validation/test split before training-dependent preprocessing; SMOTE, Min–Max scaling, and feature selection are fitted exclusively on the training partition and then applied unchanged to validation and held-out test data. Under this corrected protocol, the final evaluated AD2EF-Net pipeline achieved 90.49% accuracy, 84.54% precision, 98.19% recall, a 90.86% F1 score, and a 95.99% AUC on the held-out test set. A controlled ten-seed dropout ablation showed only small differences among no-dropout, fixed-rate, and adaptive configurations: adaptive dropout achieved 92.45 ± 0.21% accuracy, 92.49 ± 0.20% F1, and the highest mean AUC (97.36 ± 0.13%), while fixed rates produced slightly higher mean accuracy, F1, or recall in some cases. A separate feature-selection ablation showed that the intersection-consensus strategy is not the highest-performing selector on this dataset; Extra Trees top-16 achieved stronger predictive performance, whereas the intersection-consensus configurations are discussed as consensus-based design trade-offs rather than as the highest-performing feature-selection strategy. The revised results therefore support AD2EF-Net as a transparent, leak-free framework with high recall on the evaluated IRAD benchmark, while avoiding claims of universal superiority, generalizability, or deployment readiness.

Source: Scientific Reports

DOI: 10.1038/s41598-026-77742-9

Authors: Nadia Adnan Alfriehat, Mohammed Anbar, Mohammad Aljaidi, Mohammad Ahmad, Mohammad Arafah, Ziyad R. Alashhab, Ahmad Alshammari, Shankar Karuppayah

Institutions: Middle East University, Universiti Sains Malaysia, Zarqa University, University of Bedfordshire, Petra University, Northern Border University

Language: English

Topic: Network Security and Intrusion Detection

Subfield: Computer Networks and Communications

Field: Computer Science

Domain: Physical Sciences

Open Access status: gold

Estimated APC paid: $2,690

OpenAlex ID: W7225817177

FWCI:

Cites:

Cited by:

Related to: