A study published in Cluster Computing reveals a lightweight, optimized machine learning model that detects black hole attacks in RPL-based IoT networks with an accuracy of 98.71%. The emphasis is on edge deployment to keep detection fast and local.

The model uses OPTUNA for Bayesian optimization to tune hyperparameters like tree depth and split criteria, balancing model complexity and generalization for resource-limited edge devices.

The authors argue that lightweight detectors running at the edge are essential for defending billions of IoT devices, since cloud-based solutions can be impractical due to power and latency constraints.

Black hole attacks exploit trusted routing by advertising attractive parents in the RPL tree, causing legitimate traffic to be dropped without obvious failure signs, posing particular risk to critical IoT applications.

Evaluation is conducted on a benchmark RPL-based IoT dataset under normal and attack conditions, enabling supervised learning to distinguish malicious routing behavior from legitimate activity.

A key takeaway is that carefully optimized simple models can deliver strong intrusion-detection performance suitable for edge deployment, offering a scalable security foundation for IoT against black hole attacks.

Compared with neural networks, CNNs, and ensemble methods, the optimized decision tree achieves competitive accuracy with far lower computational and memory demands.

The study places black hole attacks within the broader RPL threat landscape, noting related risks such as rank, version number, and Sybil attacks, and cites the STRIDE framework for threat modeling.

Researchers employ decision trees enhanced with Bayesian hyperparameter optimization via OPTUNA to reach high accuracy while remaining suitable for constrained IoT devices.