Routing over low power and lossy networks (RPL) is a standardized routing protocol for constrained Wireless Sensor Network (WSN) environments. The main node's constraints include processing capability, power, memory, and energy. RPL protocol describes how WSN nodes create a mesh topology, enabling them to route sensor data. Unfortunately, various attacks exist on the RPL protocol that can disrupt the topology and consume nodes' energy. In this article, the authors propose an intrusion detection system (IDS) based on self-organizing map (SOM) neural network to cluster the WSN routing attacks, and hence notify the system administrator at an early stage, reducing the risk of interrupting the network and consuming nodes' power. Results showed that the proposed SOM architecture is able to cluster routing packets into three different types of attacks, as well as clean data.
