  IPv6 over Low-powered Wireless Personal Area Networks (6LoWPAN) have grown in
importance in recent years, with the Routing Protocol for Low Power and Lossy
Networks (RPL) emerging as a major enabler. However, RPL can be subject to
attack, with severe consequences. Most proposed IDSs have been limited to
specific RPL attacks and typically assume a stationary environment. In this
article, we propose the first adaptive hybrid IDS to efficiently detect and
identify a wide range of RPL attacks (including DIO Suppression, Increase Rank,
and Worst Parent attacks, which have been overlooked in the literature) in
evolving data environments. We apply our framework to networks under various
levels of node mobility and maliciousness. We experiment with several
incremental machine learning (ML) approaches and various 'concept-drift
detection' mechanisms (e.g. ADWIN, DDM, and EDDM) to determine the best
underlying settings for the proposed scheme.
