Tuned Decision Trees Catch Black Hole Attacks in IoT Networks With 98.71% Accuracy

Billions of low-power devices now form the nervous system of modern infrastructure, from smart meters and industrial sensors to medical monitors and connected vehicles. But the very protocols that let these constrained gadgets chatter efficiently across a network also open the door to one of the most insidious threats in the Internet of Things: the black hole attack. In a new study published in Cluster Computing, researchers led by Amardeep Das of Utkal University and C. V. Raman Global University in Bhubaneswar, India, together with Nibedita Adhikari and Sunil Kumar Mohapatra, present a lightweight, optimized machine learning model that detects these attacks with an accuracy of 98.71 percent, offering what they describe as a scalable foundation for defending IoT networks against cyber threats.

A black hole attack exploits the trust at the heart of IoT routing. Most low-power IoT networks rely on the Routing Protocol for Low-Power and Lossy Networks, or RPL, which builds a logical tree of routes connecting every constrained device to a border router that links the network to the wider internet. A malicious node carrying out a black hole attack advertises itself as an exceptionally attractive parent in that routing tree, claiming the best possible path quality. Neighboring devices, eager to conserve energy and latency, eagerly route their traffic through the attacker. Once packets arrive, the attacker simply drops them, silently swallowing data without any obvious sign of failure. Because the compromised node never announces its treachery, the network can continue operating for long stretches while messages quietly vanish, making the attack particularly dangerous for applications such as industrial monitoring or healthcare telemetry where missing readings can carry real consequences.

Defending against such attacks is complicated by the hardware on which IoT security must run. Constrained devices often operate on milliwatts of power, with limited memory and modest processors, so heavyweight deep learning architectures that perform well in cloud-based intrusion detection are frequently impractical at the network edge. The research team therefore set out to build a detection model that is not only accurate but lightweight enough for the realities of IoT deployment. Their approach centers on classical machine learning, specifically decision trees, but with a crucial twist: rather than accepting default settings, they subjected the model’s hyperparameters to systematic optimization using the Bayesian OPTUNA tuning technique, a framework originally introduced at the ACM SIGKDD conference in 2019 that has since become a standard tool for automated hyperparameter search.

Hyperparameter optimization is the quiet engine behind many modern machine learning successes. A decision tree’s behavior depends on settings such as the maximum depth it may grow, the minimum number of samples required to split a node, and the criteria used to measure split quality. Choosing these values poorly can leave a model either too rigid to capture attack patterns or so flexible that it memorizes noise instead of learning generalizable signatures of malicious behavior. OPTUNA approaches this search intelligently. Instead of exhaustively testing every combination or randomly sampling configurations, it uses Bayesian reasoning to build a probabilistic model of which hyperparameter regions are likely to yield strong performance, then concentrates its search budget on the most promising areas. This efficiency matters doubly in IoT security research, where computational resources for training and evaluation are themselves often limited.

To train and evaluate their model, the researchers turned to a benchmark RPL-based IoT dataset, giving their results a directly comparable footing with prior work in the field. The dataset captures the traffic patterns of RPL networks under both normal operation and attack conditions, allowing a supervised classifier to learn the statistical fingerprints that distinguish black hole behavior from legitimate routing activity. The team conducted what they describe as a comprehensive performance analysis, evaluating key metrics and examining how hyperparameter optimization shaped the model’s behavior. The headline result is striking: an optimized decision tree reached 98.71 percent accuracy in detecting black hole attacks, a level of performance that places this lightweight approach on par with far more computationally demanding methods reported in the literature.

The significance of that number becomes clearer when set against the broader landscape of IoT intrusion detection research. Recent surveys have catalogued a wide array of machine learning approaches applied to RPL-based attack detection, ranging from artificial neural networks and convolutional architectures to ensemble methods such as gradient boosting machines and hybrid CNN-LSTM models. Many of these achieve strong detection rates, but their appetite for computation can be prohibitive on constrained hardware. The Indian team’s work aligns with a growing recognition in the field that optimization of simpler models can deliver competitive accuracy at a fraction of the cost. Their bibliography points to parallel efforts using particle swarm optimization, cuckoo search, ant colony optimization, and artificial bee colony algorithms to tune detectors, reflecting an intense global race to find the sweet spot between detection power and deployment feasibility.

The study also situates black hole attacks within a wider taxonomy of RPL threats. Security researchers have documented a family of routing attacks that abuse the protocol’s trust assumptions, including rank attacks that manipulate a node’s advertised position in the routing tree, version number attacks that trigger unnecessary network-wide re-synchronization, and Sybil attacks in which a single node masquerades under multiple identities. The authors reference the STRIDE threat modeling framework, a widely used Microsoft-developed methodology for systematically identifying security design flaws, as part of the conceptual scaffolding for their work. By focusing specifically on the black hole variant, they target an attack whose silent, packet-dropping behavior makes it especially hard to catch with simple threshold-based monitoring, since the network’s own performance metrics may not immediately reveal that data is being lost.

What makes the optimized decision tree so effective at this task? Decision trees classify by asking a sequence of simple questions about input features, effectively carving the feature space into regions labeled as benign or malicious. In an RPL network, features derived from routing metrics, control message behavior, and traffic statistics provide rich discriminative signals: a black hole node’s exaggerated route advertisements and its failure to forward packets leave characteristic traces. A well-tuned tree can capture these patterns with interpretable logic, an advantage over black-box deep models when operators need to understand why an alarm was raised. The Bayesian OPTUNA tuning ensures the tree’s structure is neither too shallow to separate attack traffic from normal behavior nor so deep that it overfits the training data, striking the balance that raw accuracy figures alone can conceal.

The authors frame their contribution as providing a scalable foundation for efficiently securing IoT networks, and the claim carries weight given the trajectory of connected-device deployment. Industry estimates routinely project tens of billions of IoT devices in the coming years, spanning smart cities, agriculture, logistics, and critical infrastructure. Every one of those devices is a potential entry point, and the RPL protocol that underpins many low-power deployments was designed with efficiency, not adversarial resilience, as its priority. Detection systems that demand cloud-scale computation cannot protect networks whose gateways are battery-powered routers. Lightweight, highly accurate classifiers that can run close to the network edge represent one of the few realistic paths to defending this vast and heterogeneous ecosystem at scale.

The research, published in Cluster Computing as volume 29, article 800, arrives amid a wave of related work on IoT security that spans federated learning for privacy-preserving detection, blockchain-integrated threat intelligence sharing, and explainable AI methods that make intrusion alerts more transparent to human analysts. The Indian team’s contribution stands out for its discipline: a focused attack type, a benchmark dataset, a systematic optimization pipeline, and a model simple enough to imagine actually deploying. As the authors note, their data availability statement indicates no new datasets were generated during the study, meaning the work’s value lies in demonstrating how far careful optimization can push a classical algorithm. For network defenders wrestling with the black hole problem, the message is encouraging: sometimes the most effective weapon against a silent attacker is not the biggest model, but the smartest-tuned one.

Subject of Research: Machine learning detection of black hole attacks in RPL-based Internet of Things networks

Article Title: An optimized machine learning approach to mitigate black hole attacks in IoT networks

Article References: Das, A., Adhikari, N., & Mohapatra, S. K. (2026). An optimized machine learning approach to mitigate black hole attacks in IoT networks. Cluster Computing, 29(14), Article 800. https://doi.org/10.1007/s10586-026-06583-y

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06583-y

Keywords: Internet of Things, black hole attack, machine learning, decision trees, hyperparameter optimization, OPTUNA, RPL protocol, intrusion detection, network security, IoT security, Bayesian optimization, Cluster Computing