Today, we see an increase in popularity towards connected devices. This process of connecting devices to individuals called the Internet of Things. The core concept of the Internet of Things is to connect heterogeneous objects separately and centrally in different places using standard protocols. The general idea is to create an independent world using smart objects that have the ability to exchange information and make decisions. Connected objects give users the capability to remotely monitor and track in real time. The Internet of things relies on the development of low-bandwidth networks to support communication between objects and connect them to the Internet. The characteristics of these networks are resource constraints in terms of energy, memory and processing. In the real sense of the Internet of things, objects were create as 6LoWPAN, and the RPL was introduce as a new routing protocol compatible with these networks. Due to the limited nature of RPL-based networks, they may be expose to a variety of internal attacks. Neighboring attacks and DISs are the specific attacks posed by this protocol. In this study, the aim of presenting an abnormal diagnostic detection system based on threshold values for detecting attacks on the RPL protocol is to simulate and fully evaluate these attacks. This intrusion detection system fully distributed, in which each node monitors its neighbors to detect possible attacks. The proposed Intrusion Detection System detects two attacks from dedicated RPL attacks, but the approach proposed to detect similar attacks can be exploit. The results of the simulation using Cooja shows that the proposed design has a very high detection rate and in some cases, it can be 100%, while the positive rate of error is very low and varies from zero to 2%. In addition, the rate of packet reception does not change much with the presence of neighboring attacks and DIS. The results shows that the proposed scheme is fully effective in detecting attacks and applicable to large-scale networks. Keywords: Internet of Things, 6LoWPAN, RPL, IDS, Anomaly-based, Neighbor Attack, DIS Attack
