Towards a Protocol-Aware Intrusion Detection System for LoRaWAN Networks

The increasing reliance of Internet of Things (IoT) applications on low-power wide-area network technologies, particularly Long Range Wide Area Network (LoRaWAN), has amplified the need for security monitoring approaches that go beyond attack-specific signatures and generic traffic anomalies. Existing solutions are often tailored to individual threat scenarios or rely on statistical indicators, which limits their ability to systematically capture protocol-level misuse in an interpretable manner. This paper addresses this gap by proposing a protocol-aware validation methodology based on a Digital Twin abstraction of LoRaWAN communication behavior. The Over-The-Air Activation (OTAA) procedure is modeled as a finite-state machine that encodes expected message sequences, timing constraints, and specification-driven state transitions. Observed network events are continuously evaluated against this formal state model, enabling the identification of protocol-level deviations indicative of anomalous or non-conformant behavior. Illustrative examples include replay behavior, timing inconsistencies, and integrity-related anomalies, although the framework is not limited to predefined attack categories. The results demonstrate that state machine-based Digital Twin provides a structured and extensible foundation for protocol-aware security validation and Security Operation Center (SOC)-oriented telemetry enrichment. In this sense, the presented approach represents a concrete step toward protocol-aware intrusion detection for LoRaWAN networks by establishing a state-synchronized semantic validation layer upon which higher-level detection mechanisms can be built.