Internet of Things (IoT) devices are ubiquitous in various applications, such as smart homes, asset and people tracking, and city management systems. However, their deployment in adverse conditions, including unstable internet connectivity and power sources, present new cybersecurity challenges through new attack vectors. The LoRaWAN protocol, with its open and distributed network architecture, has gained prominence as a leading LPWAN solution, presenting novel security challenges. This paper proposes the implementation of machine learning algorithms, specifically the K-Nearest Neighbours (KNN) algorithm, within an Intrusion Detection System (IDS) for LoRaWAN networks. Through behavioural analysis based on previously observed packet patterns, the system can detect potential intrusions that may disrupt critical tracking services. Initial simulated packet classification attained over 90% accuracy. By integrating the Suricata IDS and extending it through a custom toolset, sophisticated rule sets are incorporated to generate confidence metrics to classify packets as either presenting an abnormal or normal behaviour. The current work uses third-party multi-vendor sensor data obtained in the city of Lisbon for training and validating the models. The results show the efficacy of the proposed technique in evaluating received packets, logging relevant parameters in the database, and accurately identifying intrusions or expected device behaviours. We considered two use cases for evaluating our work: one with a more traditional approach where the devices and network are static, and another where we assume that both the devices and the network are mobile; for example, when we need to report data back from sensors on a rail infrastructure to a mobile LoRaWAN gateway onboard a train.

A LoRaWAN application architecture comprises three functional components: (i) nodes, which convert and wirelessly transmit data as LoRaWAN messages; (ii) gateways, which receive and forward these transmissions; and (iii) network servers, which process the received data for application delivery. The nodes convert data into LoRaWAN messages and transmit them wirelessly with the hope that one or more LoRaWAN gateway will receive the messages successfully. Then, the gateways pass on the received messages to a distant network server, where various processing steps occur before the messages are forwarded to the end application. If none of the gateways can receive the messages, then they will be lost. Although this default behaviour is suitable for some applications, there are others where ensuring messages are successfully delivered at a higher rate would be helpful. One such scenario is the application in this paper: monitoring maritime vessels and fishing equipment in offshore environments characterised by intermittent or absent shore connectivity. To address this challenge, the Custodian project was initiated to develop a maritime monitoring solution with enhanced connectivity capabilities. Two additional features are especially welcome in this scenario. The most important feature is the transmission of messages created in offshore areas to end users who are offshore, regardless of the unavailability of the ground network server. An example would be fishermen who are offshore and wish to position their fishing equipment, also offshore, based on location data transmitted from nodes via LoRaWAN, even when both entities are far away from the mainland. The second aspect concerns the potential use of gateway-to-gateway communications, through gateways on various ships, to transmit messages to the coast. This setup enables fishing gear and fishing vessels to be monitored from the coast, even in the absence of a direct connection. The functional constraints of conventional commercial gateways necessitated the conceptualisation and implementation of C-Mesh, a novel relay architecture that extends LoRaWAN functionality beyond standard protocol implementations. The C-Mesh integrates with the Custodian ecosystem, alongside C-Beacon and C-Point devices, while maintaining transparent compatibility with standard LoRaWAN infrastructure components through protocol-compliant gateway emulation. Thus, compatibility with both commercially available nodes and gateways and those already in deployment is guaranteed. We provide a comprehensive description of C-Mesh, describing its hardware architecture (communications, power, and self-monitoring abilities) and data processing ability (filtering duplicate messages, security, and encryption). Sea trials carried out on board a commercial fishing vessel in Sesimbra, Portugal, proved C-Mesh to be effective. Location messages derived from fishing gear left at sea were received by an end user aboard the fishing vessel, independently of the network server on land. Additionally, field tests demonstrated that a single C-Mesh deployment functioning as a signal repeater on a vessel with an antenna elevation of $15m$ above sea level achieved a quantifiable coverage extension of 13 km (representing a 20% increase in effective transmission range), demonstrating the capacity of C-Mesh to increase LoRaWAN’s coverage.