Intelligence in Things expresses a paradigm through which every object around us are connected through unique addressing, interact and cooperate to accomplish certain objectives irrespective of time and place [I). The coordination of diverse technologies, heterogeneity and distributed nature of the network magnifies threats to loT system. Furthermore, constraints such as limited storage, cost, power consumption, scalability and mobility, unique addressing of things has to be considered [2). IPv6 over WPAN (Wireless Personal Area Network) referred to 6LoWPAN is a networking technology, that uses IPv6 protocol, enabling limitless scaling while retaining all the characteristics required for providing an unassailable loT structure [3][4). Wireless Sensor Network (WSN) is an integral part of loT and can be subjected to various attacks with routing layer attacks being the most prominent one. An Intrusion Detection System (IDS) examines activities in a network or node, detects attacks, alerts network and mitigatesthe harmful effect of the detected attacks. IPv6 Routing Protocol for Low-Power and Lossy Networks (RPL), a routing protocol has inherent mechanism to defend against all severe attacks except sinkhole attacks even with DTLS, IPsec and IEEE 802. 15. 4 link-layer security applied [5][6). There are slews of works for detecting sinkhole attacks on WSN [7][8). Though, these are suited for WSN, they didn’t consider loT environment and few have postulated IDS for loT with Shazid Raza et al. [6] comprehensive work being the initial attempt.