# Routing Attacks Detection in 6 LoWPAN-Based Internet of Things
## 5 Experiment Setup and Results
### Analysis of the Captured Data  
The nodes' power consumption was recorded and stored in a file. The CSV file identified the network's power consumption as normal traffic, whereas the IoT network's power consumption with a malicious node was classed as an attack. After that, machine learning software was used to examine the data. There are seven different fields in the Power Tracker file, and these are listed in Table 2.  
Cooja is employed, which is a simulation tool from the Contiki OS that is popular among academics studying the IoT ecosystem. The major goal of using Cooja is to determine how to make use of it to evaluate the impacts of attacks and create more effective security solutions. In this paper, the effects of insider threats on RPL-based IoT sensor nodes are examined. Based on the seven different scenarios, values from the mote were obtained \begin{table}
\begin{tabular}{c c} \hline \hline
**Mote\_ID:** & **The ID of the Mote in the IoT Network** \\ \hline \multirow{4}{*}{monitored\_time:} & The simulation’s duration and interval in seconds are displayed \\  & in this field. Given that this simulation was run for 120 s, its \\  & maximum value is 120. If there was activity at a specific moment \\  & on the IoT network, that time interval will be present. Therefore, \\  & in this field, 1 represents the first second, and 2 represents the \\  & second. \\ \hline \multirow{2}{*}{on\_time:} & This represents how long the mote was on overall for each session. \\  & This field would have a value of 3 if the mote were turned on \\  & three times in a second. \\ \hline \multirow{2}{*}{tx\_time:} & This is the total amount of time the mote spent transmitting a \\  & packet during each interval. This field for the mote would have a \\  & value of 4 if the mote sent four packets in 15 seconds. \\ \hline \multirow{2}{*}{rx\_time:} & This field displays the total number of packets the mote received \\  & throughout the course of the particular period. For instance, the \\  & mote’s value for such a field would also be 6 if it collected six \\  & packets within the 6 th second. \\ \hline int\_time: & Timer for trickle time reset \\ \hline \multirow{2}{*}{Class:} & This field serves as the data classification field. Data coming from \\  & an IoT network without a malicious mote are categorized as \\  & normal, whereas data coming from a network with a malicious \\  & mote are categorized as an attack. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Attributes of Power Tracker file. Figure 5: IoT network with malicious mote and the power usage chart. during the experiment and saved in data collection (DC) files named \"DC1\", \"DC2\", \"DC3\", \"DC4\", \"DC5\", \"DC6\", and \"DC7\". There are various totals for attack and normal motes/nodes in each instance. In the simulation, new members of the community introduce themselves by transmitting their identification number with signal strength alongside a \"Hello\" message to their closest neighbors. Every node then modifies its routing tables and broadcasts individual messages. Malicious nodes frequently send out \"Hello\" messages in Sinkhole, Hello Flood, DDoS/DoS, Wormhole, Blackhole, or RPL Rank Attacks by sending out DIS packets that make them appear to be neighbors. As a result, they are the node that other nodes may reach the easiest. As a result, they make their neighbors spend time and resources coping with pointless data packets. The average amount of DIO, DIS, and DAO messages a node sends out each day increases with level or rank. A message takes longer to get through the system when there are more hops between both the root and any additional node. For instance, the first-rank malicious node transmits 40 bytes of data for each packet, or 320 bytes for a packet of 40 bytes. The actual bandwidth is 10 Kbytes per second, or 10,240 bits each second. After the simulation begins, the IoT routing dataset, which contains both attack and normal nodes, is created. Table 3 shows the Characteristics of the Cooja simulator.