# Routing Attacks Detection in 6 LoWPAN-Based Internet of Things
## 2 Background
### Intrusion Detection System (IDS)
The algorithm works by recursively partitioning the data based on the values of the features, to create pure leaf nodes where all instances in a leaf node belong to the same class or have the same predicted value. There are many different decision tree algorithms, including ID3 [17], C4.5 [18], and CART [19]. The decisions are often simple attribute tests that isolate the data using one attribute at a time. By using categories established at lower nodes, new data can be classified. [PERSON] (1993) promoted using a decision tree technique, and C4.5 is the most recent version of [PERSON]'s model [20; 21]. Bayesian Networks: To model an uncertain domain, a Bayesian network is used widely and applied in various ways to treat AIDSs. The Bayesian intrusion detection system has been applied to learning an attack strategy to relate alerts, and it expects possible upcoming attacks in a connected system. A Bayesian network is a graphical model that consists of a directed acyclic graph (DAG). In this graph, each node represents a random variable, and the edges represent probabilistic dependencies between these variables. The structure of these networks shows how the variables are related to each other. The relationships are represented by the conditional probability distributions between the nodes. The probability distribution of a node is determined based on the values of its parent nodes in the graph. This approach allows us to make inferences about the joint probability distribution of all the variables in the network, given certain evidence or observations. One Support Vector Machine (SVM): The one-class Support Vector Machine (SVM) is a type of machine learning algorithm is used for detecting anomalies. Unlike traditional SVMs that separate data into two classes, the one-class SVM works with a single class of data, which are usually the expected or normal data. The purpose of the one-class SVM is to identify typical patterns of normal data, and any data that deviate from this pattern are considered an anomaly. The algorithm first maps the input data to a high-dimensional feature space and finds a hyperplane that separates the normal data from the rest of the data. This hyperplane is defined as the decision boundary, and any data that falls on the other side of the hyperplane is considered an anomaly. Multilayer Perceptron (MLP): An MLP is an artificial neural network used in machine learning that has several layers of nodes or artificial neurons arranged in a feedforward fashion. The input layer, which accepts the input data, is the first layer, while the output layer is the last layer, which generates the output. In the middle, there may be one or more hidden layers that perform computations. Each neuron receives input from the previous layer, applies an activation function to the input, and produces an output that is sent to the next layer. During a training process, a backpropagation algorithm is used to learn the weights of the connections between neurons, which are adjusted based on the error between the predicted output and the actual output. MLPs are mostly used for supervised learning, such as classification and regression. They can learn complex non-linear relationships between inputs and outputs and support various activation and loss functions. However, they may be prone to overfitting and require the careful tuning of hyperparameters to achieve optimal performance.