# Routing Attacks Detection in 6 LoWPAN-Based Internet of Things
## 2 Background
### Intrusion Detection System (IDS)  
An Intrusion Detection System (IDS) is a crucial component in the field of cybersecurity that helps to detect and prevent unauthorized access to computer networks and systems. The IDS is designed to identify potential security breaches and intrusions that could compromise the confidentiality, integrity, and availability of data and system resources. The primary function of an IDS is to monitor network traffic and system activity, looking for anomalous or malicious behavior that may indicate an attack. The IDS operates by analyzing traffic patterns and comparing them to known attack signatures or deviations from established patterns of normal behavior. Once an intrusion is detected, the IDS can alert security personnel or take automated action to block or mitigate the attack. The IDS is used in various settings such as enterprise networks, cloud infrastructure, and IoT devices, and it can be deployed in different forms including network-based, host-based, or hybrid IDS. With the increasing sophistication and frequency of cyber-attacks, IDS is becoming an increasingly vital component in protecting the security of digital systems and infrastructure [7; 13; 14]. IDS systems have two main approaches: Signature Intrusion Detection Systems (SIDSs) and Anomaly Intrusion Detection Systems (AIDSs). Signature Intrusion Detection Systems (SIDS) are based on pattern-matching techniques to find a known attack; these are also known as Knowledge-based Detection or Misuse Detection. In other words, an alert is raised when a recognized intrusion meets a malicious string database. For well-known attacks, SIDS frequently produces positive detection outcomes. The second approach is Anomaly Intrusion Detection Systems (AIDS), which identify unusual behaviors on a computer system. They are categorized into several sub-categories based on the learning approaches applied, such as statistical techniques, data mining, artificial neural networks, and genetic algorithms [15]. The main benefit of an anomaly-based scheme is that it can potentially detect attacks even when detailed prior information of the attack does not exist and can be used to obtain signature information used by misuse-based IDS. Researchers are aware of this potential to identify a zero-day attack, AIDSs have captured the attention of numerous studies. AIDSs can identify unusual computer user behavior. This method is predicated on the idea that malicious user behavior is distinct from benign user activity. AIDSs use a combination of chosen features plus machine learning techniques to build a behavioral profile of typical user activity. Then, they compare the new data's behaviors to the predetermined normal behavior profile to look for abnormalities. Users who exhibit odd activity are flagged as potential attackers. In general, the AIDS contains two stages: the training stage and a testing stage. In the training stage, the normal activity profile is categorized using data that identify normal behavior; in the testing stage, the new data set are examined based on the profile that has been built in the first stage. Many researchers use a variety of machine-learning techniques and algorithms to detect anomalies. These techniques include both supervised and unsupervised learning approaches to address different pattern recognition problems. In supervised learning, a model is built from labeled training data wherein each trained data point is associated with a class label. During the training phase, a classifier model is developed, which can classify additional examples based on learned class labels. Several machine learning structures have been employed with A-NIDS, and some of the most prominent structures are described below, including their main strengths and limitations [16]. Decision trees: A decision tree is a tree-like model wherein each node represents a feature or attribute, each branch represents a decision rule, and each leaf node represents a predicted outcome or class label.