## 4 Proposed Work
The Network Layer Security offers an extensive array of services for Zigbee-enabled devices.To protect an \"NWK layer\" frame, the Network Layer Security uses \"AES encryption/authentication\" with the Enhanced Counter and the \"CBC-MAC (CCM*)\" mode (the \"NWK layer\" ensures the security of transmitting and receiving outgoing and arriving frames). The highest levels oversee security processing processes by generating security keys. The routing layer: The routing layer uses the AODV-RPL protocol, which is a reactive \"peer-to-peer\" route discovery system that can find routes for both symmetric and asymmetric network flows. It is a \"routing protocol\" that facilitates point-to-multipoint communication from a 6 BR to Zigbee devices and \"multipoint-to-multipoint\" communication from \"Zigbee devices\" to a 6 BR. A destination-oriented, directed acyclic graph with a root-based design manages diverse traffic flows (DODAG). The DTLS protocol, which stands for Datagram Transport Layer Security, is based on the TLS protocol and can offer similar security guarantees while maintaining the data-gram delivery model. DTLS provides authenticity, including \"data origin authentication\", \"identity authentication\", \"integrity\", and \"confidentiality\". DTLS operates on top of the \"unreliable transport protocol UDP\". PANA and EAP use DTLS to authenticate a joining node and the \"Authentication Server\". The Application Support (APS) Sublayer. Through a wide range of services provided by APS data and management entities, the \"Application Support (APS)\" sublayer serves as an interface between the NWK and APL levels. The APS sublayer handles incoming and outgoing frames to establish and manage the cryptographic keys and allow safe transmission and reception of the frames. The APS sublayer receives primitives from the above levels to access its services. Entity Authentication, Permission Config Table, Establish Key, Transport Key, Updating Device, Removal Device, Request Key, Switch Key, and Device Update and Removal are among the services that make up APS Layer Security. The support for application security protocols, service discovery protocols, encryption methods, and authentication procedures is integrated to provide sublayer  
Figure 3: Proposed Zigbee IP protocol stack security with attack landscape. security. The Application Layer Security. This layer provides direct end-to-end security at the application level. As shown in Figure 3, the Constrained Application Protocol is one of Zigbee's most well-liked application layer protocols (CoAP). The Internet Engineering Task Force's working group on constrained RESTful environments (CoRE) has suggested CoAP (IETF). However, the CoAP does not offer any security services. To protect CoAP messages concerning secrecy, integrity, authentication, and non-repudiation, it integrates with DTLS. CoAP defines four security levels that differ in the methods used for key negotiation and authentication. A hybrid security architecture using RBF networks and blockchain can improve Zigbee-enabled IoT network security. RBF networks ensure data integrity, authentication, and confidentiality for proactive threat identification, whereas blockchains ensure safe, decentralized key distribution. Intelligent Threat Pre-Identification Using RBF Networks: We discover security issues using RBF-based machine learning. These models analyze network traffic and device behavior in real time to identify security concerns such as unauthorized access, data manipulation, and denial-of-service attacks. Early threat detection and mitigation improve network security with this proactive solution. Blockchain technology allows decentralized, immutable key management. The proposed Blockchain-based Trust Security Service Provider (B-TSSP) protects Zigbee edge device cryptographic credentials. Zigbee routers, end devices, and coordinators securely use blockchain ledgers for digital key credentials and authentication.