## 7 Result and Discussion
### RQ2: What Are the Existing ML-Based Approaches to Detect Attacks in RPL-Based 6 LoWPAN?
Concerning the experimental results, the authors reported that they attained the best outcomes of 97.3%, 96.1%, 98%, and 99.1% of AC, Precision, Recall, and F-Score, respectively, with an ELLIPS distribution of 20 nodes in the network. [PERSON] and [PERSON] [3] presented a cross-layer IDS for RPL-based IoTs. The proposed approach employed a neural network for detecting VN, WP, and HF attacks conducted in binary and multi-class classification scenarios. In this work, the author utilized two types of features extracted from different IoTs' layers to identify the attacks: routing layer and link-layer features. In addition, the authors introduced and shared their dataset publicly. Such a dataset includes the invoked attacks with different scenarios. Additionally, the authors also came up with a new set of features extracted from the link layer and investigated their effect on intrusion detection. Moreover, the authors classified the extracted features into three groups: data, topology, and link-layer features. Data-based features include information related to the data packets received by the root node, whereas topology-based features contain information about RPL control messages, and lastly, the link-layer features provide information about the dropped packets in this layer, such information including neighbor allocation, collisions, and queuing. As for the experimental result for the binary classification model, the 10-fold cross-validation techniques obtained 97.11% and 0.34% of DR and FPR, respectively. In contrast, the 60% split techniques attained 96.88% and 0.13% for DR and FPR, respectively. Moreover, for the multi-class model, the proposed approach achieved a high DR of 97.52%. Furthermore, the results showed that the implementation of link-layer features reduced the FPR and improved the detection of VN attacks. [PERSON] et al. [52] proposed a secure framework for detecting attacks in smart city IoT and Industrial Internet of Things (SFIIoT) in two phases: threshold modulation and attack detection. At first, after identifying all available network traffic features, the features are reduced using GP algorithm. After that, the features with the highest probabilities are elected. Finally, the in-order traversal-based selected features are used to construct a threshold statement for each type of referred attack. Moreover, after forming the threshold statements, the latter phase identifies the attack. Each attack's scenario contains a set of features that reflect a specific type of attack. Thus, the targeted attack will be detectable by comparing each scenario with the threshold statement constructed in the previous phase. As for the simulation part of this work, the proposed framework, called RPL-NSF-IIoT, targets specific types of attacks (HF, VN, SH, and BH attacks). In addition, the authors tested the performance of their work using various time intervals (500 s, 1000 s, the 1500 s, and 2000 s) with some evaluation metrics. Based on the simulation result, the authors reported that they achieved the best detection AC of HF and VN attacks at 2000 s, while for SH and BH attacks, the highest result was achievable at 1000 s. In terms of TPR, they achieved the best results at 2000 s for all attacks. Moreover, the experimental results reveal that the PDR of this work is higher, with fewer data drops and delays as well. The authors in [10] proposed an efficient framework for detecting VN attacks in IoTs that is deployable at the IoT-LLN edge and the cloud. Furthermore, the proposed framework aims to detect the attacks without any miss-identification using any form of deployment. In addition, the detection process in the cloud is performed by a cloud service, while fog computing is responsible for detecting attacks at the IoT-LLN edge. The proposed framework identifies attacks on the local network and cloud side through several stages: filtration of input features, feature preprocessing, and ML classification algorithms (DT, Support Vector Machine (SVM), and Bernoulli RBM and LR).