# Protocol-Specific and Sensor Network-Inherited Attack Detection in IoT Using Machine Learning
## 3 Methodology
### Exploration Phase in SEMMA  
Data generation, feature segmentation, feature extraction, and data collection steps are performed in this phase. The data is generated using Cooja, which is sent to the Wireshark through 6 LoWPAN analyzer. The network traffic is analyzed in the Wireshark and feature segmentation is also performed. The data is collected for one benign and two attack scenarios. Figure 3 shows the raw data sample collected through Wireshark. The benign and attack datasets are consolidated in the LIoTN-RPL data pool and analyzed to understand the features and their relationships with the target columns.  
The feature extracting unit manages the extraction of broadly related features from the packets and IoT nodes after fragmentation in the Wireshark. To assure the coverage of all the associated attributes from the network models in RPL-based IoT, the data from each use case is collected, which has contributed towards a novel and diverse LIoTN-RPL dataset. The features are extracted based on the main protocols operating in the network, which are ICMPv6, UDP, and IEEE 802.15.4. The associated features are presented in Figures 4-6.  
The pivot table analysis shows that 3259 data points belong to the benign network scenario, 6213 to the PS-R attack scenario, and 4408 to the SN-W attack scenario. The descriptive statistics of the protocol-based feature set, data points belonging to each protocol, and their percentages are shown in Figures 7 and 8.  
The figures show that \"ICMPv6\" filter retrieves five primary feature classes with thirty-nine features in total, \"UDP\" filter retrieves six feature classes with a total of twenty-three features inclusive of the features from other protocols, while \"IEEE 802.15.4\" has two feature classes with a total of nineteen features. Figure 8 indicates that the percentage of total data points is 41.2, 36.7, and 22.1, respectively.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  
Figure 4: Dataset columns with ICOMPv6 filter-related features.  
Figure 5: Dataset columns with UDP filter-related features.  
Figure 3: Network traffic data collection.  
Figure 9 presents the instance percentage of each feature class in the protocol-based traffic collected and extracted through Wireshark in the Contiki Cooja 3.0 simulator. It shows that there are five classes in ICMPv6 protocol. The fifth feature, that is, ICPMv6, encompass a little over half the percentage of all the classes while the remaining classes have similar features spreading across, except for 6 LoWPAN, which is comparatively less at about five percent of the total features. For the UDP classes, the feature distribution is higher in three classes, while the Data class has the lowest percentage among all others. In the IEEE 802.15.4 class, the ratio is sixty-seventy to thirty-three.  
Figure 8: Number of features and datapoint percentage in each protocol.  
Figure 6: Dataset columns with IEEE 802.15.4 filter-related features.  
Figure 7: Features in each class of the protocol.  
The analysis reflects that ICMPv6-related features are important as they reveal information about the control messages in RPL-based routing happening in the IoT network. In the next section, the data is prepared for feature selection to build the ProSenAD model for addressing the routing attacks in RPL-based IoT networks.