## 7 Result and Discussion
### RQ6: What Are the Existing Threats in RPL-Based 6 LoWPAN That the Existing Studies Had Addressed?
#### 7.6.3 Traffic-Based Attacks  
* **Decreased Rank (DRA) Attack:** In this attack, a rogue node broadcasts its fabricated rank to its neighbors, resulting in neighboring nodes choosing the fraudulent node as their parent. Consequently, this causes other nodes to route their messages through a fake node. In addition, the fraudulent node broadcasts its predecessor's rank as its own to deceive other nodes. The main effect of this attack is to increase the network's traffic, and it can also be used to eavesdrop on DODAG's downward nodes [56; 81]. * **Sybil Attack:** In the Sybil attack scenario, the attacker masquerades the identities of multiple legitimate nodes to access network data. This attack deteriorates the network's performance and increases the control communication overhead, resulting in delegated power resources. In addition, this attack could serve as a jumping-off point for other types of RPL attacks [49; 82]. * **Clone ID (CID) Attack:** In this attack, the attacker takes the ID of one existing legitimate node and transfers it to the malicious node, resulting in the data being routed to the malicious node instead of legitimate nodes. Therefore, the attacker will sniff a large size of the network information [49; 83]. Figure 8 shows the distribution of attacks in the reviewed studies, as discussed in Sections 7.2-7.4. It is evident from Figure 8 that the VN and HF attacks are the most frequently studied, followed by SH and BH attacks. In addition, the DR, Rank, and SF attacks can be found in six studies. However, the rest of the attacks received very little attention from researchers. Therefore, it could be concluded that those attacks received less attention because they are fairly easy to detect or too challenging to implement in RPL networks. To sum up, the analysis of implemented attacks in the existing studies would help future researchers detect such attacks and focus their attention to new kinds of attacks. From Figure 10, it is evident that the most used metric is Accuracy, which was found in 25 studies, followed by Precision and Recall, used in 17 and 16 studies, respectively. The  
Figure 8: Distribution of the attacks in the existing studies. Figure 10: Distribution of the used metrics and parameters in the existing studies. Figure 9: Distribution percentages of the used tools and network simulators in the existing studies. F-score and False Positive Rate also obtain significant consideration in 12 and 10 studies, respectively. However, few researchers evaluated their approaches using rarely known metrics such as Fitting Time, Balancing Technique Average, and MSE. On the other hand, some researchers evaluated the performance of their mechanism using well-known data mining metrics, such as AC, Precision and Recall, extracted from confusion metrics' parameters. Moreover, other researchers are also evaluating and validating the proposed approach for detecting the attacks using a set of network parameters to measure the effectiveness of the proposed defense mechanisms under RPL attacks, such as PDR, E2E Delay, and PRC. RQ8: What Are the Datasets Utilized to Evaluate the Existing Studies, and Are There Any Available Datasets Designed Specifically for RPL-Based 6 LoWPAN? Responding to this question, we extracted the dataset types used based on information provided in the reviewed studies presented in Sections 7.2-7.4. The result is shown in Figure 11, in which 19 studies used synthetic datasets, 6 used real-time datasets, and 3 studies did not state the dataset type used in their experiments. In addition, two studies used the IRAD and RPL-NIDDS2014 datasets. Finally, other types of datasets, such as IDC, EDC, WSN-DS, UNSW-NB15, and KDD99, were only used in one study, respectively. It is apparent from Figure 11 above that most researchers use synthetic datasets to evaluate their mechanisms. However, such datasets are typically generated to cater to specific tasks or configurations that might not apply to real-world environments.