## 7 Result and Discussion
### RQ2: What Are the Existing ML-Based Approaches to Detect Attacks in RPL-Based 6 LoWPAN?
After that, an ML algorithm, GP, selects the significant features that contribute to high classification AC. The classification stage uses three algorithms: DT, SVM, and Bayesian Classifiers. Furthermore, during the evaluation step, the performance of each classifier was tested individually. Moreover, to enhance AC and reduce the computational cost of alarm processing, the authors propose a post-processing stage that depends on a predefined threshold. Such a threshold was used to revise and validate the generated alarms. The authors conducted the experiments at different intervals of the network's run-time. The Bayesian classifier obtained the highest DR at all time intervals. As for the FPR, the DT classifier attained the lowest results at runtimes of 2, 4, and 6 minutes. On the other hand, at 8 and 10 minutes, the SVM classifier gained the best FPR compared to other classifiers. After the post-processing stage, the Bayesian model's DR improved to 99.03% at ten intervals, and the DT's FPR reduced to zero at 2-, 4-, and 6-minute intervals of the runtimes, while at 8- and 10-minute intervals, the DT classifier obtained 0.19% and 0.16% of FPR, respectively. In [56], the authors presented an ML approach for detecting routing attacks in RPL. The proposed approach simulates three routing attacks: HF, DRA, and VN attacks. The authors used ANN to detect those attacks in their work. The workflow of the proposedANN-based IDS involves several processes: setting up the network scenarios, inspecting the network behavior in the presence of attacks, sniffing, collecting and processing the gathered information, analyzing and classifying the network traffic using ANN, improving the ANN performance via parameter tuning technique, and testing the proposed ANN via hold-out and k-fold cross-validation methods. As for the simulation scenarios, the authors employed four scenarios, with each scenario representing one type of attack, except for the last scenario, which combines all attacks simultaneously. Moreover, concerning the packet generation in the network, the malicious node produced the maximum number of packets during HF attacks. On top of that, the malicious node also induced the adjacent nodes to generate more packets inside the network during VN attacks. In contrast, the malicious nodes initiated the lowest number of packets during DRA attack scenarios. Moreover, the authors also compared the performance of hold-out and k-fold cross-validation, and they claimed that the hold-out methods required fewer epochs to obtain 100% AC. Additionally, the authors used ten-fold cross-validation methods to avoid the over-fitting problem. Finally, the ANN model achieves an AC of 100% with an optimized value of its hyper parameters. The authors in [57] proposed a Multi-Layer (MLRPL) model by employing an ANN approach for detecting DRA attacks in RPL. The MLRPL comprises three phases: data preprocessing, feature extraction based, and ANN-based attack detection model. The authors utilized the IRAD dataset, which contains three types of attacks, VN, DRA, and HF, to evaluate their work. The authors merged two datasets (VN and DRA attack datasets) into one named RPL attack dataset during the data preprocessing phase. The produced dataset includes 18 features. In the second phase, the authors used an entropy algorithm known as information gain to evaluate each feature of the entire dataset and an RF classifier to train the entire dataset. The output of this phase is the optimum set of features, which includes eight features, and such features will be inserted into the last phase for attack detection. Furthermore, different detection scenarios, such as binary and multi-class classification, are employed to test the proposed model. Regarding the experimental results for the binary class, the training and testing AC was 97.14% and 97.01%, respectively. In contrast, for a multi-class model, the training and testing AC is 96.59% and 96.39%, respectively.