## 7 Result and Discussion
### RQ2: What Are the Existing ML-Based Approaches to Detect Attacks in RPL-Based 6 LoWPAN?
As for the deployment of the proposed approach, the authors implemented a scenario in the Cooja simulator, where the system comprises two types of IDS nodes: IDS agent and backbone (6 BR router) IDS. First, they deployed the IDS agent to sniff and monitor network traffic. At the same time, they installed other IDS nodes in the 6 BR router to make the final decision and send orders to the network nodes if any suspicious behavior is detected. [PERSON] and [PERSON] [72] introduced a framework to build a real-time dataset comprising three known RPL attacks: Flooding, SH, and BH attacks. The authors proposed a queuing method for collecting the network traffic using several sniffing nodes deployed in the network. In addition, the authors extracted the features from three different layers: physical, network, and application layers. The framework comprises four scenarios with the same topology. The first scenario represents the normal network behavior without any attack. In contrast, the other three scenarios contain normal and attack behavior. The dataset generation procedure comprises seven modules and units. The first unit focused on initializing the network and setting up the attack scenarios. Throughout this module, the authors utilized industrial IoT sensors that have constrained resources and communicate using IEEE802.15.4 and 6 LoWPAN protocols. Next, the traffic generation module used the simulation program, Cooja, to generate the traffic. The sensor nodes are programmed to run humidity and temperature applications, enabling the capturing algorithm to collect application-layer features. Capturing data from the network requires the authors to use props packets that are distributed equally in the network. Such packets continuously monitor the network and send the gathered data to the aggregation module. The data aggregation module accumulates the collected data and checks for duplication in the information by inspecting each packet's node ID and timestamp. The aggregated data are forwarded to the queue system to check the time window. The packets located in the same time window are sent to the feature extraction unit. The feature extraction unit is also designed to take the packets from the queueing system and extract the features. The authors extracted the features from three different IoT layers in this work. The first vector of features includes physical layer features, such as signal strength and transmission range. In comparison, the second feature's vector involves the network layer features, most of which are linked to network attacks. The last feature's vector contains application layer features related to humidity, temperature readings, and node power level. Another work proposed by [PERSON] et al. [73] focused on building a Data Exportation Framework (DEF) for IoT devices. The proposed approach aims to extend the existing features of the Cooja simulator program by adding an extension to the current Collect View plugin. The proposed DEF tool enables the simulation program to export the data into different formats, such as CSV files or MySQL databases. The authors reverse-engineered and modified the existing code of the Collect View plugin model to run the DEF tool during the runtime. The DEF framework comprises four modules: Data Handler Module (DHM), Data Visualization Module (DVM), Database Management Module (DMM), and API Module (APIM). The DHM is responsible for extracting collected data from each node and archiving it as an ArrayList for presentation later in the table. The DVM operates as a database interface for reading and writing into a database. Next, the APIM provides developers with a simple API that includes database connection and data retrieval. As for the evaluation of the DEF framework, the authors implemented six scenarios, three with the DEF tool and three without it. The result illustrated a slight increase in CPU and memory utilization during the implementation of DEF scenarios, which caused a little overhead on the resources. Finally, [PERSON] et al.