## 7 Result and Discussion
### RQ2: What Are the Existing ML-Based Approaches to Detect Attacks in RPL-Based 6 LoWPAN?
[35] developed a fault-tolerant AI-based IDS for detecting routing attacks in RPL-based IoT networks. The authors targeted six different types of RPL attacks: DRA, BH, SH, HF, SF, and VN attacks. In addition, the authors used the Cooja simulator to generate two types of datasets, two-class (normal with attack) and multi-class (normal with six attacks). Moreover, the authors obtained the configuration settings used in [58] to set up their simulation environment for the data collection process. The architecture of the proposed approach consists of several modules, such as data collection, feature engineering, selection, and classification. As for the feature selection process, the authors combined two types of embedded methods: RF and a filter method, Pearson Correlation (PC). Then, they selected the top 10 most essential features produced by RF. On the other hand, the authors applied the correlation matrix using the PC method, and the authors defined a threshold value of 0.3 for the correlation. Consequently, the features that achieve the defined value will be selected. Afterward, the authors employed an intersection step to produce a new subset of features. Concerning the classification stage, the authors used six types of ML classifiers: DT, RF, KNN, NB, MLP, and LR. Moreover, the authors also used the Sequential DL model to evaluate their approach. As for the experimental result of the proposed approach, the KNN, RF, and DT classifiers performed the best for all metrics compared to the other classifiers. Furthermore, the DT, RF, and KNN gained more than 99% classification AC for both class types (binary and multi-class). Moreover, in multi-class classification, the results reveal that KNN obtains an AC and DR of 99% and 98%, respectively. Furthermore, the RF and DT gained 98% of AC and DR. Consequently, based on the attained result, the authors conclude that the RF model is best in performance and fitting time, making it the most suited for intrusion detection in RPL-based networks. Finally, the authors produced an RF-based IDS approach, introducing fault tolerance and intrusion tolerance for detecting attacks in RPL-based Industry 4.0 networks using an RF classifier. Lastly, a study by [68] introduced an ML approach based-IDS for detecting RPL attacks. The architecture of the proposed work is based on hybrid IDS, which combines anomaly-based and signature-based IDS. In addition, the 6 LoWPAN compression header is used in this work to study and observe the form used during routing attacks. Furthermore, the obtained rule or signature from the ML algorithm will be injected into the border router. Moreover, this work implemented different types of RPL routing attacks, such as HF, WH, and SH attacks. The methodology of the proposed approach comprises three stages: 6 LoWPAN network traffic, data preprocessing, and data classification. First, the authors generate a dataset using the simulation environment for different scenarios of RPL routing attacks. Then, the authors applied some preprocessing and analysis on the collected data to extract the features from network traffic. Such features include 24 features representing regular and attack node traffic characteristics. After that, the authors applied some techniques to extract the relevant features that contribute to the detection of RPL attacks. Moreover, the authors use a Particle Swarm Optimization (PSO) algorithm, a type of bio-inspired optimization algorithm. Such an algorithm is used to optimize the optimum parameter of classification algorithms that are used in stage 3. The optimization step plays a vital role in obtaining the best performance of ML classifiers, which enhances their efficiency in differentiating between normal and suspicious samples of the proposed dataset features. As for stage 3, the authors use several classification algorithms, such as NB, SVM, RF, KNN, and a False MLP, to classify the normal and malicious behavior.