## 7 Result and Discussion
### RQ2: What Are the Existing ML-Based Approaches to Detect Attacks in RPL-Based 6 LoWPAN?
Furthermore, the experimental results show that the RF classifier obtains the best Precision (99.4%), Recall (99.3%), and AC (99.33%) than other classifiers. In contrast, the J48 classifier attained the worst results in all evaluation metrics compared to other classifiers. Finally, the results also show that the dimensionality reduction step significantly reduces the processing time and energy consumption and improves the overall performance of the proposed framework. A study by [48] presented a centralized IDS for detecting HF and VN attacks in RPL-based Industrial IoTs (IIoTs). The proposed framework uses Genetic Programming (GP) with a centralized IDS to identify the attacks. The proposed mechanisms are placed in the root node to monitor the packets of the surrounding nodes. Then, the monitored packets are analyzed to extract the features that contribute to detecting the attacks. In addition, implementing centralized IDS in this work reduces the computation and communication overhead on the monitoring nodes. The authors used different time intervals (500 ms, 1000 ms, 2000 ms, 3000 ms, 4000 ms, and 5000 ms) in the feature collection step. Furthermore, the authors examined the distributed IDS type; this type allows the monitoring nodes to identify the attacks. The simulation results show that the proposed framework (Centralised IDS) achieves 96.08% and 99.83% of the worst and best AC values obtained during 500 ms and 5000 ms intervals for the HF attack scenario. For the VN attack, the best and worst AC occurred at intervals of 4000 ms (99.42%) and 3000 ms (97.97%), respectively. As for the distributed architecture, the authors discovered through the experiments that about 51% and 71% of nodes could detect HF and VN attacks, respectively, with an AC rate higher than 90. An analytical study on the performance of IDS for RPL-based IoT networks is proposed by [49]. The proposed work presents the statistical analysis of RPL-NIDDS17. The authors study the probability distribution of the dataset features and their correlation by applying five types of ML techniques to evaluate the dataset. The workflow of the analysis comprises three steps. Firstly, the authors performed descriptive statistical analysis using three methods: the Kolmogorov-Smirnov test, skewness, and kurtosis functions. Secondly, the authors tested the feature correlation of the training and testing sets by applying Pearson's Correlation Coefficient (PCC) and Gain Ratio. The process of correlation analysis has two categories. First, the authors used PCC to study the feature correlation of the Training set and Testing set without depending on class or labels. Then, the correlation of features is ranked using the Gain Ratio technique, considering the instance labels. Lastly, in the third step, the authors evaluated the complexity analysis of the training and testing sets using five ML classifiers: NB, DT, Logistic Regression (LR), Artificial Neural Networks (ANN), and Expectation-Maximization (EM) Analysis Clustering. Afterward, they evaluated the classifiers' performance using AC and FAR metrics. Additionally, the results of the RPL-NIDDS17 dataset are compared with some datasets typically used in traditional networks, such as KDD-99, UNSW-NB15, and WSN-DS. The authors reported that the DT achieves the best AC (93%) and a minimum of 3.57% for FAR. However, the EM clustering has the lowest AC (89.63%), with a FAR of 5.59%. Finally, the EM and LR classifiers achieve unacceptable results for FAR, and the authors claim this is due to some unbalanced distribution of dataset records. A study by [PERSON] and [PERSON] [50] presented an ML approach named MLTKNN for detecting Rank attacks in RPL-based IoT networks. The proposed technique uses the K-Nearest Neighbor (KNN) algorithm to identify the attacks. The proposed approach is placed at the border router node to check the distance of each node physically within the radio range from node to node. The detection process of an attacker node depends on the distance between nodes in the network and the border node.