## 8 Open Issues, Challenges, and Future Research Directions  
This section presents the research issues and challenges faced by ML, DL, and combined ML and DL approaches to provide future research directions in developing new defense mechanisms for RPL attacks. Figure 12 illustrates the issues and challenges. The following points provide more details about those challenges:  
* **Challenge 1--Datasets Availability:** This study discovered that most researchers use self-generated datasets from various simulation programs, either synthetic or real-time, to evaluate their approaches [7, 47, 48]. However, some researchers do use existing publicly available datasets [31, 49], even though many of those datasets were based on traditional networks' traffic, which is different from the traffic of RPL-based 6 LoWPAN networks [49]. Unfortunately, only a handful of researchers constructed datasets for RPL networks and made them available publicly [46, 58, 72]. Consequently, it is difficult for researchers to compare their work with others due to the variations in the datasets used. * **Challenge 2--Evaluation Metrics:** We found that most studies used well-known evaluation metrics and parameters to validate the effectiveness of their work. Unfortunately, those parameters are commonly used in devising mechanisms for detecting attacks in traditional networks. In addition, due to the constrained environment of IoT networks, there is a need to also evaluate the proposed mechanism in terms of network and nodes metrics, such as PRC, PDR, and E2E delay. However, only a few researchers utilized these metrics in their studies [35; 66; 67]. Consequently, that might lead to bias in the results. * **Challenge 3--Implementation of Security Mechanisms:** We can infer from our observation that the majority of researchers applied traditional security solutions to detect attacks in RPL-based 6 LoWPAN networks [30; 32; 66]. Due to limited device capabilities in RPL-based 6 LoWPAN networks (e.g., processing, memory, and power), there is a need for lightweight security and robust mechanisms with low complexity to avoid depletion of network resources and minimize the response time to defend against possible attacks. * **Challenge 4--Network Configuration:** We noted many variations in the network configuration parameters used by researchers, such as the number of normal and malicious nodes, network topology, and network size. Without a standard configuration, researchers will face challenges when comparing their work to others. Furthermore, the evaluation scenarios used by the majority of existing approaches were using a small network [47; 52; 53]. However, in reality, IoT deployment is typically a vast network comprising various resource-limited nodes. Consequently, in such a network, the actual performance of the existing solutions may degrade and decline, making it less effective and vulnerable to attacks. * **Challenge 5--Diversity of Devices:** This study discovered that the majority of approaches were designed and tested with only one or two types of sensor nodes (see Sections 7.2-7.4), i.e., the interoperability of non-homogeneous devices is one of the first assumptions of IoT applications. However, different hardware configurations can impact the performance of routing protocols and message processing rates. Therefore, researchers creating IoT routing solutions must consider the heterogeneity of hardware components. * **Challenge 6--Contemporary Attacks:** We inferred those new attacks are technically and behaviorally different from the earlier ones. ML and DL models are usually trained with more outdated datasets' features. However, new attacks might require a  
Figure 12: Issues and challenges. different set of features to identify. Consequently, the new attacks may either evade classifiers, generate false alarms, or reduce detection rates. In addition, most studies superficially describe the pseudo-codes of the attacks, making reproducing them difficult.