## 7 Result and Discussion
### RQ6: What Are the Existing Threats in RPL-Based 6 LoWPAN That the Existing Studies Had Addressed?
#### 7.6.1 Resource-Based Attacks  
* **Hello Flooding (HF) Attack:** This attack aims to make the network services or resources unavailable. The HF attack is carried out by constantly flooding the network with many \"Hello\" packets to notify their one-hop neighbors of their presence. The high transmission power of the malicious nodes will persuade all other nodes in the network that it is their neighbor [49; 54]. Meanwhile, the adjacent nodes will respond to those messages. As a result, massive network traffic will be generated, resulting in control overhead, service unavailability, instability, and node resource depletion [56].
* **Increased Rank (IR) Attack:** In the IR Attack scenario, a malicious node increases its rank illegitimacy. Meanwhile, the malicious node announces itself near the root node, but with a higher rank and worse path. Therefore, nodes in the malicious node's subtree and those in its proximity must choose other nodes as parents, leading to more delay and disruption of the routing topology [14; 65].
* **Rank Attack:** In a Rank attack, the attacker distributes the minimum rank r-value, intending to become a parent node. In the RPL network, the parent node is chosen based on the rank metric. Regularly, the nodes closest to the root node have the lowest rank. Therefore, using a low-rank value, the rank attacker is chosen as a parent, and the other nodes forwarded routing messages along the network's attacking path. Thus, it loads extra overhead and excessive energy dissipation at the nodes, resulting in lower routing performance [59; 75].
* **Version Number (VN) Attack:** In a VN attack scenario, the attackers target the global repair feature of RPL by modifying the version number of the existing DODAG. The root node is responsible for changing the version number in normal operation. However, suppose the malicious node transmits a DIO message with a higher version number. In that case, it forces the global repair mechanism to start and reconstruct the DODAG, which will result in additional overhead and drain the nodes' power resources [14; 51].
* **Local Repair Attack:** The rogue node increases its rank to infinity during the execution process. It transmits this message to the entire network, compelling other legitimate nodes to look for a new parent to reach the root (gateway) node. When this occursfrequently, network performance suffers, as the topology must be modified every time the node changes [63].
* **Increased Version (IV) Attack:** In this attack, the fraudulent nodes purposefully change the version number of the DIO control packet and send the altered DIO message to their neighbors. When the neighbors receive the altered DIO message, they demonstrate their exclusion from the new DODAG, resulting in the unnecessary reconstruction of already-available DODAG. Consequently, the frequent reconstruction increases network traffic and causes an impact on critical network factors, such as lifetime, availability, and energy efficiency [56,76].
* **DIS Flooding Attack:** This attack occurs when one or more malicious nodes periodically send DIS messages to neighboring nodes within their transmission range, and upon receiving of DIS message, the trickle timers of the victim node(s) would reset, and this process continues until the power resources of the victim node(s) depleted, crashing the network [62].
* **DDoS Flooding Attack:** In a DDoS flooding attack, various malicious nodes target the network nodes with vast amounts of traffic to interrupt the normal operation of the network services. This attack also increases communication overhead and overwhelms the power resources of the sensor nodes [63,76,77].