## 7 Result and Discussion
### RQ2: What Are the Existing ML-Based Approaches to Detect Attacks in RPL-Based 6 LoWPAN?
The experimental results showed that the proposed framework achieved an AC of 94.50%, 86.13%, 82.46%, and 91.88% in predicting the normal scenarios, topological attacks,resource attacks, and traffic attacks, respectively. In addition, the authors claimed that their framework could detect and identify various routing attacks. [PERSON] et al. [5] introduced a DNN approach for detecting CID attacks in RPL networks. They used the Cooja simulator to implement CID attacks and three types of topological structures with a different number of normal and malicious nodes to build a dataset. The workflow of the proposed approach has three stages: data preprocessing, unsupervised pre-training, and supervised classification. The first stage comprises dataset balancing, value transformation, and scaling steps. Regarding the implementation flow of the proposed approach, Firstly, the authors applied a Random Over-Sampling (ROS) technique to handle the dataset balancing, then implemented the One-Hot Encoding technique through the value transformation step to convert the feature format into a proper shape. After that, the standard scaling method was used during the scaling step. Later on, the authors implemented an autoencoder-based unsupervised algorithm to pre-train the second-stage model. Then, the DNN was used in the last stage to classify and identify normal and suspicious behaviors. Table 3 shows the summary of the existing DL approaches with their critical parameters, features, and advantages and limitations. **Summary:** Table 3 clearly shows that most researchers employed synthetic datasets to evaluate their approaches and used Contiki (Cooja simulator) to simulate their experiments. Furthermore, it could be observed that there is a lack in the information provided in the reviewed studies, such as [65], where the authors did not disclose the feature selection techniques used in their works. In addition, [62] did not clarify the number of features used in their solution. Meanwhile, [58] generated a new dataset and publicly published it for the other researchers. Finally, [63] did not disclose the used dataset in their work. RQ4: What State-of-the-Arts Combined ML and DL Approaches Have Been Used to Detect Attacks in RPL-Based 6 LoWPAN? This section thoroughly discusses the literature based on the combined ML and DL studies, as described in Section 7.1. Additionally, we highlight the essential findings from each study. After that, we provide a summary table that highlights the critical points while resolving the inadequacies of prior works. Finally, we provide a brief overview of some neglected characteristics of the presented combined approaches. [PERSON] et al. [30] proposed a DL approach for detecting and preventing HF attacks in RPL. In this work, the authors implemented a Gated Recurrent Unit (GRU) network with Recurrent Neural Network (RNN) to identify legitimate and malicious nodes. The methodology of the proposed model comprises three steps: network simulation, data preprocessing, and attack detection. In the network simulation step, the authors carried out three scenarios with different legitimate and malicious node combinations. The authors also computed each node's PRC parameters for later use as features to detect the attacks in the detection step. For preventing HF attacks, the authors designed a set of rules that depends on the Rx power value of the network nodes. In particular, the maximum and minimum Rx values of legitimate node(s) are used to identify malicious nodes. As a result, the proposed model achieved the highest AC values of 99.96% and 99.90% in the third scenario, using five and four features set, respectively. Furthermore, the authors attained the best outcomes (lowest value is best) for ACC, MSE, and MAC at 0.01, 0.05, and 0.05, respectively, in the third scenario with four sets of dataset features.