# Rank and Wormhole Attack Detection Model for RPL-Based Internet of Things Using Machine Learning
## 3 Methodology
### LloTN-RPL Dataset Creation and Data Preparation  
We used the Wireshark network analyzer to perform deep network traffic analysis and fragment the data to observe the traffic pattern for creating an extensive and all-inclusive dataset with appropriate feature vectors called the LloTN-RPL dataset. As a result, the total extracted features counted to 210. We then performed the data cleaning process to delete duplicate features, resulting in the total number of features being reduced to 61, the majority of which had numeric values. Subsequently, the fixed features (with unchanging values) were removed from the dataset. Missing values were handled using the NaN as a replacement using the Pandas library in Python. Then, the categorical input features including source ID, destination ID, and protocol were encoded using one-hot encoding. One-hot encoding is a technique used in machine learning for converting categorical data into numerical data for ML-based models to successfully train them on the dataset. This is because ML models, particularly the ones involving classification algorithms for binary and multiclass problems, require the data to be in a uniform format for improving the model performance [30; 31]. One-hot encoding achieves this by converting the categorical values into a numerical format. Therefore, we have used this approach to transform the categorical features in our dataset into numerical data for uniformity. Moreover, we have encoded the target labels as (0-2) for benign, rank, and wormhole attack traffic, respectively. The static node dataset contains 17,736 data instances and the mobile node dataset contains 13,326 data points.  
Feature Engineering techniques for machine learning are a fundamental element in machine learning but are usually neglected or conducted in an uninvolved manner. However, this step needs to be performed carefully because it plays a crucial role in the accuracy of the models Feature engineering involves various processes including feature selection, transformation, and normalization that lead to a prepared dataset for building the model. Given the nature of the dataset, the feature selection process was adopted in this paper. The broad categories of feature selection methods include supervised and unsupervised methods. As this paper proposes a supervised-learning-based model, the former methodology is preferred. Supervised-learning-based feature selection methods include wrapper, filter, embedded, and hybrid methods. In this paper, we have adopted one of the filter methods called the correlation matrix with heatmap for feature selection, and a set of best resulting features is presented in Table 3.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**No.** & **Selected Features** & **Feature Name** \\ \hline
**1** & src.6 lowpan & Source ID \\ \hline
**2** & dst.6 lowpan & Destination ID \\ \hline
**3** & dio.rank & DIO rank \\ \hline
**4** & dao.ack & DAO acknowledgment \\ \hline
**5** & ack & Acknowledgment \\ \hline
**6** & udp & UDP \\ \hline
**7** & maxrankinc & Maximum Rank Increase \\ \hline
**8** & minhoprankinc & Minimum Hop Rank Increase \\ \hline \hline \end{tabular}
\end{table}
Table 3: The selected features for model development.  
Figure 4: Workflow of data collection module.