## 7 Result and Discussion
### RQ2: What Are the Existing ML-Based Approaches to Detect Attacks in RPL-Based 6 LoWPAN?
The experimental results show that the RF attained the best result in detecting all kinds of attacks compared to the other algorithms. Table 4 summarizes the existing combined ML and DL approaches with their significant parameters along with advantages and limitations. **Summary:** Based on our analysis of the studies presented in this section, we discovered that two studies, [30,66], did not provide details about the feature selection technique used. Furthermore, it is evident that all studies used synthetic datasets to test their experiments, except for one [67], which used the IoT Routing Dataset. RQ5: What Are the Recent Applications Based on ML and DL Approaches Proposed for Detecting Attacks in RPL-Based 6 LoWPAN? This section presents the most recent applications based on ML and DL approaches proposed for detecting attacks in RPL networks. Using ML methods, [PERSON] et al. [69] proposed a framework for detecting routing attacks in the RPL network--specifically Rank and WH attacks--using three modules: profiling, model building, and model testing. The first module investigates the factors and parameters of Rank and WH attacks and identifies the differences between those factors to detect each type of attack. Furthermore, the parameters of Rank and WH are assigned to be used later in building an effective and high-performance detection model. At the same time, the second module selects an appropriate set of ML algorithms to detect the attacks accurately. Then, various ML algorithms are evaluated using the predefined parameters of Rank and WH attacks, and the best ones are selected to be a part of the detection model. After that, the selected algorithm is used to build and train the detection model. The last module tests the performance of the proposed model in detecting Rank and WH attacks, then finally analyzes the results. Another work by [PERSON] et al. [70] extended their previous work [69] by introducing a mitigating approach. The authors used a similar methodology to their previous work to design the attack detection model. In addition, the obtained results from the detection model were stored in an index for further analysis and used to initialize the mitigation scheme. Unfortunately, the authors failed to provide more detailed information about the mitigation scheme. Finally, the authors proposed SVM, an ML model for attack prediction. An ML approach based on the SVM classifier to detect DoS attacks in IoT was proposed in [71]. The proposed architecture designed a real-time data collection tool to monitor the network behavior and collect IoT network datasets. The workflow of the proposed architecture contains three models: Data Collection Model (DCM), Detection Model (DM), and Classification Model (CM). The DCM is designed to work with any IoT protocol type and collects IoT communication data from three layers--physical, network, and application layer features. \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline
**Ref/Year** & **A1** & **A2** & **A3** & **A4** & **A5** & **A6** & **A7** & **Advantages and Limitations** & & & & & \\ \hline \multirow{2}{*}{[34], (2002)} & \multirow{2}{*}{NA} & \multirow{2}{*}{RNN, SVM,}  
The physical layer contains features related to detecting jamming attacks that target this layer. Next, the features at the network layer are crucial for detecting many prevalent attacks, for instance, BH and DRA attacks. Finally, the application layer's features are related to some applications, such as humidity, temperature, and node power level. The detection process of the attacks begins with DCM. Then, the generated dataset from the DCM will be utilized for training and testing the proposed ML algorithm. Furthermore, the DCM includes a two-stage scenario. The first stage constructs the ML model according to the collected dataset, and the second stage embeds the predicted model.