## 7 Result and Discussion
### RQ2: What Are the Existing ML-Based Approaches to Detect Attacks in RPL-Based 6 LoWPAN? This section produces a classification of the reviewed studies based on the ML mechanisms described in Section 7.1. Then, we illustrate the most crucial information from each study. After that, we figure out a summarization table that highlights the crucial parameters with the limitations of existing studies. [PERSON] [8] proposed an ML model with lightweight IDS to detect WormHole (WH) attacks in IoT networks. The proposed approach contains three ML models: K-Means (KM) clustering-based IDS (KM-IDS), Decision Tree (DT)-based IDS (DT-IDS), and a two-stage hybrid IDS approach (KM Clustering and DT models). The first model used centralized IDS to identify attacks by sorting network nodes into clusters. Each cluster, called \"safe zone\" plays a crucial role in identifying attacks inside the network, while the second model also used a centralized IDS; this model is used to train the data that help to specify the safe distance between two neighboring routers, which is later used as a baseline for identifying attacks. Then, the IDS is used to detect the attack; for example, if two routers send a request to become neighbors, the IDS will check if the safe distance between the two routers is within the specified safe distance. This decision is created through the learning stages to check whether the two neighbors' routers are normal or victims of the attack. Eventually, the last model uses the KM clustering algorithm to set up a safe zone to detect W/H attacks. After that, the DT algorithm reduces the occurrence of false alarms and improves the attack Detection Rate (DR). The author used two types of networks in the experiments. The first network comprises randomly distributed network nodes, while the second network represents standard topologies, such as mesh, ring, and star. The simulation result shows that the KM approach obtains 70-93% DR for different sizes of random RPL networks, while the second model, DT-IDS, achieves 71-80% DR. Additionally, the hybrid model attains 71-75% DR for the same network size. The result clearly shows that the hybrid model achieved the lowest result compared to the others. However, the hybrid model has significantly reduced the False Alarm Rate (FAR), while the other two models still suffer from high FAR. The study [44] presented an IDS based on a Self-Organizing Map (SOM) neural network that clusters the WSN routing attacks and reports them to the network administrator if an attack is detected. This work targeted three types of attacks: HF, SH, and VN. In addition, the authors used the Cooja simulator to create a synthetic dataset. During the simulation, the authors compute the PRC of every node utilizing Contiki's Power Tracker module. Then, the data are fed to an aggregator to perform some processing and remove unnecessary information from the packet. Finally, the processed data are inserted into  
Figure 7: Distribution of studies according to country of origin. the train to obtain the SOM map. Moreover, the authors assigned specific types of SOM parameters, for example, the Euclidean distance for the distance function, a Gaussian function as a neighborhood function, and a random initialization of the SOM weights. Furthermore, the authors extracted six types of dataset features using the available data in packet fields. The time window technique was employed as a reference to identify suspicious behavior at a particular time slot. As for the simulation result, the authors reported that the SOM model could accurately cluster the dataset samples into four classes: clean data, HF, VN, and SH attacks. [PERSON] and [PERSON] [45] conducted an Artificial Neural Network-based IDS (ANNIDS) technique for detecting attacks in RPL. The proposed approach uses MLP to identify DIS and VN attacks.