## 2 Relevant Works  
This section presents the existing literature studies within the scope of attack detection in RPL-based 6 LoWPAN in IoT networks related to our study. The related works in this section focus on existing reviews, surveys, and systematic review studies. In addition, we identify and highlight the covered topics along with the limitations and gaps of such studies. In the research of [16], the authors provided a survey on the existing challenges in IPv6 for LLNs. The authors presented a thorough background on the RPL architecture and its network operation; additionally, the authors reviewed 97 papers related to the RPL research domain. The reviewed studies were analyzed and classified into 13 categories according to RPL specifications. In addition, this work listed statistics concerned with practical parts of reviewed studies (e.g., simulation method, number of experiments, number of parameters, and other hardware and software specifications). Furthermore, the authors covered several RPL security threats, albeit partially, and offered some ideas for future research directions. The authors in [36] provided a review of the security of RPL-based 6 LoWPAN in the IoT. First, the authors provided an overview of the IoT architecture and the RPL protocol, then explained the existing threats in RPL with some proposed defense mechanisms. In addition, this work presented the evaluation metrics used in those mechanisms. Finally, based on shortcomings extracted from the existing review studies, the authors discussed the issues and proposed some paths for future research. The authors of [25] surveyed various solutions for detecting IoT attacks using ML techniques. They presented a thorough background on the IoT layers and security issues, including different attacks targeting IoT layers. Moreover, the authors proposed various classifications for cyber-attacks based on behavior type, targeted layer, and type of damage. They also presented some ML techniques used in attack detection supported by different statistical results. However, they only briefly explained RPL attacks before discussing ML challenges and potential solutions. In [37], the authors propose an SLR on the security aspects of the RPL protocol. After a detailed introduction to the RPL architecture, the authors reviewed 53 proposals covering different aspects of RPL attack countermeasure mechanisms (e.g., mitigation, authentication, cryptography, network monitoring, secure parent node selections, and others). Moreover, the authors established a set of research questions as a baseline for their work, then answered them sequentially. Moreover, the authors categorized the collected studies into different classes and provided a comprehensive analysis from a statistical point of view; the authors also displayed a list of tables and info-graphics that facilitate the extracted information. Meanwhile, the authors showed some of the existing challenges with possible solutions. However, they did not give any details or critical analysis about the reviewed studies (e.g., proposed architecture, simulation environment, utilized parameters, conducted results, and others). In [15], the authors performed a survey on ML approaches for detecting IoTs attacks, focusing on the design of IDS based on ML techniques. The authors explained the significant aspects of IDS systems, implementation, and their taxonomy in IoT networks. Moreover, they also discussed several recent IDS approaches for detecting IoT attacks and identified their limitations. Finally, the authors identified some of the open issues and research challenges with future works that could solve outstanding problems in IoT security. The authors in [38] reviewed the implementations of several IDS strategies in IoT, providing insights into IDS techniques, deployment strategy, validation approach, and datasets. The authors first presented a taxonomy of IoT attacks with detection and security mechanisms, then offered a taxonomy for anomaly-based IDS techniques involved in IoT attack detection.