## 7 Result and Discussion
### RQ2: What Are the Existing ML-Based Approaches to Detect Attacks in RPL-Based 6 LoWPAN?
The architecture of the proposed approach contains three phases; the simulation phase for generating and collecting the real-time data packets, preprocessing phase to extract the features from network packets, and the last phase, which is ANNIDS. The ANNIDS phase uses the MLP classifier to identify the normal and malicious traffic. In addition, the authors set up the simulation using a random distribution of network nodes with two attacker nodes. The results reveal that the Mean Absolute Error (MAE) is 0.0002 and the Root Mean Square Error (RMSE) is 0.0003. Meanwhile, the other evaluation metrics, such as TPR, Precision, Recall, and F-Measure, attained the maximum result in this experiment. The authors in [46] conducted an ensemble learning approach based on Network IDS for detecting attacks in RPL-based IoT networks. The proposed approach, named ELNIDS, is designed to detect seven types of routing attacks (SinkHole (SH), BlackHole (BH), Sybil, Clone ID (CID), Selective Forwarding (SF), Hello Flooding (HF), and Local Repair). The architecture of the ELNIDS approach consists of several modules: sniffer for listening to network traffic, a repository for archiving the sensor events, a feature extraction module, an analysis module, a database for signatures, a user interface, and a notification manager for attack alerting. The working principle of the ELNIDS approach is based on ensemble learning that combines different kinds of ML classifiers. In this work, the authors used four types of ML classifiers: Boosted Trees, Subspace Discriminant, RUSBoosted Tree, and Bagged Trees. The authors evaluated the performance of each classifier individually using different evaluation and validation metrics. Then, the ensemble model (voting scheme) is applied to improve the classification results by merging multiple models. The output of this method produces better prediction Accuracy (AC) and generates less noise than the traditional single ML methods. To test the performance of the proposed approach, the authors used their self-generated dataset, RPL-NIDDS, which comprises seven types of routing attacks with twenty features. The authors used two evaluation and validation methods, hold-out and cross-validation, to obtain the experimental results. The simulation results show that the ensemble of Boosted Tree obtained the best AC at 94.5%, with an Area Under Curve (AUC) of 0.98, using 30% and 40% hold-out validations. However, the Subspace Discriminant model obtained the worst AC (77.8%), with an AUC of 0.87, in the case of 40% hold-out. As for the cross-validation method, the ensemble model of Boosted Trees attains the best AC. Meanwhile, the ensemble of the RUSBoosted model produced the highest value of AUC. [PERSON] et al. [47] proposed a new framework for simulating attacks in the RPL network by generating a multi-class dataset for a supervised ML model. The proposed dataset consists of 58 features extracted from the networks' packets gathered throughout the simulation. In addition, the dataset contains the traffic pattern of a regular network and various RPL attacks, such as HF, DIS Flooding, Version Number (VN), and Decreased Rank (DRA) attacks. The authors used pairwise correlation, a dimensionality reduction method, that eliminates variables that have more than a specific correlation among themselves. Moreover, the authors used a correlation ranking filter to remove irrelevant features that might mislead the detection algorithm during the feature ranking and selection stage. The feature ranking technique works by measuring the Pearson's correlation between the dataset's features and the class value. Moreover, the feature ranking and selection stages' outputs are four datasets with various features. Then, the produced datasets are evaluated separately using three types of classification algorithms: Random Forest (RF), Naive Bayes (NB), and J48 classifiers. After the evaluation process, the authors observed that the dataset with 21 features obtained the highest classification AC.