## 7 Result and Discussion
### RQ2: What Are the Existing ML-Based Approaches to Detect Attacks in RPL-Based 6 LoWPAN?
Then, the computed distance is compared to the actual rank of the inspected node. If the two values are not equal, the inspected node is verified as malicious and eliminated from DODAG. Otherwise, it will be considered a regular node. The authors claimed that the proposed approach achieves better results than the network under rank attack only based on the experimental results. The proposed approach reduced the End to End (E2E) delay from (2.7 to 1.9) seconds compared to the network scenario under attacks when the number of nodes involved is five. Moreover, the Packet Delivery Ratio (PDR) also improved from 59% to 80% after applying the proposed mechanism in a scenario involving 15 network nodes. Furthermore, for the True Positive Rate (TPR), the proposed approach achieved 90% and 98% TPR when the number of network nodes is 5 and 30, respectively. Finally, for the False Negative Rate (FNR), the proposed approach obtained 0.9% and 0.2% scores when there are 5 and 30 network nodes involved, respectively. Research conducted by [PERSON] et al. [51] presented a distributed anomaly detection of a single mode attack in RPL networks, targeting three types of RPL attacks: HF, VN, and BH. The proposed approach deploys a pre-trained model in the network nodes to avoid extra steps, such as data collection and model training. Furthermore, the authors used a distributed architecture to eliminate communication overhead. Moreover, the proposed approach was evaluated using a semi-supervised ML algorithm suitable for a resource-constrained environment and produces a low computational overhead. The authors use Kernel Density Estimation (KDE) for the anomaly detection system due to its advantages, such as its ability to provide some degree of prolific illustration and its adaptability to work in highly resource-constrained environments. However, despite KDE providing many benefits, it still has limitations, prompting the authors to modify their model to overcome those limitations. The workflow of the detection phase contains two stages performed at node-level and root-level; the former for anomaly scoring and the latter for anomaly notification packets. Referring to the implementation part of this work, the authors used a modified version of the RPL attacks framework. They initially created 20 test groups containing 80 individual datasets, and each dataset comprises two subdatasets: a normal scenario and a malicious scenario. As for the result of the proposed approach, the authors reported that the system, on average, detects the VN, HF, and BH attacks with (96.1%, 90.2%, and 68.52%) of TPR, respectively, and 0.5% False Positive Rate (FPR). As for the model overhead, the result shows that the proposed approach increases the executable size by 17%. A Feedforward Neural Network (FNN) model for detecting suboptimal path attacks in RPL was devised by [24] to detect Worst Parent (WP) attacks and the attack sources. First, the authors defined a threat model to analyze the performance of the RPL network under WP attacks. Then, they registered some routing metrics that indicate the presence of WP attacks. In addition, the methodology of the proposed work consists of several stages: data collection, data preprocessing, FNN model initialization, and performance evaluation. In the data collection stage, several steps are used for transforming, encoding, splitting, and scaling collected data. The data are then fed into the FNN model before constructing it and setting up the required parameters. The designed FNN model identified WP attacks with 18 nodes in the input layer and two hidden layers with one output layer in the performance evaluation stage. Furthermore, the authors assigned Rectified Linear Unit (ReLU) as an activation function and specified a sigmoid activation function for the output layer. Furthermore, the authors employed an adaptive learning rate optimization algorithm to train the FNN model.