## 7 Result and Discussion
### RQ2: What Are the Existing ML-Based Approaches to Detect Attacks in RPL-Based 6 LoWPAN?
Moreover, identifying VN attacks in the network relies on various parameters, such as variance in VN and the number of VN changes. Moreover, after identifying malicious nodes in the network, an alert will be sent to the root node to blacklist them. Based on the simulation result, the proposed framework achieves 0.98, 1.00, and 1.00 for AC, Precision, and Specificity, respectively. However, concerning the Recall result, the DT and Bernoulli RBM and LR obtain 95%, while SVM obtains 94  
A study by [21] devised an AI technique for detecting SF attacks in RPL. The proposed approach employs a new scheme called the AI-based Packet Drop Ratio (AIPDR), which uses neighborhood information to get the PDR. In addition, the border router node and the other nodes are working mutually based on the environmental situations in the RPL network. The working principle in this work is that all the nodes are checked for the PDR value. Meanwhile, the border router node also inspects the PDR of the other nodes. Then,based on the PDR value, the malicious mode will be detected and eliminated from the RPL network. As for the simulation results, it can be observed that after applying the proposed scheme, the PDR increased up to 89% when the number of nodes was 25. Moreover, when the number of nodes is 25, the E2E result declined from 14 to 4 after launching the proposed scheme. Concerning TPR and FPR, the proposed scheme reports 72% (highest is best) for TPR with 25 networks' nodes, and the FPR obtained 0.3% (lowest is best) with 25 of networks' nodes. In [53], the authors proposed an ML approach for detecting Rank attacks in a smart hospital environment using centralized anomaly-based IDS. The key specifications of the proposed work include adaptation, lightweight, and learning from the past. For example, the authors selected the One-class Support Vector Machine (O-SVM) for its low Power Consumption (PRC) among ML classifiers for the classification stage. As for the simulation environment, the authors designed four scenarios with a random distribution of malicious nodes and tested their approach with various numbers of attackers' nodes. The first scenario contains only normal network traffic behavior as training data for IDS, and the other three scenarios have different combinations of malicious nodes. The experimental result shows that the proposed IDS' DR increases when more malicious nodes are present in the network. [PERSON] et al. [54] proposed a DT-Based IDS for preventing intra and inter-network from Denial-of-Service (DoS) attacks. The proposed work investigates the behavior and impact of two types of Distributed DoS (DDoS) attacks: HF and VN attacks. In addition, they used the Cooja simulator to generate their dataset. Moreover, the authors deployed a distributed-IDS on some high-power sensor nodes to prevent intra- and inter-network attacks. Furthermore, the architecture of the proposed approach encompasses several IoT sensors, two of which are for IDS monitoring, and one is responsible for performing actions, which is the border router node. The proposed C5 DT-based IDS model attained 99.9% and 5.2% of AC and FAR, respectively, based on the experimental result. However, it suffered from massive Central Processing Unit (CPU) power and listening PRC under attack simulation compared to normal behavior in terms of PRC. [PERSON] and [PERSON] [55] proposed an anomaly-based distributed IDS for detecting SH attacks in RPL. In this work, a hybrid placement strategy was employed for monitoring and identifying suspicious behaviors. The monitoring nodes were deployed in the host, and the IDS agent responsible for computations and actions runs inside the border router. The workflow of the proposed approach has several stages. First, the data collection stage uses a lightweight module inside the network node to send information to the border router. After collecting the information, the preprocessing step identifies invalid and faulty data using specific techniques.