# Protocol-Specific and Sensor Network-Inherited Attack Detection in IoT Using Machine Learning
## 3 Methodology
### Modification Phase in SEMMA
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Instance**} & \multicolumn{4}{c}{**Number/Value**} \\ \cline{2-5}  & **Normal** & **PS-R** & **SN-W** \\ \hline Source ID & 3259 instances & 6213 & 4408 \\ \hline Destination ID & 3259 instances & 6213 & 4408 \\ \hline \multirow{4}{*}{Protocol} & IEEE 802.15.4 & 2991 & 241 & 3324 \\ \cline{2-5}  & UDP & 1980 & 1314 & 2152 \\ \cline{2-5}  & ICMPv6 & 1279 & 4899 & 2256 \\ \hline \multirow{2}{*}{Rank} & Number of rank values observed & 114 & 172 distinct values observed in the dataset & Number of rank values observed \\ \hline \multirow{4}{*}{Message} & DODAG Information & \multirow{2}{*}{816} & \multirow{2}{*}{1424} & \multirow{2}{*}{1218} \\  & Object (DIO) & & & \\ \cline{2-5}  & DODAG Information & \multirow{2}{*}{-} & Not considered & 23 \\ \cline{2-5}  & Solicitation (DIS) & & & \\ \cline{2-5}  & DODAG Advertisement & \multirow{2}{*}{463} & \multirow{2}{*}{3475} & \multirow{2}{*}{1015} \\  & Object (DAO) & & & \\ \cline{2-5}  & Acknowledgment (Ack) & 2991 & 241 & 3324 \\ \cline{2-5}  & UDP & 1980 & Not considered & 2152 \\ \hline \multirow{4}{*}{MaxRankInc} & The threshold set for a maximum rank increase for stable network performance and controlled DIO & \multirow{4}{*}{Normal value: 896, 816 values in the normal traffic dataset} & Value in attack scenario is set to 0 & The threshold set for a maximum rank increase for stable network performance and simulated network model & Minimum rank increase for stable network performance and simulated network model & Minimum hop rank increase for stable network performance and for avoiding loops \\ \cline{2-5}  & & & Total values observed in the rank attack & simulated network model \\ \cline{2-5}  & & & Total values observed in the rank attack & Total value: 128, 1225 values observed in the normal traffic dataset \\ \hline \multirow{4}{*}{MinHopRankInc} & Minimum hop rank increase for stable network performance and for avoiding loops & \multirow{4}{*}{Normal value: 128, 816 values observed in the normal traffic dataset} & Value in attack scenario is set to 0 & Minimum hop rank increase for stable network performance and simulated network model & Number of rank values observed in the normal value: 128, 1225 values observed in the normal traffic dataset \\ \hline \multirow{4}{*}{RErr} & Rank error, RPL’s inherent method to detect any errors in the rank values & True: 3 & True: 0 & Not considered \\ \cline{1-1} \cline{2-5}  & & False: 1976 & False: 1315 & Not considered \\ \cline{1-1} \cline{2-5}  & & Total: 1979 & & False: 1315 \\ \hline \multirow{4}{*}{DIOIIntervalMin} & \multirow{4}{*}{The interval threshold set for sending DIOs} & The normal threshold value is observed to be 12 in the simulated network, and a total of the attack: 7 & Threshold value observed to be decreased during the attack: 7 & Not considered \\ \cline{1-1} \cline{2-5}  & & & & \\ \cline{1-1} \cline{2-5}  & & in the normal traffic dataset & & \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Descriptive statistics of features in the LIoTN-RPL dataset.