## 7 Result and Discussion
### RQ6: What Are the Existing Threats in RPL-Based 6 LoWPAN That the Existing Studies Had Addressed?
#### 7.6.3 Traffic-Based Attacks
Furthermore, due to privacy and security concerns, most researchers prefer to generate and use their own private datasets to evaluate their works. However, since there is no standard configuration for setting up the network and simulation scenarios, it is challenging for researchers to compare their approach with others fairly. The following list provides more details about the existing datasets that are made explicitly for RPL-based 6 LoWPAN IoT networks:  
* **RPL-NIDDS2017 Dataset** is a synthetic dataset created by [PERSON] and [PERSON] [46] in 2018 using the NetSim program to simulate various network scenarios. They simulated an IoT network scenario comprising sensor nodes, a gateway, routers, and wired nodes to generate the dataset, containing 20 attributes and two additional attributes for labeling. In addition, the dataset included seven attack traces: Local Repair attacks, CID, BH, SF, Sybil, HF, and SH attacks. Moreover, the dataset's features were divided into three types: flow, basic, and time. They also proposed an approach to detect the attacks, as mentioned in Section 7.2. Figure 11: Occurrence of the datasets in the existing studies. **IoT DDoS Dataset:** [PERSON] and [PERSON] [72] proposed a real-time dataset explicitly designed for the 6 LoWPAN/RPL network. The dataset contained three DoS-based RPL attacks: DIS flooding, SF, and BH attacks. Twelve features were extracted from the physical, network, and application layers. In addition, the authors devised queueing methods for collecting network traffic from a set of sniffing nodes. The dataset simulation was executed for 24 h, resulting in more than 4,195,537 packets of RPL-based 6 LowPAN network traffic. The simulation process involved 29 nodes, where the Zolertia (z1) nodes are mimicked in the Cooja environment. Moreover, to reflect the environment of real-world networks, the authors included two distributor nodes that generate a noisy signal at predetermined intervals. Furthermore, the proposed system that generates the IoT DDoS dataset consists of four components: the capturing medium, data aggregation, queuing unit, and the feature extraction unit. The authors conducted four scenarios. The first scenario represents the normal network behavior without any attack, while the rest represent the three DoS-based RPL attacks. * **IDC and EDC Dataset:** The researchers [7] at the SERCOM Lab of the University of Carthage have created two datasets, IDC and EDC, reflecting a smart hospital infrastructure. The generated IDC dataset comprises the normal and malicious behavior of network traffic. The malicious behavior includes the traces of three attacks: Rank, Flooding, and VN Modification attacks. Meanwhile, the dataset is split into training and testing sets, with 1000 instances utilized for the training set and 200 for the testing set. The EDC dataset generation used two types of data, environmental and body sensor data, where the environmental data include environmental information, such as temperature, light, and humidity. The training and testing set of environmental data contained 100 and 200 instances, respectively. The body sensor data comprise body temperature information and heart rate information. Similar to the environmental data, 1000 instances were utilized as a training set, and 200 for the testing set. * **IRAD Dataset:** [PERSON] et al. [31] developed a VN attack-based dataset. The authors developed a Python model to extract the dataset features. The total number of extracted features was 113. They proposed a dataset comprising 1,050,861 records, out of which 884,861 were assigned as benign and the rest as malicious traffic. In addition, the authors developed a lightweight mechanism to identify the attack, as stated in Section 7.2.