## 7 Result and Discussion
### RQ2: What Are the Existing ML-Based Approaches to Detect Attacks in RPL-Based 6 LoWPAN?
The authors in [67] introduced ML and DL techniques to identify an optimal subset of features for identifying routing attacks in RPL based IoT networks. The architecture of the proposed approach encompasses several stages. First, the authors generated an IoT routing dataset using the Cooja IoT simulator. Then, in the second stage, the preprocessing technique was applied to prepare the collected data; additionally, in this stage, the SMOTE was employed to solve the balancing issues of abnormal samples. Furthermore, the authors divided the dataset into four blocks randomly. In addition, for the feature selection stage, the Cuckoo Search (CS) meta-heuristic algorithm is employed to select the optimal features. Moreover, in this work, the Dagging meta classifier is applied to enhance the performance rate of the base learner Bayesian Logistic Regression (BLR) by minimizing the over-fitting problem. Additionally, the modified version of the CS algorithm was carried out using BLR-based Dagging, which is better than the original CS algorithm in terms of speed, convergence rate, and iteration number. Lastly, the authors utilized SVM, CNN, and Fuzzy Unordered Rule Induction Algorithm (FURIA) in the classification stage. Regarding the implementation of the presented work, the authors conducted two experiments. The first experiment examined the impact of Dagging on the original CS algorithm and BLR, and the second experiment inspected the performance of the standard CS algorithm with BLR only. Meanwhile, after implementing the designed scenarios, the authors obtained 12 features from the first experiment and 15 from the second. Additionally, the outcomes revealed that employing BLR-based Dagging improves the original CS algorithm's speed and enhances the performance of BLR. As for the result, the first experiment showed that the CNN model attained the best results of 98.57%, 1.43%, and 98.32% for AC, Error, and F-measure, respectively. Moreover, the results of the second experiment exhibited that the CNN also obtained the highest values, 92.57%, 7.43%, and 90.4% for AC, Error, and F-measure, respectively. The results showed that the first experiments' outcomes were better in AC, Error, and F-measure than the second. [PERSON] and [PERSON] [32] proposed ML techniques for detecting routing attacks in RPL-based IoT networks. The authors utilized a synthetic dataset generated using the NetSim simulator in their work. The collected network's traffic includes normal and malicious behaviors. In addition, the authors implemented seven types of RPL attacks, SH, DIO Suppression, BH, SF, Sybil, and DIS Flooding attacks. Moreover, the gathered datasets contain 21 attributes and two labels reserved for normal and attack classes. The architecture of this work comprises several modules, such as data collection, feature selection, data preprocessing, data splitting, and ML classification algorithms. The implementation flow of the proposed approach starts by collecting network traffic and then employing the feature extraction step. After that, the authors employ a random forest algorithm to reduce the datasets' features and select the most powerful ones. Later, the preprocessing techniques, such as cleaning, encoding, and scaling, are applied to the selected features. Finally, the selected features are evaluated using seven kinds of ML classifiers, such as MLP, KNN, AdaBoost (AdB), RF, Gaussian Naive Bayes (GNB), DT, and LR. As for the experimental results, the authors reported that the DT classifier obtained the best AC, Precision, and F1-score, i.e., 92.6%, 0.946, and 0.955, respectively, for 10% test data hold-out. On the other hand, the LR, GNB, and MLP achieve the best result of 1.00 for all cases regarding the Recall value. Moreover, the RF classifier gains the best AUC of 0.946 in the case of 20% hold-out data. In contrast, the GNB classifier attains a low AUC value of 0.623 during the 10% hold-out dataset among other classifiers. [PERSON] et al.