## 7 Result and Discussion
### RQ2: What Are the Existing ML-Based Approaches to Detect Attacks in RPL-Based 6 LoWPAN?
This section presents a comprehensive review of the studies based on the DL mechanisms, as described in Section 7.1. In addition, we highlighted the essential findings from each study, followed by a summarization table that underlines the essential parameters while addressing the shortcomings of previous works. Then, we briefly review some of the neglected aspects of contemporary DL approaches. [PERSON] et al. [58] developed a DL approach for detecting routing attacks in IoTs. The proposed methodology has three stages: dataset simulation, feature preprocessing, and DL stage. The work used a self-generated dataset known as IRAD, using the Cooja simulator, and comprising three types of RPL routing attacks: HF, VN, and DRA. The authors implement different scenarios for each type of attack during the first stage. For example, the authors used various regular and malicious nodes in an HF attack and replicated the same process for other attack scenarios. Then, in the second stage, the authors employed different tools to aggregate and handle the collected information. The authors also performed some preprocessing on the extracted features, using the window size to calculate the values of the extracted features. Eventually, there were 18 extracted features, including packet features, control messages features, and new lists of features extracted from some mathematical calculation based on a specified time frame. The authors then used three feature selection methods, DT, Pearson coefficient, and histogram, to select important features. Next, the selected features are fed into the final stage for attack detection using a DL algorithm. A Multi-Layer Perceptron (MLP) classifier identifies normal and malicious behavior using different activation functions. For building the DL model, the authors utilized the sequential model and employed Mean Square Error (MSE) for the loss function. Furthermore, the authors selected the AdaDelta algorithm as the optimizer. The experimental results show that the AC of the DL model is 99.5% through the use of the Sigmoid function in the output layer. As for the proposed approach's overall performance, the F1-scores for the model are 94.7%, 99%, and 95% in detecting DRA, HF, and VN attacks, respectively. Meanwhile, as for the AUC result, the model attained 94.2%, 98.1%, and 94.7% in detecting DRA, HF, and VN attacks, respectively. An anomaly-based intrusion detection model using the DL approach for detecting malicious traffic in IoT networks was designed by [63]. The proposed approach sorts the network traffic into sessions and inspects the characteristics of network activities to identify five types of RPL attacks: BH, Opportunistic Service, DDoS, SH, and WH attacks. To achieve that, the authors employed three phases in the detection process: a network connection, anomaly detection, and mitigation. The first phase initialized and deployed the required network channel to sniff the network traffic. Next, in the second phase, the authors applied some processes, such as features extraction and transformation, to the data packets before injecting them into the ML module. After that, the ML module trained the data by employing a perceptual learning model known as a supervised ML algorithm. Finally, the mitigation phase mitigates the identified attack and provides an adequate response by utilizing the actuator and handler module. Furthermore, this work uses the pre-trained layered Deep Belief Network (DBN) to develop the feed-forward Deep Neural Network (DNN) model, which is considered faster than supervised learning. Moreover, regarding the experimental result, the authors reported that the proposed approach obtained a significant result of detecting all types of attacks, for instance, in a DDoS attacks scenario, the proposed approach attained a Precision (96%) and Recall (98.7%) rate comparable to the result of the work [64]. Furthermore, the proposed scheme attained a higher F1-score of 0.973.