Fortifying RPL-Based 6LoWPAN in IoT: A Comprehensive Review of Emerging Attack Vectors and Defense Mechanisms using Machine Learning

Internet of Things (IoT) is a system of interconnected digital tools, including sensing elements and communication modules, that enables seamless data transfer over the Internet. These devices, though, run with resource limitations in terms of power, memory, and computational capabilities. Therefore, scientists created the IPv6 Over Low-power Wireless Personal Area Network (6LoWPAN) protocol, which allows for wireless communication among IoT devices while ensuring efficient use of resources. The Internet Engineering Task Force (IETF) has formally ratified 6LoWPAN, and its ROLL working group presented the Routing Protocol for Low-power and Lossy Networks (RPL), standardized as IETF RFC 6550, as a fundamental part of the 6LoWPAN stack. Although beneficial, RPL-based routing within IoT networks is particularly exposed to various security risks. This survey offers an in-depth overview of RPL-specific attacks and their defense mechanisms, as published in top-tier journals between 2015 and 2025. Based on a conceptual analysis of routing-based attacks in RPL, we introduce a new attack taxonomy that categorizes these attacks into 12 fundamental categories based on intrinsic features and behavior. Furthermore, we discuss the impact of every attack on network performance and describe actual cases in which these vulnerabilities have been targeted. Aside from attack classification, this survey proposes a novel taxonomy of defense mechanisms that categorizes them into 8 fundamental categories depending on their strategic method of routing attack mitigation. Every defense method is extensively studied concerning its applicability in actual IoT implementations. Furthermore, we critically study and evaluate different evaluation platforms, such as testbeds and simulators, used in investigating RPL-based security attacks and countermeasures, highlighting their applicability and usefulness in real-world environments. Lastly, we identify open research challenges by examining current literature gaps and outline future research opportunities for both researchers and practitioners. In addition, the survey notes a clear shift toward sequence-based and graph-driven learning models, supported by optimization with meta-heuristic techniques, which increasingly guide the design of modern IDS frameworks for RPL-enabled IoT networks. Our research is intended to offer valuable understanding and a strong platform for investigators to create more efficient security measures in response to evolving RPL-based attacks in the IoT environment.