Proposed Agent Based Black hole Node Detection Algorithm for Ad-Hoc Wireless Network

International Journal on Computational Sciences & Applications (IJCSA) Vol.5, No.2,April 2015
DOI:10.5121/ijcsa.2015.5207 69
Proposed Agent Based Black hole Node Detection
Algorithm for Ad-Hoc Wireless Network
Neeti Thakur, Dhananjay Bisen, Neelesh Gupta
Rajiv Gandhi Proudyogiki Vishwavidhalaya, Bhopal,India
Abstract
A Mobile ad-hoc network (MANET) is a latest and emerging Research topic among researchers. The
reason behind the popularity of MANET is flexibility and independence of network infrastructure. MANET
has some unique characteristic like dynamic network topology, limited power and limited bandwidth for
communication. MANET has more challenge compare to any other conventional network. However the
dynamical network topology of MANETs, infrastructure-less property and lack of certificate authority make
the security problems of MANETs need to pay more attention. This paper represents review of layer wise
security attacks. It also discussed the issues and challenges of mobile ad hoc network. On the importance of
security issues, this paper proposed intrusion detection framework for detecting network layer threats such
as black hole attack.
Keywords: Mobile ad-hoc network, AODV, security attacks, blackhole attacks, issues, challenges.
1.INTRODUCTION
In the recent years, wireless technology has a tremendous rise in popularity and usage, thus
opening new fields of applications in the domain of networking. One of the most important of
these fields concerns mobile Ad hoc networks (MANET) [1], where the participating nodes do
not rely on any existing network infrastructure. A mobile ad hoc network is a collection of
wireless nodes that can be rapidly deployed as a multi hop packet radio network without the aid
of any existing network infrastructure or centralized administration. Therefore, the inter
connections between nodes are capable of changing on content basis. Nodes within each other's
radio range communicate directly via wireless links. The designing of guaranteed security
protocol for ad hoc wireless is a very challenging task [2].
1. Shared broadcast radio channel: In wired network a dedicated transmission line or
physical wires are used for transformation of data between pair of end users. Where as in
wireless network radio channel used for data transformation between users as wireless
network is broadcast in nature. Data radiated by radio channel shared by all nodes in the
network so malicious node can easily collect data. This problem is minimized by using
directional antenna.

70
2. Insecure operational environment: Ad hoc wireless network is may not provide secure
operation environment always. Wireless network used in various application but the most
security requirement application is used in the networks of battlefields. In such
application nodes may move very frequently from secure zone to unsecure zone where
there would be probability of being attacked is increased.
3. Lack of central authority: In wired network or infrastructure based network some
important processing central point such as base station, access points, routers are used.
These central point controls and monitors the whole traffic activity and security regarding
issues of the network. Wireless network do not have such central processing points hence
this mechanism are not applicable in wireless network.
4. Lack of association: Wireless network is dynamic network in which a node can join or
leave the network at any instant of time. As there is no association limitation available for
nodes. With the help of this property of wireless network malicious node may join the
network quite easily and try to attack on network very easily.
Wireless ad-hoc networks [2] are usually vulnerable to different security threats in which
malicious activity of node one of these. In this activity, a malicious node can adsorbs and drops
all the data packets make use of on demand routing protocols such as AODV, DSR. Route
discovery and maintenance process of these routing protocols are affected by malicious node.
They immediately respond to source node with false information and source node sends it’s all
data packets through this malicious node. Some time malicious node work like black hole node in
which they plunges data packets unintentionally. This paper proposed a solution for detecting
malicious node at different wireless environment.
The rest of paper is organized as follows. In section 2 introduces the related work. Section 3 and 4
discusses the security requirements and basics of intrusion detection system. Section 5 presents a
layer based security attacks. Finally section 6 and 7 presents proposed solution of black hole
attack and conclusion of paper.
2.LITERATURE SURVEY
In 2010, Ming Yang Su proposed a method of prevention of selective black hole attacks on
mobile ad hoc networks through intrusion detection system. In this method IDS nodes are set on
sniff mode to perform anti black hole mechanism function which is used to estimate the
suspicious value of nodes according to their abnormal behavior. This suspicious value when
exceeds a threshold value then nearby IDS broadcasts message in whole network to isolate them
by malicious node [3].
In 2012, Poonam Yadav,Rakesh Kumar Gill and Naveen kumar introduced a fuzzy based
approach to detect black hole attack. This paper presents the method to identify that a node is
infected by black hole attack or not by using fuzzy based approach. This approach helps to
identify the attack occurrence over the node as well as provide the solution to reduce data loss
over the network [4].

71
In 2013, M. Mohanapriya, Llango krishnamurthi introduced a Modified Dynamic Source Routing
protocol (MDSR) for detection and removal of selective black hole attack in MANET. This paper
describes the MDSR to detect and prevent selective black hole attack and explained that selective
black hole attack is a kind of black hole attack which drops data packets selectively [5].
Adnam Nadeem and Michael P. Howarth introduced an intrusion detection and adaptive
response mechanism for MANETs. This paper describes the method to detect range of
attacks.[6]
Aikaterini Mitrokosta and Chrinstos Dimitrakakis introduced intrusion detection in MANET.
This paper provides how to use classification of IDS method for MANET and provide the
evaluation of five classifications algorithms for IDS on the basis of their performance [7].
In 2012, Pramod Kumar Singh, Govind Sharama introduced an efficient prevention method
which uses the promiscuous mode of the node. This promiscuous mode controls the whole packet
transformation activity of the network. Possibility of collision was the disadvantage of this
approach [8].
In 2010, Baldachin, A. Belmehdi introduced a merkle tree method for avoiding black hole and
cooperative black hole attack in wireless adhoc network. Merkle tree method work on the
principle of binary tree according to which every leaf contains a hash value to generate a new
combined hash [9].
In 2012, Hidehisa Nakayama, Satoshi Kurosawa, Nei Kato, Abbas Jamalipour and Yoshiaki
Nemoto proposed dynamic learning method for detecting black hole attack on AODV based
mobile adhoc networks. An anomaly detection scheme adopted using dynamic training method
according to which training data is updated at expected time intervals [10].
Different conventional approaches with its features and performance parameters:
S.
No.
Approach Description Performance
parameter
1. Analytical model of
route acquisition
process approach [11].
Introduced an Analytical model of
AODV route acquisition process and the
classification scheme for misbehaving
nodes.
Probability
description loss.
2. Real time intrusion
detection for ad hoc
networks (RIDN)
system [12].
Specification based detection technique
adapted for detection and counter
measures to minimize the damage from
the attacks.
Detection rate and
delivery ratio.
3. Neighborhood based
approach [13].
To detect and respond to black hole
attack a neighborhood based approach is
developed.
Detection
probability and
false positive
probability.
4. Anomalous basic events
approach [14].
To detect violation of the specification
directly and statistical anomalies the
specification based approach was
introduced.
Detection rate and
false positive rate.
5. Cross feature approach Anomaly based detection technique Detection

72
[15]. introduced with a data mining capability. probability.
6. Neighbor monitoring
scheme with markov
blanket based feature
selection approach [16].
Anomaly based detection technique used
through neighbor monitoring scheme
with markov blanket based feature
selection.
Detection rate of
all features and
detection rate of
using only four
selected features.
7. Dynamic training
approach [17].
Anomaly based detection technique used
to update routing table periodically to
adopt the network changes and the
clustering based technique is adopted to
identify nodes.
Detection rate
compared to static
training and false
positive rate
compared to static
training.
8. Clustering based
reputation mechanism
[18].
A clustering based reputation mechanism
proposed to recognize the flooding of
malicious nodes in military battle field
network.
Mobility of nodes,
flooding detection
rate.
9. Mechanism for
detection of cooperative
black hole attack [DRI
approach] [19].
Two concepts are introduced against
black hole attack:
• Data routing information [DRI].
• Cross checking.
Hop count,
memory overhead.
10. Detection and
prevention techniques
[DRPAODV method]
[20].
DRPAODV method introduced which
uses ALARM named managed packet to
improve throughput.
Packet delivery
ratio, routing
overhead and
delay.
11. Bluff probe based
approach [21].
Bluff probe based black hole detection
and prevention algorithm is introduced
using ZRP protocol in which extra code
is integrated for bluff probe packet.
Throughput,
routing table
entries.
12. Bayesian watchdog
[22].
Collaborative Bayesian watchdog
approach proposed which is based on
message passing mechanism.
Overhead,
tolerance
threshold.
3.SECURITY REQUIREMENTS
Ad-hoc wireless network should fulfill the following requirements of security protocol [2] [23]:
3.1.Confidentiality: The data sent from source node must be reaching to the destination node
directly through an intruder so that no one else can be able to retrieve any useful information
from data. There are different types of techniques used for ensuring of confidentiality but most
popular technique is data encryption.
3.2.Integrity: when data transferred from source node to its destination node during this
transformation, data should not be interfered by any malicious node. Hence data send by sender
node should reach destination node as it was sent.

73
3.3.Availability: The network should be in operating condition every time. It should have the
capacity to face various attacks. It should be able to provide service with security whenever an
authorized user needed them.
3.4.Non repudiation: when sender node sent data after that it cannot deny later that it had not
sent data. Received node also cannot deny that it had not received data after receiving data. This
mechanism is knows as non repudiation.
3.5.Access controllability: The communicating nodes should have total control on its
resources. They must have the tendency to identify the unauthorized node frequently before
handshaking.
4.INTRUSION DETECTION SYSTEMS
Intrusion is any set of action that attempt to understanding the integrity, confidentiality or
availability of the system and Intrusion Detection System (IDS) [1] is a system which detects
intrusion. It is basically a sophisticated packet scanner. Intrusion detection system is a framework
or a system that recognizes any irregularity in the network. A small piece of electronic chip is
appended to all devices or gadgets secured by IDS. It is also utilized as a part of wired network
however that varies from IDS in MANETs. IDS is used to detect active attacks like black hole,
byzantine, rushing, warm hole and so on attacks in MANET [24].
Figure 1:Intrusion Detection System in MANET
An IDS connected to MANET is shown in figure 1. Each node itself works as an investigator and
share investigated information with other IDS executors attached with each device. This process
helps a node to obtain information of whole network which will help to detect any misbehaving
node in the network and follow it and manage it before any node is harmed [8].

74
There are three main constituents of intrusion detection system: data collection, detection and
response [1] [25].
a. DATA COLLECTION: This constituent is used for gathering and preprocessing
information and send collected information to detection module.
b. DETECTION: In this constituent collected information is analyzed to locate intrusion
attempt is positive or negative.
c. RESPONSE: When detection component decided that an intrusion is positive or
negative then detected intrusions are sent to response component.
There are three IDS detection techniques are used signature based detection (used to detect only
known attack) [1], anomaly detection (profiles the normal behavior of system) [26] and
specification based detection (used to detect all type of attacks which can be known or unknown)
techniques [27].
4.1.SIGNATURE BASED DETECTION TECHNIQUE:
This technique is also known as misused based intrusion detection. This technique works in a
similar fashion to a virus scanner. It has a list of all known attacks in database whenever IDS
agent collects data then collected data is compared with database and decided whether it is
positive or a negative attempt. Signature based system can only detect an intrusion attempt if it
matches a pattern that is in the database, causing database to be updated continuously. These
systems can only detect known attacks but novel attacks cannot be detected which is the major
drawback of this technique [1] [25].
4.2.ANOMALY DETECTION TECHNIQUE:
Each network behavior is specified by network administrators. Anomaly detection technique
detects any behavior that fall outside of acknowledged or predefined model of network behavior.
This technique detects anomalies which figure out when something deviates from normal or
expected standard. Unknown attacks can also be detected which is its advantage over signature
based detection technique. New attacks might be distinguished without needing to stress over
database being up to date. Once system framework is introduced it proceeds to learn about
network and keeps on building its profiles. But network can be in unprotected state when system
builds its profile. When malicious action looks like ordinary activity to the framework it will
never send an alarm or alert which is the drawback of this technique [26].
4.3.SPECIFICATION BASED DETECTION:
This system have been proposed as a guaranteeing elective that join the qualities of both misuse
and anomaly detection techniques [27]. In this methodology, physically created determination or
manually developed specifications are utilized to characterize valid program. It does not generate
false alarm when unexpected program is experienced. As this detection system have large
potential to detect known as well as unknown attacks anytime. It can detect easily new attacks
that do not follow the framework specification. New specifications are additionally required for
every new program and this methodology cannot recognize some kind of attacks like denial of
service.

75
5.SECURITY ATTACKS
Internal and External Attack
Internal attacks [2] are carried out by nodes, which are actually the part of the network. Internal
attack broadcast wrong information to multiple nodes of same network. This attack is organized
by an authorized node in the network so internal attacks are more dangerous and much more
difficult to control as compare to external attacks.
Figure 2: Internal Attack and External Attack
External attacks [2] are accomplished by nodes that do not belong to the domain of the network.
External attack initiated by an authorized node of another network. External attacks normally
mean to initiate network blockage, denying access to particular system capacity. Hence try to
destroy the whole network operation. This attack’s fundamental point is to destroy normal
communication between source and destination nodes. External node could be further
characterized into active and passive attacks.

76
Active and Passive Attack
There are so many active and passive attacks [23] [28] in MANET which affects network layer.
An active attack modifies the operation of the network by changing and interfering with data.
These attacks can inject the packets, drops the packet or can adopt many different ways to launch
an attack. Active attacks are very dangerous attack because it totally changes the content of the
packet transmitted by the source node. Active attacks may be internal or external. Active external
attack organized by source node that does not belong to the same network. Active internal attack
organized by source node which is the part of the same network.
Passive attack does not interfere with the normal arrangement of the operation of the network.
Passive attacks are difficult to detect because this attack does not affect the basic operation of the
network. These attacks generally used to collect the information about the network like which
kind of communication pattern is going to be adapted, type of protocol and so on between source
and destination. This type of attack collects enough information to hijack a network very easily.
Figure 3: Active Attack and Passive Attack

77
6.CLASSIFICATION OF SECURITY ATTACK
6.1 MAC Layer attack
6.1.1.Jamming attack:
In this form of attack malicious node observe the wireless medium of the receiver node
continuously and monitor the frequency at which receiver node receiving signals from source
node after that malicious node send fake signals to receiver as result of which receiver node
become busy and assume that it is receiving actual signals sent by source node. Frequency
hopping spread spectrum (FHSS) and direct sequence spread spectrum (DSSS) techniques
commonly used to reduce this attack [2].
6.1.2.Eavesdropping attack
Eavesdropping is a passive attack. According to eavesdropping attack malicious node tries to
collect all important information about the wireless network. All nodes in the network tuned with
particular frequency band. The main purpose of this attack is to collect secured confidential
information about both communicating nodes. Attacker may steal information like private key, IP
address, protected password, location of nodes, routing information and so on [23].

78
6.1.3.Impersonation/spoofing/man in middle attack:
Each node is identified by MAC or IP address in ad-hoc network. These addresses are not capable
to authenticate any node (sender or receiver node). Therefore MAC or IP address of node can be
manipulated very easily by attackers to make useless network. When malicious node changes
source IP address in control message than this process is called “impersonation”. Man in middle
attack is the example of impersonation. In this attack malicious node adapts both spoofing and
dropping. Attacker placed malicious node as an only node in the middle of the route between
source and destination node. Malicious node prevents source node from receiving any route
information about destination node.
When source node broadcasts RREQ message in network then malicious node drop RREQ
message received by source node and immediately reply with spoofed RREP message to source
node. Source node assumes that received RREP message is coming from destination node. At the
same time malicious node send RREQ message to destination node and drop RREP message
received from destination node. Hence malicious node controls the data transmission between
source and destination. Impersonation modifies the source address due to which destination nodes
assumes that malicious node is true source node [28].
6.1.4.Selfish misbehavior/ Selective existence (selfish nodes):
Selfish node does not participate in network operation. This node does not send hello message to
other nodes of the network. Therefore it works in silent mode. When it want to communicate with
another node than it adopts routes discovery mechanism and send needed packets. It is a passive
attack in which malicious node does not participate in network operation. Silently try to gather
important information about network which is the main aim of all passive attackers [23].
6.2.Network layer attack
6.2.1.Information Disclosure:
In this attack malicious node collect confidential or important information from node and send all
collected information to unauthorized nodes of the network. Malicious node tries to collect
information such as geographical location of nodes, optimal routes to authorized nodes,
information regarding the network topology [29].
6.2.2.Sleep deviation (resource consumption attack):
It is a type of denial of service attack (dos). When source node want to communicate with
destination node then it needs a route to reach destination node. In this case source node adapts
route discovery process and broadcast RREQ with destination node information. Intermediate
node receive RREQ and check route availability if it discover any route in routing table then it
reply with unicast RREP message back to source node otherwise forward RREQ message and this
process goes on until actual route discovered or all nodes battery completely run out. To control
distribution of RREQ request message AODV routing protocol uses a “ring search technique” [6]
According to which source node send RREQ with its time field with particular initial value of
time. Source node waits for defined time if this defined time expires without receiving any RREP
message, source node resend RREQ request with greater initial time value. This process repeated
until initial time value reaches threshold value (threshold value > initial value). As this at attack
somehow depends on the require time to identify true route or battery life of nodes.

79
6.2.3.Routing attacks:
There are various types of attacks of routing protocol which try to destroy the stability of the
network. There are several attacks described briefly as follows [2] [30]:
a. Routing table overflow: In this form of attack malicious node advertises routes which
represents the connectivity of fake nodes or nodes which are not actually present in real
time, to an authorized node. The main aim of such an attack is to fill the routing table
entries completely due to which an authorized node will not able to update its routing
table with new actual routes. Proactive routing protocols are more unsafe as compare to
reactive routing protocol is case of this type of attacks.
b. Packet replication: Here, malicious node reproduce (replicates) captured or collected
packets. In this reproduction additional bandwidth and battery power utilized by the
nodes. These regenerated modified packets create big confusion in the network’s routing
process.
Figure 4: Rushing Attack
c. Rushing attack: Rushing attack [31] works against the principle of on demand routing
protocol. In this procedure nodes first broadcasts RREQ message in whole network to
discover route and each node only accepts the first coming RREQ request and discard
later received RREQ requests. Therefore malicious node sends RREQ earlier than actual
RREQ request send by actual source node. Destination node accepts the fake RREQ
request of malicious node and discard true source node RREQ request (late received
RREQ). Due to which source node become unsuccessful to find accurate route [1-2].
according to figure source node is S, destination node is D and attacker node is 5.when
source node broadcasts RREQ request message in network to identify actual route then
attacker node 5 immediately send fake RREQ request to node 2 and node 4. Both nodes
1 2
5 6 D
4
3
S
RREQ REQUEST
RUSHING RREQ

80
accept fake requests and reject later received true RREQ requests, forward fake RREQ
request to destination node. Destination node D also accepts first coming fake RREQ
request and discard later received RREQ requests [1].
6.2.4.Grey hole attack
A grey hole attack [30] represents special case of black hole attack. Grey hole attacker included
in route searched by source node and then drop all received packets selectively in particular
pattern. When source node broadcasts request message then grey hole attacker node reply with
route reply message after that source node send data packets as assuming attacker node as actual
destination node. After receiving data packets attacker node drop all received packets and make
network useless to fulfill requirement of users.
a. Black hole attack
Black hole attack [23] is an active attack. Malicious node waits for RREQ message
broadcasted by neighboring nodes to carry out a black hole attack. When attacker node
receives an RREQ message then malicious node very frequently sent back RREP
message to source node with high sequence number and minimal hop count before other
nodes true reply. After this source node assumes that it gets the shortest route to transfer
data to destination node and its route discovery process is fulfilled and it ignores other
node’s RREP messages, start to send data packets over malicious node. As malicious
node attacks on all nodes of the network and become a single destination node of all other
nodes, collect all packets and destroy over all network by dropping all received packets.
Figure 5: black hole problem in AODV

81
b. Warm hole attack
In this attack malicious node captures packets from one node and tunnels them to another
malicious node. Tunneling can be done through multiple ways such as with the help of
hidden channels (it can be wired link or wireless channel or medium), Packet
encapsulation and high powered transmission. All tunneled packets transmitted through
route with minimum number of hops. Attacker creates two malicious nodes which are
very less distance apart from each other. Given figure explains the behavior of warm hole
attack [32]. Node A and node B are connected via a hidden channel. This channel used to
tunnel data from one node to another within same network.
Figure 6: Warm Hole Attack
As shown in figure source node S wish to communicate with destination node D.
Source node when initiate the request message (RREQ) to search smallest route to reach
destination node. RREQ message received by immediate next nodes (node 1 and node 6)
and they forward RREQ message to their neighboring nodes (node 2 and node A). After
this malicious node A shares RREQ message with malicious node B without any delay.
Node B frequently forwards RREQ message to its neighboring node (node 7) and node 7
forward it to destination node as RREQ massage reached to destination node D and node
reply with RREP message to destination via different nodes to source node. After
analysis source node S get destination node D two hops apart via smallest path because
of malicious nodes therefore source node S selects route [s-6-7-D] instead of actual
route [s-1-2-3-D] to send data to destination.
c. Sybil attack
Sybil attacker [6] creates multiple additional nodes with fake identity. Malicious nodes
express itself as multiple instead of single node. These multiple additional nodes are
known as Sybil nodes. These Sybil nodes very efficiently affect the actual behavior of the
network. In the vicinity of Sybil nodes in the network, it may make hard to distinguish
misbehaving node, block true resource allocation, creates confusion between
communicating nodes in the network.

82
Figure 7: Sybil Attack
6.3.Transport layer attack
6.3.1.Session hijacking:
It is also known as address attack. In this attack malicious node get benefit by controlling the
session of data transformation between two nodes. Attacker node tries to gather confidential
information such as password, important codes and so on [1].
6.3.2.SYN flooding attack:
It is a denial of service (DoS) type of attacks due to which the connection between two authorized
nodes will never completes and data packets are not able to reach their actual destination node
[23].
6.4.Application layer attack
6.4.1.Repudiation:
This attack represents the denial activity of a node. This attack shows the mechanism of non
repudiation. According to which node pretend itself after sending data that it had not send data
and do same after receiving data (it deny that I did not receive any kind of data). For example- a
attacker person can deny to perform an operation on credit card service and can deny any
successful transaction. Firewall can be used to control the input and output process of data
packets in network layer [6].
6.4.2.Mobile virus & worm attacks:
Application layer contain information regarding user data and support several protocols such as
SMTP, FTP, HTTP etc. These protocols help attackers to destroy the operation of system via
viruses, worms, spyware [1].

83
7.PROPOSED WORK
The parameters such as security requirements, operational environment and broadcast radio
channel challenges are major design goal of ad hoc wireless network. In this paper security
aspects and major challenges of network layer protocol are discussed briefly. This paper is also
followed by layer wise classification of various types of attacks. Network layer protocol is
considered as back bone of today’s communication system. By the study of certain scenario of ad
hoc wireless network it is come to know that black hole attack is very harmful active attack of
network layer protocol. This attack affects the whole network in very serious way. In further
study a security framework will be invented to identify the malicious node in the network. It will
be analyzed in different conditions. The working efficiency of the framework will be checked or
analyzed in the presence and absence of black hole node in the network. As invented framework
will be configured along with the routing protocols, which will help to calculate the impact of
black hole attack in networks. The working of proposed framework of black hole detection as
follows:
1. Initialized the network area and mobile nodes with configuration of AODV
Routing
2. Set sender and receiver nodes and define application like CBR or FTP between
them.
3. Then mobile node follows route discovery process to create path between source
to destination using broadcasting of RREQ packets.
4. When destination node will found then it unicasts the RREP packet back to
sender with updated sequence number.
5. After that finally sender sends data packets and then receiver forward ACK
packet to sender.
6. Then check malicious activity of nodes:
a. For this activity some agent nodes are deployed in the networks.
b. The working of agent nodes is to watch the activity of neighbor’s
node.
c. Each agent node contains the following information of
neighbor’s such as updated sequence number, total packet send,
total packet received, packet delivery ratio and time.
d. On the basis of that information agent node find malicious node
(black hole node) in network
7. After that remove malicious node and its related information from network.
8. Create other alternative effective path between source to destination.
9. Then evaluate the performance of network with standard parameters such as
packet delivery ratio, end-to-end delay, throughput and Routing load with
different network condition [33].

84
8.CONCLUSION
Mobile Ad-Hoc Networks has the ability to deploy a network where a traditional network
infrastructure environment cannot possibly be deployed. Security of MANET is one of the
important features for its deployment. This paper defined various layer based security attacks,
highlights issues and challenges of mobile ad hoc network those are important to proposed
feasible solution of intrusion detection system for detecting black hole attack.
REFERENCES:
1. Hung-Jen Liao, Chun-Hung Richard Lin, Ying-Chih Lin, Kuang-Yuan Tung. “Intrusion detection
system: A comprehensive review”, Journal of Network and Computer Applications 36: 16–24, 2013.
2. C. S. R. Murthy, B. S. Manoj, “Ad Hoc Wireless Networks: Architecture and Protocols”, Pearson Ltd,
2004.
3. Ming-Yang Su. “Prevention of selective black hole attacks on mobile ad hoc networks through
intrusion detection systems”, volume 34, issue 1, Computer Communications, pages 107–117, (2011).
4. Poonam Yadav, Rakesh Kumar Gill, Naveen Kumar. “A Fuzzy Based Approach to Detect Black hole
Attack”, International Journal of Soft Computing and Engineering (IJSCE), Volume-2, Issue-3, July
2012.
5. M. Mohanapriya, Ilango Krishnamurthi. “Modified DSR protocol for detection and removal of
selective black hole attack in MANET”, Computers and Electrical Engineering, volume 40, issue 2,
February 2014, Pages 530–538.
6. Adnan Nadeem, Michael P. Howarth, “A Survey of MANET Intrusion Detection & Prevention
Approaches for Network Layer Attacks”, Communications Surveys & Tutorials, IEEE Volume:15,
Issue: 4, Page(s):2027 – 2045, ISSN:1553-877X.
7. Aikaterini Mitrokotsaa, Christos Dimitrakakis. “Intrusion detection in MANET using classification
algorithms: The effects of cost and model selection”, Ad Hoc Networks, volume 11, issue 1, January
2013, Pages 226–237.
8. Pramod Kumar Singh, Govind Sharama, “An Efficient Prevention of Black Hole Problem in AODV
Routing Protocol in MANET” IEEE 11th International Conference on trust, security and privacy in
computing and communications 2012.
9. A. Baldachin, A. Belmehdi, “Avoiding Black Hole And Cooperative Black Hole Attacks In Wireless
Ad Hoc Networks”. Arxiv preprint arXiv: 1002. 1681, 2010.
10. Satooshi Kurosawa, Hideshisa Nakayama, Nei Kato, Abbas Jamalipour And Yoshiaki Nemoto,
“Detection Blackhole Attack On AODV Based Mobile Ad Hoc Networks By Dynamic Learning
Method” International Journal Of Network Security, Vol. 5., No. 3, PP.338-346, Nov. 2007.
11. M. Hollick, J. Schmitt, C. Seipl and R. Steinmetz, “The ad hoc on-demand distance vector protocol:
an analytical model of the route acquisition process”, Proc. of Second Intl Conference on
Wired/Wireless Internet Communications (WWIC'04), Frankfurt, Feb 2004, pp. 201-212.
12. I. Stamouli, P. G. Argyroudis and H. Tewari, “Real-time intrusion detection for ad hoc Networks”,
Sixth IEEE Intl Symposium on a World of Wireless Mobile and Multimedia Networks
(WoWMoM'05), 2005, pp. 374-380.
13. B. Sun, Y. Guan, J. Chen and U. W. Pooch, “Detecting black-hole attack in mobile ad hoc networks”,
Proc. 5th European Personal Mobile Communications Conference, Apr 2003, pp. 490-495.
14. Y.A. Huang and W. Lee, “Attack analysis and detection for ad hoc routing protocols”, 7th Intl
Symposium on Recent Advances in Intrusion Detection (RAID’04), French Riviera, Sept 2004, pp.
125-145.
15. Y. Huang, W. Fan, W. Lee and P. Yu, “Cross-Feature analysis for detecting ad-hoc routing
anomalies”, Proc. of the 23rd IEEE Intl Conference on Distributed Computing Systems (ICDCS'03),
May 2003.

85
16. X. Wang, T. Lin and J. Wong, “Feature selection in intrusion detection system over mobile ad-hoc
network,” Technical Report, Computer Science, Iowa State University, 2005.
17. S. Kurosawa, H. Nakayama, N. Kato, A. Jamalipour and Y. Nemoto, “Detecting blackhole attack on
AODV-based mobile ad hoc networks by Dynamic Learning Method”, Intl Journal of Network
Security, vol 5, no. 3, Nov. 2007, pp. 338-346.
18. Taranpreet Kaur, Amanjot Singh Toor, Krishan Kumar Saluja, “Defending Manets Against Flooding
Attacks For Military Applications Under Group Mobility”, Proceedings Of 2014 RAECS VIET
Punjab University Chandigarh, 06-08 March, 2014.
19. Jaydip Sen, Sripad Koilakonda, Arijit Ukil, “A Mechanism for Detection of Cooperative Black Hole
Attack in Mobile Ad Hoc Networks”, Intelligent Systems, Modeling and Simulation (ISMS), 2011
Second International Conference on , pp:338-343, 25-27 jan. 2011.
20. Ankita Singh Kushwah, Krittika Khator, Atul Singhal, “A Review On Prevention and Detection
Techniques For Black Hole Attack In Manet”, ISSN: 2319 – 6327, Vol. 2, No. I (2013), pp. 24 – 27.
21. S. Sharma, Rajshree, R. Prakash, Vivek Shukla, “Bluff-Probe Based Black Hole Node Detection and
prevention”, IEEE international advance computing conference, 7 march 2009, pp. 458-461.
22. Manuel D. Serrat-Olmos, Enrique Hernandez-Orallo, Juan-Carlos Cano, Carlos T. Calafate, Pietro
Manzoni, “Accurate detection of black holes in MANETs using collaborative bayesian watchdogs”
IEEE International conference 2012.
23. Latha Tamilselvan, Dr. V Sankaranarayanan., “Prevention of Co-operative Black Hole Attack in
MANET”, Journal of Networks, vol. 3, no. 5, 2008.
24. Mandala S, Ngadi MA, Abdullah AH. “A survey on MANET intrusion detection”, International
Journal of Computer Science and Security 2:1–11. 2008.
25. Y. Zhang, W. Lee, and Y. Huang, “Intrusion Detection Techniques for Mobile Wireless Networks”,
ACM/ Kluwer Wireless Networks Journal, Vol. 9, No. 5, pp. 545-556, 2003.
26. Mukkamala S, Sung AH, “A comparative study of techniques for intrusion detection”, in: 15th IEEE
international conference on tools with artificial intelligence, Sacramento, California, USA, 2003, pp.
570–577.
27. Murali A, Rao M, “A survey on intrusion detection approaches”, In First international conference
information and communication technologies, Karachi, Pakistan, 2005, pp. 233–240.
28. Kamanshis Biswas and Md. Liakat Ali, “Security Threats in Mobile Ad-Hoc Network”, master thesis,
2003.
29. Pradip M. Jawandhiya, Mangesh Ghonge, M.S. Ali and J.S. Deshpande, “A Survey of Mobile Ad
Hoc Network Attacks”, International Journal of Engineering Science and Technology Vol. 2(9), pp.
4063-4071, 2010.
30. V. Balakrishnan and V. Varadharajan, “Packet Drop Attack: A Serious Threat to Operational Mobile
Ad hoc Networks”, the International Conference on Networks and Communication Systems (NCS
2005), Krabi, pp. 89-95, April 2005.
31. Yih-Chun Hu, Adrian Perrig, and David B. Johnson, “Rushing attacks and defense in wireless ad hoc
network routing protocols”, ACM workshop on Wireless Security (WISE 2003), San Diego, CA,
USA, pp. 1-11, 2003.
32. H. Yih-Chun and D. Johnson, “Wormhole attacks in wireless networks”, IEEE Journal on Selected
Areas in Communications (JSAC), vol. 24, no. 2, pp. 370-380, 2006.
33. Dhananjay Bisen, Preetam Suman, Prof. Sanjeev Sharma, Rajesh Shukla, “Effect of Pause Time on
DSR, AODV and DYMO Routing Protocols in MANET”, international journal of IT & knowledge
management, volume-3, issue-1.

Proposed Agent Based Black hole Node Detection Algorithm for Ad-Hoc Wireless Network

More Related Content

What's hot

Similar to Proposed Agent Based Black hole Node Detection Algorithm for Ad-Hoc Wireless Network

Recently uploaded

Proposed Agent Based Black hole Node Detection Algorithm for Ad-Hoc Wireless Network