International Journal of Engineering and Techniques - Volume 3 Issue 5, Sep - Oct 2017

RESEARCH ARTICLE OPEN ACCESS

An Efficient Black Hole Attack Detection Using Secure Distributed

Path Detection (SDPD) Algorithm
V. Deepadharsini1, VR.Nagarajan2
1
M.Phil Research Scholar, Department of Computer Science ,Sree Narayana guru College, Coimbatore, India.
2
Assistant Professor, Department of Computer Science , Sree Narayana guru College, Coimbatore, India.

Abstract:
Secure Routing is a fundamental networking function in all communication system, even multi-hop wireless
networks are no exceptions. Attacking the routing service, an adversary can easily paralyze the operation of an
entire network. In this research paper aims to present an enhanced Secure Distributed Path Detection (SDPD)
Algorithm to prevent the black hole attacks in multi-hop networks. The proposed methodology consists of two
important mechanisms, Multipoint Point Relay (MPR) and Shortest path routing. The SDPD is used to select the
multiple shortest paths and secure protocol used to transfer a message to destination without packet drops. The path
selection is adopted to find the maximum Connection Probability between any given source-to-destination pair in a
dynamic way. Through extensive simulations and verification proposed framework achieves extensively better
detection accuracy than conventional methods.

Keywords — MANET, Path detection, Black hole, Attacks.

common channel. For the small systems loads the

I. INTRODUCTION
protocols are the bandwidth proficient due to the
Mobile ad hoc networks (MANETs) enclose
have been an important group of networks, need of transparency. Though, as the network load
provided that message support in assignment boosted, their bandwidth efficiency also decreases.
significant scenarios including battlefield and
strategic assignments, find and save operations, and In a black hole attack [2] a malicious node
tragedy release operations. Cluster infrastructure advertises itself as having a valid route to the
has been necessary for huge applications in
MANETs. The characteristic number of users of destination node even though the route is spurious.
MANETs has always increased, and the With this intension the attacker consumes or
applications carried by these systems have become intercepts the packet without forwarding it. The
increasingly resource demanding. In this turn, has attacker can completely suppress or modify the
increased the significance of bandwidth
effectiveness in MANETs. It is essential for the packet and generate fake information, which may
medium access control (MAC) protocol of a cause network traffic diversion or packet drop.
MANET not only to adjust to the dynamic
environment but also to efficiently manage A B
bandwidth consumption.
In common, the MAC protocols in wireless
networks can be categorized as synchronized and C D
unsynchronized protocols based on the association
level [1]. In unsynchronized protocols such as IEEE X
802.11, nodes compete with each other to divide the Fig 1: Black hole Attack

ISSN: 2395-1303 http://www.ijetjournal.org Page 214

 International Journal of Engineering and Techniques - Volume 3 Issue 5, Sep - Oct 2017

The black hole attacks are most often used to The rest of this paper is organized as follows. In
publish the addresses of networks linked to Section 2 review the Literature survey. The
spamming; most e-mail server software can be proposed models and descriptions are described in
configured to eliminate or flag messages which have Section 3. Finally conclude the paper in Section 4.
been sent from a site listed on one or more such
II. RELATED WORK
lists.
In [3] authors addressed the problem of selective
In figure 1, node “A” wants to send packet to node
jamming attacks in wireless networks. In these
“X”. In order to do so node A will send RREQ
attacks, the adversary selectively targets specific
message to neighboring nodes i.e. node “B” and
packets of “high” importance by exploiting his
node “C”. As “C” is malicious node it will quickly
knowledge on the implementation details of network
responds to the RREQ message send by node “A”
protocols at various layers of the protocol stack. To
by sending a false RREP message. Node “A” will
illustrated the impact of selective jamming on the
think that it is an active route and will send packet to
network performance by illustrating various
node “C”. After receiving packets from node “A”,
selective attacks against the TCP protocol.
node “C” will drop all the packets.
In [4] authors addressed the problem of selective
All network services of ad hoc network are
jamming attacks in wireless networks. In these
configured and created on the fly. Thus it is obvious
attacks, the adversary is active only for a short
that with lack of infrastructural support and
period of time, selectively targeting messages of
susceptible wireless link attacks, security in ad hoc
high importance. To illustrate the advantages of
network becomes inherent weakness [1]. Nodes
selective jamming in terms of network performance
within nomadic environment with access to
degradation and adversary effort by presenting two
common radio link can easily participate to set up ad
case studies; a selective attack on TCP and one on
hoc infrastructure. But the secure communication
routing
among nodes requires the secure communication
In [5] authors studied the data delivery
link to communicate. Before establishing secure
mechanisms that can with high probability
communication, link the node should be capable
circumvent black holes formed by these attacks. To
enough to identify another node. As a result node
argued that classic multipath routing approaches are
needs to provide to identity as well as associated
vulnerable to such attacks, mainly due to their
credentials to another node. However delivered
deterministic nature. So once the adversary acquires
identity and credentials need to be authenticated and
the routing algorithm, it can compute the same
protected so that authenticity and integrity of
routes known to the source, hence, making all
delivered identity and credentials cannot be
information sent over these routes vulnerable to its
questioned by receiver node. Every node wants to be
attacks.
sure that delivered identity and credentials to
In [6] authors utilized and uniquely combine the
recipient nodes are not compromised. Therefore it is
public key based homomorphic authenticator with
essential to provide security architecture to secure
random masking to achieve the privacy-preserving
ad hoc networking.
public cloud data auditing system, which meets all

ISSN: 2395-1303 http://www.ijetjournal.org Page 215

 International Journal of Engineering and Techniques - Volume 3 Issue 5, Sep - Oct 2017

above requirements. To support efficient handling of

multiple auditing tasks, to further explore the
technique of bilinear aggregate signature to extend
our main result into a multi-user setting, where TPA
can perform multiple auditing tasks simultaneously.
In [7] authors addressed the problem of
identifying and isolating misbehaving nodes that
refuse to forward packets in multi-hop ad hoc
networks. To develop a comprehensive system
called Audit-based Misbehavior Detection (AMD)
that effectively and efficiently isolates both
continuous and selective packet droppers.
In [8] authors proposed a novel method of energy-
conserving route protocol called NCE-DSR
(Number of times nodes send Constraint Energy
DSR). Based on DSR protocol, mark related to the
number of times of sending message is added to the
datagram for routing protocol. And the nodes with
relatively more number of times of sending message Fig. 2: Proposed Architecture
are protected. Cost function for route is designed for
route choice with reasonable energy allocation for A. NETWORK MODEL
the whole network.
The network model in this section
III. RESEARCH METHODOLOGY
concerning the Distributed Path Vector (DPV)
The proposed methodology accepts the simulation protocol is taken from its AODV routing. It is a
parameters as input which contains the NS2.34 proactive routing protocol, so the paths are always
simulation where the novel Secure Distributed path without delay available when needed. DPV is a
Algorithm (SDPA) is applied to the mobile adhoc normalization model of a pure link state protocol. So
network. This overall proposed architecture in figure the topological changes cause the broadcasting the
2 follows a routing procedure form start to end state. topological information to all accessible hosts in the
network. To reduce the potential collusions in the
network protocol uses Multi Point Relays (MPR).
The key idea of MPR is to reduce broadcasting
public encryption keys in some areas in the network.
An additional reduce is to provide by the shortest
path. The reducing the time period for the Hello
messages transmission can bring more reactivity
DPV uses two kinds of the control messages should

ISSN: 2395-1303 http://www.ijetjournal.org Page 216

 International Journal of Engineering and Techniques - Volume 3 Issue 5, Sep - Oct 2017

be encrypted: Hello and Topology Control (TC). process starts, each mobile node automatically
Hello messages are used for searching the selects one place in the simulation area as the
information about the connection status and the destination. It travels towards this destination with
host’s neighbors. With the Hello message the regular velocity chosen consistently and randomly
Multipoint Relay(MPR) Selector set is created from [0, V], where the parameter V is the maximum
which describes which neighbors has chosen this permissible velocity for every mobile node. The
host to act as MPR and from this information the velocity and orientation of a node are selected
host can calculate its own set of the MPRs. independently of other nodes. Upon getting the
The control messages (Hello messages) are sent destination, the node stops for a duration defined by
only one hop left but the TC messages are the ‘silence time’ parameter. If T=0, this leads to
broadcasted throughout the whole network. TC continuous mobility. After this duration, it again
messages are used for broadcasting information chooses another casual destination in the simulation
about own presented neighbors which includes at field and moves towards it. The entire process is
least the MPR Selector list. The Topology Control repeated again and again until the simulation
messages are transmitted periodically and only the process ends.
MPR hosts can forward the TC messages. In the Random Waypoint model, Vmax and
Tpause are the two input parameters that determine
B. MOBILITY MODELING the mobility actions of nodes. If the Vmax is little
and the pause time Tpause is extended, the topology
In mobility modeling a random waypoint model
of Ad Hoc network becomes relatively stable. On
(RWP) is one of the most extensively used mobility
the other hand, if the node moves fast (i.e.,Vmax is
structures in analysis of mobile ad hoc networks.
large) and the pause time Tpause is small, the
This model analyzes the stationary spatial allocation
topology is expected to be highly dynamic.
of a node shifting according to the RWP model in a
Differencing these two parameters, particularly the
given convex area. For this it gives an explicit
Vmax parameter, and the Random Waypoint model
expression, which is in the form of a one-
can generate various mobility scenarios with
dimensional essential giving the density up to
different levels of nodal speed.
normalization constant. This result is also
The proposed the Mobility metric to capture and
generalized to the case where the way points have a
quantify this nodal speed notion. The measure of
non-uniform distribution. Additionally, a modified
relative speed between node i and j at time t is,
RWP model, where the way points are on the path
boundary. The logical results are demonstrated
( )
through numerical examples. Additionally, the ( , , )= ( )− (1)
analytical results are applied to learn certain
performance measures in ad hoc networks, namely
connectivity and transfer load distribution. Then, the Mobility metric is calculated as the
In network simulator (ns-2.34) allocation, the measure of relative speed averaged over all node
execution of this mobility model is as follows: as the

ISSN: 2395-1303 http://www.ijetjournal.org Page 217

 International Journal of Engineering and Techniques - Volume 3 Issue 5, Sep - Oct 2017

pairs and over all time. The formal definition is as The control messages are broadcasted periodically
follows, for the neighbor sensing. The control messages are
only broadcasted one hop away so that they are not
1 1 forwarded further. When the first host receives the
= ( , , ) (2)
|, | Hello message from the second host, it sets the
! !
second host status to asymmetric in the routing
where |imp| is the number of distinct node pair table. When the first host send control message and
(i, j), n is the total number of nodes in the simulation includes that, it has the link to the second host as
field (i.e., ad hoc network), and T is the simulation asymmetric, the second host set first host status to
time. symmetric in own routing table. Finally, when
Using this Mobility model is able to roughly second host send again control message, where the
measure the level of nodal speed and differentiate status of the link for the first host is indicated as
the different mobility scenarios based on the level of symmetric, then first host changes the status from
mobility. The Relative Speed (RS) linearly and asymmetric to symmetric. In the end both hosts
monotonically increases with the maximum know that their neighbor is alive and the
allowable velocity. corresponding link is bidirectional.
The Control Messages (CM) is used for getting
C.SECURE ROUTING IMPLEMENTATION the information about local links and neighbors. The
control messages periodic broadcasting is used for
The secure routing of DPV uses two kinds of the
link sensing, neighbor's detection and MPR
control messages: Hello and Topology Control
selection process. Control message contains:
(TC). Hello messages are used for finding the
information how often the host sends control
information about the link status and the host’s
messages, willingness of host to act as a Multi Point
neighbors. With the Hello message the Multi Point
Relay, and information about its neighbor.
Relay (MPR) Selector set is constructed which
Information about the neighbors contains: interface
describes which neighbors has chosen this host to
address, link type and neighbor type. The link type
act as MPR and from this information the host can
indicates that the link is symmetric, asymmetric or
calculate its own set of the MPRs. The Hello
simply lost. The neighbor type is just symmetric,
messages are sent only one hop away but the TC
MPR or not a neighbor. The MPR type indicates
messages are broadcasted throughout the entire
that the link to the neighbor is symmetric and that
network. TC messages are used for broadcasting
this host has chosen it as Multi Point Relay.
information about own advertised neighbors which
includes at least the MPR Selector list. The TC D. SECURE DISTRIBUTED PATH
messages are broadcasted periodically and only the DETECTION ALGORITHM
MPR hosts can forward the TC messages.
The path in the mobile ad hoc network can be The secure distributed path detection algorithm
either unidirectional or bidirectional so the host predicts the distributed attacks (wormhole, grey-
must know this information about the neighbors. hole, and black-hole) in mobile ad hoc network. In

ISSN: 2395-1303 http://www.ijetjournal.org Page 218

 International Journal of Engineering and Techniques - Volume 3 Issue 5, Sep - Oct 2017

the detection scheme, every node in the network behavior message to all of its neighbors. The
monitors the behavior of its neighbors and upon neighbors respond by sending the observed value of
detecting any abnormal action by any of its the degree of maliciousness of the accused node.
neighbors invokes a distributed algorithm to The accused node calculates the group’s trust in its
ascertain whether the node behaving abnormally is behavior using the received values and broadcasts
indeed malicious. The protocol works through the computed group-trust along with the received
cooperation of some security components that are responses to all the neighbors. The messages are
present in each node in the networks. These also time-stamped so as to prevent replay attacks.
components are as follows: (i) discovery, (ii) trust For computing group trust value from the received
collector, (iii) trust manager, (iv) trust propagator. responses, any consensus-based scheme can be
The functions of these components are described used. In the proposed scheme, the difference of the
below. absolute trust values and the average degree of
The discovery module of each node passively maliciousness of the majority of the respondents
listens to the communication to and from each of its (neighbors) has been taken as the final group-trust
neighbors. For detecting packet drops and value of the node. Majority among the neighbors has
modifications by the neighboring nodes, the monitor been taken as the larger of the two subsets of nodes
module of a node randomly copies the incoming obtained by partitioning the nodes on the basis of a
packets to its neighbors and checks whether the preset threshold value of trust.
neighbors really forward the packets with contents Trust Manager: Each node in the network
unchanged, or drop them, or modify the contents maintains a global trust state containing the
before forwarding them. The collected data is suspected nodes and their trust values. A routing
audited by the monitor. The deviation from normal table is also maintained that contains a list of nodes
behavior of a neighbor is used as an indicator for the that has been determined to be malicious and thus
unbiased degree of maliciousness, because this is should not be allowed any access to the network
independent of the past behavior of the neighbor resources. The trust manager of a node is
node. If this unbiased deviation exceeds a pre-set responsible for verifying the correctness of the
threshold, the trust collector module of the node is group trust certificate received, caching them, and
invoke updating the global trust state (table) of the node for
The Trust collector module of a node invokes a which it has received a new group certificate (from
majority consensus algorithm among the neighbors the neighbors of a suspected node). While verifying
of a node that has been suspected to be malicious. the correctness, the trust manager must check
On being activated by its discovery module, the whether the response from every neighbor node has
(accuser) node that has suspected some malicious been correctly considered in computing the group-
activity by one of its neighbors challenges the trust by the suspected node, and the messages have
suspicious node to verify its behavior as observed not been tampered with.
by all of its neighbors. The accused (suspected) The host maintains the routing table, the routing
node on receiving the challenge responds by table entries have following information: destination
acknowledging the message and sending the verify address, next address, number of hops to the

ISSN: 2395-1303 http://www.ijetjournal.org Page 219

 International Journal of Engineering and Techniques - Volume 3 Issue 5, Sep - Oct 2017

destination and local interface address. Next address Communication,” International Journal of
indicates the next hop host. The information is got Computer Science and Security (IJCSS)
Volume: 4 Issue: 3.
from the topological set (from the TC messages) and
from the local link information base (from the Hello 2. Sukla Banerjee , “Detection/Removal of
Cooperative Black and Gray Hole Attack in
messages). So if any changes occur in these sets,
Mobile Ad-Hoc Networks”, Proceedings of the
then the routing table is recalculated. Because this is World Congress on Engineering and Computer
proactive protocol then the routing table must have Science 2008 WCECS 2008, October 22 - 24,
routes for all available hosts in the network. The 2008, San Francisco, USA.
information about broken links or partially known 3. A. Proano and L. Lazos, “Selective jamming
links is not stored in the routing table. attacks in wireless networks,” in Proc. IEEE
The routing table is changed if the changes occur ICC Conf., 2010, pp. 1–6.
in the following cases. Neighbor link appear or
disappear, two hops neighbor is created or removed, 4. A. Proano and L. Lazos, “Packet-hiding
topological link disappeared or lost or when the methods for preventing selective jamming
attacks,” IEEE Trans. Depend. Secure Comput.,
multiple interface association information changes. vol. 9, no. 1, pp. 101–114, Jan./Feb. 2012
But the update of this information does not lead to
the sending of the messages into the network. For
5. T. Shu, M. Krunz, and S. Liu, “Secure data
finding the routes for the routing table entry the collection in wireless sensor networks using
shortest path algorithm is used. randomized dispersive routes,” IEEE Trans.
Mobile Comput., vol. 9, no. 7, pp. 941–954, Jul.
IV. CONCLUSIONS 2010.
In this paper, presents an enhanced Secure
Distributed Path Detection (SDPD) Algorithm to
6. C. Wang, Q. Wang, K. Ren, and W. Lou,
prevent the black hole attacks in multi-hop “Privacy-preserving public auditing for data
networks. s used to select the multiple shortest paths storage security in cloud computing,” in Proc.
and secure protocol used to transfer a message to IEEE INFOCOM Conf., Mar. 2010, pp. 1–9.
destination without packet drops. The path selection
is adopted to find the maximum Connection 7. Y. Zhang, L. Lazos, and W. Kozma, “AMD:
Probability between any given source-to-destination Audit-based misbehavior detection in wireless
ad hoc networks,” IEEE Trans. Mobile
pair in a dynamic way. Through extensive
Comput., PrePrint, Vol. 99, published online
simulations and verification proposed framework on 6 Sept. 2013.
achieves extensively better detection accuracy than
conventional methods. 8. Linyang Sheng, Jingbo Shao, Jinfeng Ding “A
Novel Energy-Efficient Approach to DSR
REFERENCES Based Routing Protocol for Ad Hoc Network”
2010 IEEE.
1. Abhay Kumar Rai, Rajiv Ranjan Tewari &
Saurabh Kant Upadhyay, “Different Types of
Attacks on Integrated MANET-Internet

ISSN: 2395-1303 http://www.ijetjournal.org Page 220