By Jannatul Ferdousi M.TECH(MCNT) Roll no GNIT With guidance of Mr.Dipankar Chatterjee (Asst professor of Computer Application department)

1. Review of some existing solutions that detect black hole node(single as well as cooperative) In mobile ad-hoc network. 2. Enhance or modify two of the solutions to minimize some of its drawbacks. 3. Create a new solution to detect single as well as cooperative black hole node in Mobile ad hoc network.

 Sept-Oct: Up to 1 st project preview: Definition of Intruder, Intrusion Detection system, Intrusion Detection Technique,Types of Intrusion Detection, Mobile ad- hoc network, Intrusion detection in Mobile ad-hoc network.  Oct-Nov: Up to 2 nd project preview: AODV routing protocol, Black Hole node’s definition, Black Hole Attack, review of some of existing solution to detect Black Hole attack in Mobile ad-hoc network..  Jan-March: Up to 3 rd project preview: I have enhanced or modified two of the solutions for minimizing some of its drawbacks.

AODV routing protocol: Every node in ad-hoc network maintains routing table. It contains information about the route to the particular destination. Black Hole Attack: A black hole attack is one kind of denial of service attack where a malicious node can attract all packets by falsely claiming a fresh route to the destination and then absorb them without forwarding them to the destination. cooperative black hole attack: If these malicious nodes work together as a group then the damage will be very serious. This type of attack is called cooperative black hole attack.

 This solution proposed a method for identifying multiple black hole nodes in group.  The methodology works with slightly modified AODV protocol by using Fidelity table contains fidelity level that acts as a measure of reliability of participating node.  If fidelity level of participating node drops to zero then it is considered to be a malicious node term as a Black Hole and it is eliminated. 

 Main drawback is time delay because source node waits for RREP packet, again waits to collect the acks and then decides only a safe route.  Another drawback is that finding route contains a node which has malicious tendencies but not a black hole node.

 I propose a solution for black hole node detection using concept of threshold value and using the concept of reputation table and weight of the node. This solution has less network overhead compared to before solution.  This solution is solved by following working principle.  1.Reputation Table  2.Choosing route  3.Updating reputation table  4.Detecting black hole node

 Reputation table contains node_id, Packet forwarded, Packet received. Weight of reputation table=Packet forwarded/packet received *10 Reputation is of three types- Weight>=8 then reputation is reliable 4<=weight<=7 then reputation is suspicious Weight<4 then reputation is malicious.  Choosing route- Then route is choose with the highest average weight value of responding node and next hop node and least hop count.  After a choosing route if RACK is received within timer event then increment the weight values of all intermediate nodes along the path by 1.  If weight value of node will drop less than 4.then it is black hole node.

 Time is delay of this modified solution because this proposed solution is lengthy. If set timer is decreased then received packets will be less. For overhead, network traffic will be increased. If network traffic is decreased then no of nodes will be less then RREQ will reach to DN at more time. BHN will be less.

I propose a solution for black hole node detection using concept of Estimation table and cross checking where estimation table is maintained by each node. Estimation table Each node contains: node field-stands the power range of the node from field-stands data packet sent from the neighboring nodes through field-stands data packet routed from itself to neighboring nodes RTS/CTS field- stands ratio of received and transmitted packets of the neighboring nodes.

If I consider fig1 NODE FROM THROUGH RTS/CTS SUSPICIOUS 4 F F 10 T 5 F T 5 T 6 T F 2 F 8 T T 1 F

 Choosing fresh route-. If a node has already routed data packets from and through some neighboring node, that node should be a normal one. Suspected route- If a node has not successfully routed any data packets from or through some neighboring node, that particular node may be a black hole node and needs to be inspected further A node with high receiving/transmission ratio should be inspected with higher priority.

source node suspicious node next hop node RREQ packet RREP packet Frq packet Frq packet Frp packet Frp packet

 Suspicious node is considered as black hole node If RREQ packet from source node is not passing through suspicious node and sends RREP packet within timer event.

1. First objective have already reviewed. 2. After reviewing I have got some drawbacks then I have enhanced and minimized two of that solution. 3. I will simulate every solution by network simulator-2(ns-2) with relative to the base protocol AODV.

Thank you