{'fraction_non_alphanumeric': 0.020988028489165023, 'fraction_numerical': 0.003409607516290347, 'mean_word_length': 4.748693379790941, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
A Trusted Framework for Discovery of Block Hole Attack Over Unsecured Network

Mobile ad hoc network (MANET) is a self-configuring network of mobile nodes formed anytime and anywhere without the help of a fixed infrastructure or centralized management. It has many potential applications in disaster relief operations, military network, and commercial environments. Due to open,dynamic,infrastructure-less nature, the ad hoc networks are vulnerable to various attacks.AODV is an important on-demand distance vector routing protocol for mobile ad hoc networks. It is more vulnerable to black hole attack. In MANET, black hole is an attack in which a node shows malicious behaviour by claiming false RREP message to the source node and correspondingly malicious node drops all the receiving packets. In this paper, we have reviewed different techniques to prevent black hole attacks in MANET.


Introduction
In an ad-hoc network, mobile nodes communicate with each other using multihop wireless links .The infrastructure is not fixed that is changing with dynamic topology. Each node in the network acts as a router, forwarding data packets to other nodes [1].
MANETs have many potential applications, in military rescue operations and commercial environments. Mobile ad hoc networks are having several security issues due to their inherent nature, like open medium, dynamic topology, lack of centralized control, limited battery power and limited bandwidth [2].Hence, there exist several attacks that can be easily launched on an ad hoc network. Since, wireless networks came into existence, routing in mobile ad hoc networks has been a challenging task. The major reason for this is the constant changes in network topology due to the mobility of nodes.
The routing protocols in MANET are mainly categorized into proactive routing protocols, reactive routing protocols and hybrid routing protocol [3]. In proactive routing protocols, the routing information of nodes is exchanged, sporadically, such as DSDV. In reactive routing protocols, nodes exchange routing information when it is needed such as AODV [4]. Some ad-hoc routing protocols are a combination of the above two categories called as hybrid routing protocols.These routing protocols plays an important role in determining efficient route between a pair of nodes so that messages can be delivered in a timely manner. In the following, Section 2 provides description of AODV protocol and factors that leads to attacks on network layer, section 3 describes the way black hole attack is performed on AODV and Section 4 deals with several techniques to prevent black hole attack and last section presents conclusion and future work of paper

AODV Routing Protocol
AODV is an ad-hoc on demand distance vector routing protocol that establishes route to the destination when it is desired by the source node. It maintains these routes as and when needed by the source node. It offers quick adaptation to dynamic link conditions, low processing, memory overhead, low network utilization, and determines unicast routes to destinations within the ad hoc network [1].
One of the distinguishing features of AODV protocol is its use of destination sequence number associated with every route. Destination sequence number is created by the destination to include route information about it send to the requesting node. In order to communicate among the mobile nodes, [1] Route Requests (RREQs), Route Replies (RREPs), and Route Errors (RERRs) are the message types defined by AODV. When a source node wants to connect to a destination node, first it checks in the existing route table, as to whether a fresh route to that destination is available or not. Fresh enough route means a valid route entry whose sequence number is greater than it in the RREQ. Larger the sequence number, fresher is the route. If a fresh enough route is available, it uses the same. Otherwise the node initiates a Route Discovery by broadcasting a RREQ control message to all of its neighbors. This RREQ message will further be forwarded by the intermediate nodes to their neighbors having a fresh route to the destination. The RREQ message will eventually reach the destination node, which will react with a route reply message (RREP). The RREP is sent as a unicast to the source node along the reverse route established during the RREQ broadcast. Similarly, the RREP message allows intermediate nodes to learn a forward route to the destination node. Therefore, at the end of the route discovery process, packets can be delivered from the source node to the destination node and vice versa. A route error message (RERR) allows nodes to notify errors due to link breakage, such as when a previous neighbor moves to a new position and is no longer reachable. Each mobile node would periodically send Hello messages (HELLO), thus, each node knows which nodes are its neighboring nodes. AODV as a reactive routing protocol, does not give nodes a complete view of network topology. That is, each node only knows its neighbors, and for the nonneighbors, it only knows the next hop to reach them and the distance in hops. However, the security of AODV is compromised by the Black Hole nodes, as it accepts the received RREP having fresher route. The standard AODV routing protocol can not fight the threat of Black Hole attacks, because during the phase of route discovery, malicious nodes may counterfeit a sequence number and hop count in the routing message; thereby, acquiring the route [3] , eavesdropping and dropping all the data packets as they pass or forward some selective packets to the destination.

Black Hole Attack
In the figure 3, consider a malicious node M. When node 1 broadcasts a RREQ packet; nodes 2,4 and M receive it. Node M, being a malicious node, does not check up with its routing table for the requested route to node 5. Hence, it immediately sends back a false RREP packet, claiming a shortest route to the destination. Node 1 Receives the RREP from M ahead of the RREP from 2 and 4.Node 1 assumes that the route through M is the shortest route and sends data packets to the destination through it. When the node 1 sends data to M, it absorbs all the data and drops this data. As this data can not reach to the destination It is called as a Black hole attack. Therefore, source and destination nodes are unable to communicate with each other [2]. The malicious node always sends RREP as soon as it receives RREQ without performing standard AODV operations, while keeping the Destination Sequence number very high. Since AODV considers RREP having higher value of destination sequence number to be fresh, the RREP sent by the malicious node is treated fresh. Thus, malicious nodes succeed in injecting Black Hole attack.
M-Malicious node Data: Figure 3: Black Hole Attack

Next Hop Information Based Scheme
Deng et.al [4] has discussed a protocol that requires the intermediate nodes to send RREP message along with the next hop information. When the source node gets this information, it sends a RREQ to the next hop to verify that the target node (i.e. the node that just sent back the RREP packet) indeed has a route to the intermediate node and to the destination. When the next hop receives a Further Request, it sends a FurtherReply which includes the check result to the source node. Based on information in FurtherReply, the source node judges the validity of the route.
In this protocol, the RREP control packet is modified to contain the information about next hop. After receiving RREP, the source node will again send RREQ to the node specified as next hop in the received RREP.However, this increases the routing overhead and end-to-end delay. In addition, the intermediate node needs to send RREP message twice for a single route request.

Detection Prevention Reactive Scheme Raj PN et.al [9]
discuss a protocol viz. DPRAODV (Dynamic, Prevention and Reactive AODV) to counter the Black hole attacks. Unlike normal AODV, DPRAODV checks to find whether the RREP_Seq_No is higher than the threshold value. In this protocol, the threshold value is dynamically updated at every time interval. If the value of RREP_Seq_No is found to be higher than the threshold value, the node is suspected to be malicious and is added to a list of blacklisted nodes. It also sends an ALARM packet to its neighbors with information about the blacklisted node. Thus, the neighbor nodes know that RREP packets from the malicious node are to be discarded. That is, if any node receives the RREP packet, it looks over the list to check the source of the received message. If the reply is from the suspected node, the same is ignored. In the simulation results, the packet delivery ratio is improved by 80-85% than AODV when under black hole attack, and 60% when traffic load increases. The advantage of DPRAODV is that it achieves an obviously higher packet delivery ratio than the original AODV. Thus, the protocol though successful, suffers from the overhead of updating threshold value at every time interval and generation of the ALARM packets. The routing overhead, as a result is higher.

IDAD Mechanism
In this, [10] author proposed a solution based on Intrusion Detection using Anomaly Detection (IDAD). It prevents both attacks by single and multiple black hole nodes. IDAD assumes every activity of a user can be monitored and anomaly activities of an intruder can be identified from normal activities. To find a black hole node IDAD needs to be provided with a pre-collected set of anomaly activities, called audit data. Once audit data collected and it is given to the IDAD system, which is able to compare every activity with audit data. If any activity of a node is out of the activity listed in the audit data, the IDAD system isolates the particular node from the network. The reduction of the number of routing packets in turn minimizes network overhead and facilitates a faster communication. But the drawback is that if neighbor node give false information then this solution gives more delay in the net-work.

Nital Mistry's Method
The author proposed a solution for analyzing and improving the security of AODV routing protocol against black hole attack. The approach basically modifies the working of source node only, using additional function pre_receivereply [6]. A table cmg_rrep_tab, a variable mali_node and a new timer mos_wait_time are data strucures added to the default AODV. In the proposed solution, after receiving the first RREP the source node waits for mos_wait_time and meanwhile it stores all the rreps in the cmg_rrep_tab table until mos_wait_time.In this technique the value of mos_wait_time is considered to be half the value of rrep_wait_time. Now, the source node will analyze the stored RREP and will discard the RREP which have high destination sequence number. The node which has sent these RREP with high destination sequence number are considered to be malicious node. This technique also declare the identity of suspected malicious nodes as mail_node , so that in future it can discard messages coming from that node and the routing table is not maintained for that node The packet delivery ratio is increased by 81.812% in presence of black hole attack compared to AODV and there is 13.28% rise in end-to end delay. The disadvantage of this method it fails to detect collaborative black hole attack. E. Sequence Number Based Scheme An algorithm presented in [5] to detect the black hole attack in a MANET based on the preprocessor called Pre_Process_RREP and it is simple and does not change workings of either intermediate or destination node. It does not even modify the working of normal AODV . The Process continues to accept RREP packets and calls a process called Compare_Pkts (packet p1, packet p2) which actually compares the destination sequence number of two packets and selects the packet with higher destination sequence number if the difference between two numbers is not significantly high. Packet containing exceptionally high destination sequence number is suspected to be a malicious node and an ALERT message containing the node identification is generated which is broadcasted to neighbor nodes so that it can be isolated from the network and can maintain a list of such malicious nodes. This solution has more network delay and cannot detect cooperative black hole Nodes.

Conclusion
In this paper, a survey on detection and prevention techniques of black hole attack in MANET is presented. Black Hole attacks are serious attacks in MANET. Black hole is an attack where a malicious node do not forward the data packets to the destination and gray hole attack is a special variation of black hole attack which is difficult to detect. Based on the above survey, it can be concluded that Black Hole attacks are severe attacks and can affect the AODV routing protocol in MANET negatively. Hence, there is need for good detection and elimination mechanisms for these attacks. Future work is intended to find presence of these attacks in MANET, if present then we will detect it and confirm it whether it is black hole or gray hole attack and finally eliminate these attacks from the network.