## 3 Materials and Methods
### Data Collection
#### 3.3.2 Definition of Features  
During the simulation, a monitoring system is designed to record various metrics and behavioral parameters within each vehicle node during the normal scenario and the black hole attack scenario. This includes recording the most relevant information to distinguish between a normal node and a black hole node in the network. Hereafter, a brief description of the characteristics of AODV routing protocol [27] and its vulnerability to black hole attack, which will help us selecting essential features relevant in detecting the black hole attack [7]. \begin{table}
\begin{tabular}{c c} \hline \hline
**Parameter** & **Value** \\ \hline Platform & Linux, Ubuntu environment. \\ Simulator of network & NS3.29 \\ Simulator of Mobility & SUMO-0.32.0 \\ Routing protocol & AODV \\ Mac/Phy Layer & IEEE 802.11p \\ WiFichannel & YansWifi \\ Propagation model & friisLoss model \\ Transmission power & 33 dBm \\ Transport protocol & UDP \\ Traffic type & CBR (constant bit rate) \\ Packet size & 64 bytes \\ Number of vehicles & 50 \\ Runtime & 360 s \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Simulation settings. Figure 3: Network XML file edited by SUMO. AODV relies on two fundamental mechanisms, namely route discovery and route maintenance. The protocol utilizes RREQ (Route Request) and RREP (Route Reply) messages for route discovery. When a source node needs to send data to a destination, it checks its routing table for a valid route. If there is no valid route available (possibly due to non-existence, expiration, or failure), the source node broadcasts an RREQ message to all neighboring nodes. Each intermediate node forwards the RREQ message until it reaches either the destination or an intermediate node that has a valid route to the destination. The node with a valid route responds to the source node by sending a unicast RREP message along the reverse path. Upon receiving the RREP message, the source node proceeds with transmitting data packets [27]. Regarding the mechanism of route maintenance in AODV, active routes are the only ones that are maintained. Nodes regularly communicate with their neighbors by sending HELLO messages in order to analyze the status of the links and identify whether a path is fresh or not. If a link breaks, a Route Error (RERR) message is sent to the source node and any other nodes affected by the broken link. The nodes are informed of the link failure by this RERR message. The AODV routing protocol's activities are illustrated in Figure 4[7]. A severe kind of denial of service known as a \"black hole attack\" occurs when a rogue node purposefully intercepts routing request (RREQ) messages from nearby nodes. Instead of sending these RREQ packets as intended to other nodes, the malicious node disrupts the route discovery process by rapidly providing a false route reply message (RREP) with the highest sequence number. As a result, the malicious node receives data packets from the source node, assuming it is the best route, under the erroneous idea that the route discovery was successful. However, the misbehaving node captures all the routing packets and intentionally discards them, effectively preventing any successful communication [1]. Based on these unique behavioral characteristics of the black hole attack, we will choose features that are the most relevant to distinguish between a normal node and a black hole node in the VANET network. Here are the key considered points when recording various metrics and behavioral parameters:  
* Routing Behavior Analysis: this involves tracking the overall routing control packets in AODV and monitoring particular packets such as RREQ (Route Request), RREP (Route Reply), and RERR (Route Error). These parameters can contribute to the detection of the black hole attack, so they are summarized in the CTRLpackets, CountRREQ, CountRREP, and CountRERR features;  
Figure 4: AODV routing protocol mechanism.