## 4 Security Benefits of Directional Antennas in WSNs
### Wormhole Attack  
The wormhole attack [63; 64] occurs on the network or physical layer and is classified as severe due to the fact that no cryptographic information is needed. This attack involves two malicious nodes that establish a uni- or bi-directional low latency link among them in order to shortcut the regular transmission path (Figure 5). By this, the adversary can collect, analyze, drop and modify the packets or can change the network topology by creating the illusion that the two ends of the wormhole tunnel are very close to each other. The methods developed to identify the wormhole attacks usually require that all/some nodes be equipped with extra hardware [65]. When the radio transmissions inside a WSN are done using directional antennas, the wormhole attack can be discovered based on direction of the received signals that will help the nodes maintain an accurate list of their neighbors. The three approaches with different levels of wormhole attack mitigation, proposed by [PERSON] and [PERSON] [53], assume that all the network nodes are equipped with directional antennas. The basic idea is to maintain an accurate list of neighbors for each network node and on this basis to reject the communication links that lead to wormhole end-points. This way, the wormhole transmitters are recognized as fake neighbors and the network will ignore them. The two authors assume an antenna model with N zones, where each zone is characterized by a conical radiation pattern covering an angle of \(2\pi/\)N radians. When idle, the sensor node works in omnidirectional antenna mode until a message is received. By determining the zone with the maximal signal power, the node is able to switch to a directional antenna mode for communicating with message's sender. The three increasingly effective protocols presented by [PERSON] and [PERSON] [53], are:  
1. The directional neighbor discovery protocol. The proposed mechanism does not rely on any type of cooperation among nodes. The protocol works in three consecutive steps: (i) a node (called announcer) of a just-deployed sensor network sends a HELLO-type message including its ID; (ii) all nodes that receive the HELLO message reply with an encrypted message that basically contains their node ID and the zone where the message was received. The encryption process is done using previously established keys, stored on each node together with corresponding neighbor ID; and (iii) the announcer will decrypt the message verifying the node ID and that the zone reported by the neighbor is opposite to its zone. After the neighbor discovery process is finished, the node will ignore any kind of messages coming from nodes that do not belong to the neighbor list. Even its effect on mitigating the wormhole attacks is reduced, the protocol is envisioned by the two authors to represent a strong basis for the following two. 2. The verified neighbor discovery protocol is based on sharing information between network nodes. It can stop attacks in which the malicious entity controls the two wormhole endpoints and when the targeted nodes have no direct communication link (are at least two hops distant). The mechanism is based on directional neighbor discovery protocol which is enhanced by a verification procedure done using verifiers (network nodes that are not in opposite direction from the wormhole endpoints). The role of verifier-nodes is to check the legitimacy of announcers. 3. The strict neighbor discovery protocol adds a supplementary requirement (the verifier region must be empty when two nodes are out of radio range) for verifier-nodes to cope with Worawannotai attack (the malicious entity convinces two close and non-neighboring nodes that they are neighbors [53]), too. This ensemble of three protocols can countermeasure the wormhole attacks without clock synchronization among nodes or precise location information. [PERSON] _et al._[54] proposed a Secure Neighbor Discovery (SND) scheme for wireless networks with a centralized network controller (NC).