# Forensic Analysis of Blackhole Attack in Wireless Sensor Networks/Internet of Things
## 4 Simulation and Results
### Analysis of Simulation Outcomes
#### 4.1.8 Discussion and Verification of Results
A node that publishes fake routes to a significant number of source nodes can cause multiple types of damages to the network. In AODV, if we give responsibility to the nodes for detecting and preventing the attacks, it may work well for that specific aim but will cause an increased average end-to-end delay. We have found that it is challenging to analyze the selective behavior of the attack from the analysis of traffic in the network and packets captured at nodes. If the attack is aimed for an extended period but within small time intervals, we would not be able to identify if the packets are dropped due to the BH attack or transmission errors. We also set up networks with different modes of physical topology with the variations in the number of malicious nodes to verify the findings of our analysis. Table 4 depicts the statistics computed from Flow Monitor for the ad hoc networks in mobile and static modes. The first network is in the normal state, and its graph of data packets is presented in Figure 16. This network has only 371 flows in a normal state, and the number of flows increases to 950 during a BH attack. The second network is the same, which we briefly analyzed under the BH attack in this paper. We can see the number of packets in the network exponentially grew due to the extensive number of control packets. The PLR, average E2E delay, and throughput are affected by the attack. The third network is the same as above, but we decreased the number of total number of nodes to 35 from 50. We did this to check the random behavior of the attack in a smaller number of nodes. Therefore, the PLR decreased and the E2E delay increased. In the end, the same ad hoc \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Outcomes** & **Tx** & **Rx** & **Lx** & **PDR** & **PLR** & **DL** & **E2E** & **Th** \\ \hline Mobile (Normal) & 2316 & 2106 & 210 & 90\% & 10\% & 0.01 & 1.03 & 88.03 \\ \hline Mobile (Attack) & 10,676 & 7604 & 3072 & 71\% & 29\% & 0.051 & 6.6 & 31.49 \\ \hline Mobile (35 Nodes) & 3612 & 2737 & 875 & 75\% & 25\% & 0.03 & 14.6 & 13.81 \\ (Attack) & & & & & & & & \\ \hline Static (Attack) & 7882 & 7137 & 745 & 90\% & 10\% & 0.03 & 4.67 & 37.95 \\ \hline Tx & Transmitted & E2E DL & End to End Delay (s) & & & & & \\ Rx & Received & TH & Throughput (bps) & & & & & \\ PDR & Packet Delivery Ratio & PLR & Packet Loss Ratio & & & & & \\ Lx & Lost & DL & Delay (s) & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparative Analysis of WSN (ad hoc). \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline
**Total** & **Mal** & **Tx** & **Rx** & **Lx** & **PDR** & **PLR** & **DL** & **E2E DL** & **TH** \\ \hline \multirow{5}{*}{50} & 10 & 14,383 & 9742 & 4641 & 67\% & 33\% & 0.09 & 9.42 & 41.99 \\ \cline{2-10}  & 14 & 17,778 & 12,762 & 5017 & 70\% & 30\% & 0.08 & 8.19 & 53.  
network in the static mode under BH attack is given. The PLR is lower, but the average E2E delay, throughput, and several control packets are affected. We have reconstructed two other WSN environments with variation in parameters to verify the forensic analysis of this research. Tables 5 and 6 contain the statistics of static and mobile WSN under BH attack, respectively. We vary the number of malicious nodes in the network to observe the behavior of the protocol and network under BH attack. A small change in the number of malicious nodes, selection of specific nodes for malicious activity, specific position of the malicious node, specific grouping between nodes for malicious activity, and environmental mode of the network has a decisive impact on the cumulative performance of the network, which we can observe from the both tables. The variations in the number of malicious nodes in Table 5 from 10 to 14, 14 to 15, and 15 to 19 significantly impacted the total number of transmitted packets, further extending the effect on PDR and PLR. Similar behavior can also be observed from Table 6. The fluctuations in the depicted metrics with the variation of above mentioned parameters verify our analysis.