# A Survey on Energy Drainage Attacks and Countermeasures in Wireless Sensor Networks
## 4 Recent Review Based on State-of-the-Art Works for Energy Drain Attack
### Network Layer
#### 4.3.4 Wormhole Attacks  
A wormhole attack is implemented such that an attacker implants malicious nodes without compromising any legitimate nodes. Thus, detecting this attack is difficult without prior knowledge of the network. Typically, a malicious node creates a secret route called a turnel to establish a connection between them. Using this tunnel, if any packet comes to either of the attacker nodes, then it is tunneled to the other attacker node. Even though intermediate nodes along the tunnel are not a part of the connection, they become involved in transmission and drain their battery power. For example, Figure 7 illustrates an example of a wormhole tunnel. After the wormhole attack succeeds, two communication paths, upper and lower, have a hop count of more than six. However, because the wormhole tunnel between sending node A and receiving node B has only two hops, the packet is forwarded along the wormhole tunnel. After studying each method, we compare them, as presented in Table 7, in terms of advantages and disadvantages. optimization (PSO) algorithm. To detect a wormhole node, a source node sends the DP message toward a destination. Like the original AODV, a destination node replies to the FP message to the source. After receiving the FP, the round-trip time is measured. If this RTT is less than the threshold value or the hop count is equal to 2, then this path is the wormhole path. After identifying the wormhole-attacked path among all the multipaths, the source node selects one of the wormhole-free paths through the PSO algorithm by considering the energy level of all intermediate nodes. The energy efficiency of detecting wormhole nodes was addressed in [71]. In this study, the ESWI was proposed to satisfy the requirement needed to reduce overheads and energy draining during the operation. Similar to a previous study, they measured the round-trip time and compared it with the predefined distance threshold. If this round-trip time exceeded the threshold, this path was marked as containing a suspicious node. After completing the marking, a detection algorithm with two steps was performed. First, whether the hop interval duration exceeded the threshold was checked. Second, a high-power transmission channel was identified. If the path was not confirmed by the two methods, this path was considered to have wormhole nodes. [PERSON] et al. [72] proposed a novel wormhole detection algorithm to be combined with the node trust optimization model against wormholes. The number of neighbors exceeding the threshold is added to the list of suspicious nodes. Moreover, the path exceeding the wormhole threshold is tested by establishing a trust model for both the node and path. The threshold is set with analysis and practical simulation and used for path trust evaluation by performing node trust with the path hops and path trust detection on paths with hops exceeding the wormhole threshold. If the number of neighbors of a node exceeds the threshold, then it can be attacked by the wormhole. By including a node in the list of suspicious nodes, a subsequent detection stage is performed. The path's trust evaluation is measured by group calculation, indicating that every two hops belong to the same group with the comprehensive trust of intermediate nodes. By using this trust model, if wormholes occur, then attacked nodes force wormhole nodes into the go-to-sleep state and they do not participate in network communication. [PERSON] [73] proposed a novel multi-step detection (MSD) scheme. The MSD method consists of five detection modules for simplex and duplex wormhole attacks. Neighbor node validation, prolonged node validation, secret key, and signature generation processes are the primary components. For the detection process, duplex and simplex wormhole attack scenarios are considered and explained. For both cases, the sensor node recognizes