# A Survey on Energy Drainage Attacks and Countermeasures in Wireless Sensor Networks
## 4 Recent Review Based on State-of-the-Art Works for Energy Drain Attack
### Network Layer
#### 4.3.2 Black Hole Attacks  
Selective forwarding attacks can be categorized as black hole and gray hole attacks. In black hole attacks, a malicious intermediate node drops all received packets. Therefore, it is regarded as the worst SFA. Compared to general SFAs, limited studies have focused on black hole attacks.  
[PERSON] et al. [59] proposed a countermeasure for black hole attacks through the ripple routing protocol (RPL), which is used for the IPv6 protocol over 6 LoWPAN. The authors insisted that existing schemes based on intrusion detection were too heavy or required working in the promiscuous mode. To overcome these shortages, the proposed scheme was designed to incorporate a novel distributed timer-based mechanism to perform malicious node detection through a two-step verification model. During the first step, a node set its parent as a potential black hole node. Next, a malicious node was verified using neighboring nodes in the second step. Each node is responsible for ensuring that its parent is not a black hole. A distributed timer is reset whenever a data packet is received. When no packet is received and the timer expires, the parent node is marked as a suspect and verified by all neighboring nodes.  
[PERSON] and [PERSON] [60] analyzed the effect of packet drop because of the black hole in WSNs. Because packet drops can be caused by either congestion or SFAs, their contribution is to design an on-demand link and energy-aware dynamic multipath (O-LEADM) routing scheme by combining bait methods and reply sequences. By matching two control messages, destination-sequence (des-Seq) and reply-sequence (rep-Seq), a malicious node can be detected using the bait method. In the bait method, a bit request with randomly generated false id is broadcasted. If an attacker replies to the source node by misunderstanding this as a route request message, then a source node confirms the corresponding node as the black hole and adds it to the lists. During path selection, they take into account link stability, bandwidth, and residual energy parameters.  
For black hole attacks in WSNs, [PERSON] et al. [61] investigated the effect of black hole attacks on network performance through an ad hoc on-demand distance vector (AODV) routing protocol. Following the digital forensic investigation process, attack simulation was conducted using an NS3 simulator. During the digital evidence identification and collection phase, literature review and commercial tools such as Wireshark and flow monitor were used. Next, isolation and forensic examination of the digital evidence were performed through traffic and node analysis. Based on these procedures, the networks consisting of normal and black hole nodes were reconstructed to verify damage analysis through  
Figure 6: Example of SFA detection in E-watchdog.  
forensic analysis. [PERSON] and [PERSON] [62] proposed to detect black hole attacks by the intrusion detection technique. They introduced a novel fuzzy logic-based intrusion detection system with a hidden Markov model (FIDS-HMM). A HMM was implemented to monitor the energy levels of nodes and analyze energy consumption patterns. Furthermore, malicious nodes were detected using a novel intrusion detection system with fuzzy logic.