# A Novel Anomaly Behavior Detection Scheme for Mobile Ad Hoc Networks
## 2 Background
### Security Issues in MANETs  
The security issues and design of routing protocols in MANETs are dependent on different parameters such as origin, environment, range, QoS, and security criticality. The implementation of security varies if the range of networks differs. If the nodes are distant from one another, the threat of security attacks increases. Security issues are always perilous and need to be addressed in different routing protocols for MANETs. In MANET routing protocols, nodes also act as routers and, thus, are involved in the exchange of information related to network topology. This is a significant flaw, be cause a compromised node may transmit information that is not updated to transmit traffic, or merely halt it. In addition, the routing protocols are extremely vulnerable in terms of security. The causes of the problems with MANET routing protocols include (1) the dynamic topology of ad hoc networks, (2) the infrastructure of ad hoc networks, (3) issues related to wireless communication viz. reduced security against signal and noise interference in wireless channels, and (4) the implicit trust relationship between neighbors. Varieties of security mechanisms are designed and developed to avert malicious attacks. The classical methods viz. digital signature, encryption, authentication, and access control offer the first line of defense. As a second line of defense, cooperation enforcement mechanisms and intrusion detection systems are implemented in MANETs to facilitate defense against attacks or implement cooperation, decreasing self-centered node behavior. Anomaly detection statistically defines anticipated behavior; it gathers data from genuine user behavior in a defined period, with statistical tests applied to regulate anomalous behavior with a high level of assurance. In real implementation, both approaches--preventive and reactive--are found to be more effective against attacks when combined [11]. The conventional MANET routing protocols assume that all contributors are honest; this directly permits malicious nodes to activate and attempt to paralyze the entire network, simply by providing erroneous information. Some attacks--such as impersonated nodes, blackhole, and wormhole--are common to all routing protocols, whereas other types are specific to a particular routing algorithm. For instance, in AODV, a malicious node may reply to an RREQ assuming that it has the most recently updated routes to the destined node; however, it may not have. The AODV protocol was designed assuming that all nodes are trustworthy and lack security considerations; this vulnerability is often exploited by intruders. Security enrichments to the AODV protocol are constantly needed. Many scholars have explored this subject: [PERSON] et al. evaluated the performance of the AODV protocol under blackhole attacks and no blackhole attacks by calculating the end-to-end delay of packets and the packet delivery rate [12]; the study's results showed that the packet delivery rate of AODV under attack is more than normal. However, the end-to-end delay reduces abruptly when AODV is under attack. [PERSON] et al. studied the impact of blackhole attacks on MANET performance, and found that the throughput, packet delivery rate, and end-to-end delay of normal AODV are higher than blackhole Attacks [13]. In DSDV, a malicious node may subjectively tamper with the updated messages to interrupt the routing algorithm. In [14], a secure efficient ad hoc distance vector routing protocol (SEAD) based on the insecure DSDV protocol is presentedOLSR. The optimized link-state routing (OLSR) protocol is a proactive routing protocol [3] that offers promising performance in terms of bandwidth and traffic overhead but does not incorporate any security measures. As a result, OLSR is vulnerable to various kinds of attacks [15], such as flooding attacks, link withholding attacks, replay attacks, denial-of-service (DOS) attacks, and collision.