# Forensic Analysis of Blackhole Attack in Wireless Sensor Networks/Internet of Things
## 1 Introduction  
The emerging integration of IoT and WSNs in various application domains has financial and societal benefits, but when these services are misused or impersonated by malicious entities, they may result in severe threats [1]. These threats may increase from the individual to the community level depending on the capacity of the malicious entity. The extensive use of WSNs and IoT in all domains of life has great risks, such as susceptibility to different security attacks [2]. Network availability, anonymity, confidentiality, access control, and integrity are critical in these vulnerable infrastructures, especially in networks of mobile devices. Data distribution and acquisition in WSNs and IoT is vulnerable to various problems such as mobility, snooping, espionage, and link breakage [3]. The mobile and broadcasting nature of WSNs, along with the resource-constrained infrastructure, makes these networks susceptible to miscellaneous denial of service (DoS) attacks [4, 5]. This research work focuses on the blackhole attack (BH), which is a detrimental type of DoS attack. In the BH attack, a malicious node proclaims a latest and shortest route to thedestination in the route-discovery phase of a source node (SN), and then the SN enters the trap and sends all data via malicious node. Consequently, the malicious node drops data packets of SN. The packet dropping behavior can encompass multiple attacker and target nodes, which may lead to an extensive DDoS attack [6]. The forensic analysis of the BH attack in static and mobile WSNs and IoT by comparing diverse parameters is conducted in this work. The precursory literature indicates various state-of-the-art attack mitigation schemes, but since security is never ultimate, and perfect security is just an illusion; it is imperative to investigate what, when, how, and why a particular security incident happened or is happening, and what damage it costs. The vulnerabilities and loopholes in the system need to be examined and revealed. Furthermore, damage to the system due to the incident(s) needs to be measured, and countermeasures need to be developed from the outcomes of forensic investigations. Digital forensics (DF) for WSN and IoT is difficult due to the proliferation of devices, heterogeneity, immense network traffic, and lack of transparency in digital evidence (DE) processing. Even though IoT data might be a valuable trace of DE, the DF investigators deal with disparate challenges, from the massive range of IoT devices and improper formats to the multi-tenant cloud organization and the subsequent multi-jurisdictional requirements[7]. Moreover, the identification, capture, discovery, and analysis of network traffic encompassing IoT infrastructure is challenging compared to traditional networks. High-speed data transmission, data extraction locations, IP addresses access, privacy, integrity, data storage on network devices, and intelligent forensic tools are key challenges in traffic analysis in IoT and WSN. Another challenge is end-to-end encryption, which means a compromise between privacy and the achievement of the DF investigation [8; 9]. Furthermore, as many IoT nodes are accumulating and processing sensitive data, they turn into a treasure of data for malevolent entities. Thus, security and particularly the capability to identify compromised nodes, together with compiling and preserving the DE of attacks, arthently arise in the effective implementation of IoT networks [10]. Post-mortem analysis of the attack can expose the status of the network at specific times and eventually provide traces about the nature of the attack and the identities of the malicious nodes. The AODV routing protocol is chosen for this study because it is one of the most notable protocols that is broadly accepted and extensively used in wireless mesh networks (WMN) due to its low setup delay, large-scale implementation, loop-free setup, flatness, efficiency in a dynamic environment, and flexibility.