## 1 Introduction
### Gray Hole Attacks  
A gray hole attack is a type of DoS attack which is an extension of a black hole attack. It drops the selective data packets during communication so it is called a partial packet drop attack. Initially, gray hole nodes do not appear as malicious nodes as they behave like normal nodes during the path discovery phase. To detect a gray hole node is a challenging task in MANETs because they send the correct sequence number during the path discovery phase. After some time, however, they turn into malicious nodes when the source node sends data packets to the destination node. As mentioned in Figure 1, gray hole attacks consist of two types of attacks, including sequence-based gray hole attacks and smart gray hole attacks. In sequence gray hole attacks, the malicious node sends the false routing information with a high sequence number and very few hop counts, to try to attract the traffic towards it. From time to time, it may or may not have any valid route to the destination node, whereas smart gray hole attacks are normally involved in the routing process to discover the destination node. They have a valid route to the destination node and drop the selective data packets at a particular time, hence they are called smart gray holes [11].  
Many researchers have proposed different solutions to cope with the issue of black hole and gray hole attacks in MANETs. Most of the solutions, however, detect only one type of attack (either the black hole or gray hole attacks). Many solutions fail to detect gray hole attacks, especially the smart gray node when it behaves exactly as normal during the routing process. Moreover, numerous techniques use traditional security measures, which are not appropriate due to the special dynamic features of MANETs. Some of the methods broadcast extra beacon messages, bait requests, trap RREQs, neighborhood nodes, or additional packets for route checking and the detection of malicious nodes, which causes delays due to routing overhead or the cumbersome nature of the network.  
The main focus of this paper is to detect the black and gray hole attacks in MANETs. In order to achieve this, a technique that achieves the dual detection of black hole and gray hole attacks (DDBG) is proposed. For the detection of malicious nodes, the proposed technique utilizes a connected dominating set (CDS) approach and selects the intrusion detection system (IDS) node as a query issuing node. In order to check the status of every query issuing node, the IDS node broadcasts a light-weight status packet periodically, which contains four questions to verify every node in the network. After receiving the status packet from the IDS node, legitimate nodes genuinely reply without any fabricated or forged information, whereas the malicious node sends fake information to the IDS nodes to prevent its identification by security mechanisms. The other reason for sending fake information is to drop the data packets from the source node. Due to the fabricated information of the malicious node, detection is easy because it does not satisfy the pre-defined questions of the status packets. Hence, the IDS node confirms that the node is a liar and is sending fake information, proving that the node is malicious. Once a node is identified as being malicious, the IDS node broadcasts a block message to apprise other nodes about this malicious node and to add this node to the blacklist.