## 1 Introduction  
A _Mobile ad hoc Network_ (MANET) is a self-configuring arrangement of wireless nodes which can communicate with each other without requiring core infrastructure such as routers and base stations. They can be deployed in a range of application domains including military communications, vehicular and sensor networks, and as an access mechanism to the Internet in scenarios where nodes are out-of-radio range, such as in underground transport systems. The open nature and absence of dedicated routers mean that MANETs are especially vulnerable to routing attacks [1, 2] which can lead to severe disruption of network communications. The _wormhole attack_[3] is one of the most serious MANET routing threats since it is relatively easy to launch, difficult to detect and can yet cause significant communications disruption. A wormhole creates a fictive shortcut link in the network with the intention to attract data packets to traverse specific nodes. It involves two collaborating malicious nodes forwarding routing packets to each other. When a malicious node captures a routing packet, it is encapsulated within a new packet and tunnelled to the other wormhole node, which then extracts the routing packet before relaying it to its neighbours. As a consequence, malicious nodes can appear as neighbours despite being located several hops from each other. Wormhole attacks can be launched in two ways: _hidden mode_ (HM) and _participation mode_ (PM) [4]. The former captures and forwards routing packets to each other without modifying the actual packets, so the wormhole nodes never appear in routing tables. In contrast, PM nodes process routing packets as any pair of legitimate nodes and thus appear in a wormhole infected route as two contiguous nodes. Wormhole nodes can forward routing packets to each other using either an _in-band_ (I-B) or _out-of-band_ (O-B) communication link. I-B tunnels packets between the malicious nodes via genuine network nodes so it is easy to launch, while the O-B link is more complex because it requires an external communication channel, _i.e._, network cable or directional antenna, to establish a direct link between the wormhole nodes. Designing effective and robust wormhole detection schemes means considering all four modes with each mandating different requirements upon the detection mechanism. Various detection strategies have been proposed and these can be broadly classified into: (_i_) neighbour validation and (_ii_) end-to-end techniques. Neighbour validation schemes like packet leashes [3] and [5] are only effective for HM wormhole attacks because they rely on every node checking the validity of its neighbours and since PM wormhole nodes appear as legitimate neighbours in a route, they can avoid being detected by simply ignoring the validity check. Other schemes like _statistical wormhole apprehension using neighbours_ (SWAN) [6] identify a wormhole by the number of neighbours, though this is only effective for HM wormholes since PM wormholes do not increase the number of neighbours for a legitimate node. In contrast, end-to-end detection techniques measure and analyse node activity and route features such as the geographical positions of nodes [7, 8, 9, 10, 11], the frequency of node appearances in routes [9, 10, 11], _hop count_ (HC) information [12] or _round trip time_ (RTT) of routing packets [13, 14, 15, 16]. Such techniques are typically used to detect PM wormholes, but have a number of recurring limitations including, the inability to detect all wormhole variants, the requirement of dedicated hardware, reliance on certain MANET environments, and high computational overheads and/or bandwidth loads upon the network. The _traversal time and hop count analysis_ (TTHCA) algorithm is a new wormhole detection technique [17] designed as a security extension to the _ad hoc on demand distance vector_ (AODV) [18] routing protocol. It combines the benefits of RTT-based approaches with HC analysis, to provide improved detection for all wormhole types, under a variety of network scenarios.