# Secure Cooperative Routing in Wireless Sensor Networks
###### Abstract
Low-level security mechanisms, including cryptography, secure key encryption, and hash functions, provide protection but often need security primitives, for example, security keys. A key management system (KMS) is used for the creation and distribution of keys, consequently developing a protected key network [11; 12]. The security protocols designed for sensor networks must take into account node failure and malicious activities as a feature of their basic functionality [13]. Complex or high-level security schemes, like intrusion detection systems (IDSs), offer enhanced protection by identifying and responding to malicious attacks within the network [14; 15; 16; 17]. This section presents the related studies that proposed bi-level techniques for both sinkhole and wormhole attacks [18; 19]. A leader-based sinkhole detection approach is proposed by [20]. It has an IDS agent with a counter that identifies the frequency visited by the agent. The counter value will be uploaded when an agent scatters the node. The counter value is refreshed if two agents are found with the same counter value. A swarm intelligence-based approach is proposed in [21] to identify sinkhole hubs in WSNs. Sinkhole detection involves a rule set and a node's ID. The value of energy is \(-1\) if the ID of the routing parcel is smaller than that stored in the ruleset of the equated node; otherwise, the energy value is \(+1\). To detect a sinkhole node, a technique based on hop count is proposed by [22]. Nodes in the network have their neighbor's record, including IDs and hop count. A hub node launches a sorting algorithm individually and computes the average number of hops. If the difference between the lowest and the average hop count is larger than the threshold, the particular hub is considered a sinkhole. WRHT, a hybrid technique for wormhole detection, is proposed by [4], which considers time delay probability per-hop (TDPH) and packet loss probability per-hop (PLPH). From the decisions of both the above probabilities, wormhole presence probabilities are calculated on the established route. Ref. [23] proposed a key encryption technique that splits the network into areas and uses mobile agents (MAs) to preserve energy by keeping it safe from intruders. Visiting Center Local (VCL) partitioned the network into sectors. When the sectors are created, the base station generates a key and shares it among the sensor nodes of the same sectors for securing the network. The use of a key will make the first injection of malicious nodes ineffective. Ref. [24] proposed a weight hop-based packet scheduling scheme, namely the starvation mitigation algorithm (SMA), for networks using the AODV protocol. In this  
Figure 1: WSN security trends [7]. algorithm, dynamic source routing (DSR) route discovery is done. Some of the previously proposed algorithms identify and isolate intruders based on neighbor-changing frequency and distance between nodes [25; 26; 27]. These protocols have heavy implementation and compromise the parameter of detection accuracy due to their high computational complexity. Techniques using mobile cluster heads and leaders [20; 23; 28] to analyze the traffic and identify the attackers have a strong verification mechanism, but generally, the communication overhead increases in these types of mechanisms. This communication overhead increases latency and packet delivery ratio. Some multipath routing protocols are also observed [27; 29; 30; 31; 24]. These protocols show high detection accuracy and less resource consumption. As they are multipath, they are cooperative and deal mostly with cooperative attacks like wormhole attacks. Several among them use the second level of the guard to the system, intrusion detection systems (IDSs) [21; 32; 33], in which the presence of threats alerts the system. Until now, the IDS mechanisms have low computational overhead, high energy efficiency, and high true positive rates but are unable to isolate attacks with different natures and discover multiple paths to mitigate link failure.