# Forensic Analysis of Blackhole Attack in Wireless Sensor Networks/Internet of Things
## 2 Literature Review
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline  & \multicolumn{3}{c}{**Internal**} & \multicolumn{3}{c}{**External**} \\ \hline
**Sources of DE** & **Perimeter** & **The** & **Sensor** & **M-Area** & **Web** & **End** & **Cloud** \\  & **Devices** & **Network** & **Nodes** & **Networks** & **Environments** & **Nodes** & \\ \hline \multirow{2}{*}{**Example**} & AAA and NAT & Network & IoT ware, Embedded & BAN, LAN, & Web Clients, & Devices, & Public, Private \\  & Servers, IPS, IDS & Media & Systems & PAN & Servers & Sensors & and Hybrid \\ \hline \multirow{2}{*}{**Expected DE**} & Admin Level & Network Logs & IP, SSID, Data & Client VMs, Logs & User activity & IP, SSID, & \\  & Evidence & & & & & logs & Data & Network Logs \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The Digital Evidence (DE) in WSN and IoT [14; 24; 25; 26]. are based on the statistical analysis of flow rate info and IDS log files. The detection time, rate and false detection rate are used as metrics of performance [29; 30]. There are some other studies that examine the jamming attack in the WSN [31; 32]. These are emphasized in the location of the clogged zone and victim nodes that damaged the network performance. A Q-learning design algorithm is used for the identification of the node location. The learning model is asynchronous and is capable of identifying the location of the the jamming area in the run-time when the attack take place. One study [33] discussed the live forensic investigation of the man in the attack (MITM). An intrusion detection system (IDS) is activated with traffic data to watch processes, packet sniffing, and log traffic with an open source IDS snort. The Snort IDS examines the entire traffic system and explores abnormalities in the network. The Live Forensic technique is implemented in a conventional manner that comprises identification, preservation, analysis, and presentation. The results of the exploration of DE are obtained in the form of the IP Address and port. The mitigation of attacks is carried out by blocking the IP Address and port used by the attacker. [PERSON] et al. [34] analytically evaluated the information reclaimed from an IoT networking device to detect the elements caused by a security rupture by extracting flash and RAM objects from a sensor node. Network connectivity information is extracted and investigated by various scenarios. They projected a scheme with the help of a RAM dump analysis tool for the extraction, analysis, and correlation of forensic data for IPv6-based WSN deployments. An IPv6 Low-Power Wireless Personal Area Networks (6 LoWPAN) traffic forensic scheme [35] to accomplish detection and investigation of attacks against availability in WSN was projected to construct the scenarios of potential interest. This scheme is related to the previous one. The attack mitigation approaches and DF studies related to this research are extensively discussed in this section. Notably, these approaches lack a node-to-network relation with the fluctuations in the severity of the attack, root-level DF investigation of BH attack, and position of the BH node relative to the cumulative damage resulting from the attack. Usually, the mitigation approaches describe the number of malicious nodes directly proportional to the damage to the network. This behavior is briefly analyzed in our research. The mitigation approaches presented are fair enough for their perspective and objectives but cannot be declared perfect for every situation and network environment. There is always a need for postmortem analysis of the attack for designing advanced countermeasures and fighting precariousness. Perfect security is just an illusion, as attackers breach systems regardless of robust prevention schemes.