## 5 Performance Analysis
### CASE 1: MANET Nodes with \(\Delta T_{i}\) Track Records  
In the first series of experiments, the situation where a node has been in the MANET for a period of time is analysed and there are at least 15 \(\Delta T_{i}\) values available. Figure 3 shows the impact of variations in both routing packet service time (\(\sigma_{R}\)) and network traffic load (\(\rho_{max}\)) upon the time tampering detection performance for different wormhole lengths. The results reveal that for the ideal case where \(\Delta T_{i}\) is constant, so all nodes have identical hardware and multiprogramming level (\(\sigma_{R}=0\)), and each node carries negligible network traffic load (\(\rho_{max}=0\)), then 100% time tampering detection is achieved for all wormhole lengths with no corresponding FP being detected (see Figure 4). Predictably, as variations in \(\Delta T_{i}\) increase, the detection rate falls and FP increase, though the time tampering detection rate is still at least 86% for all wormhole lengths analysed even when \(\sigma_{R}=0.35\) and \(\rho_{max}=0.6\). For wormhole lengths \(\geq\)5 hops, at least 94% of tampered \(\Delta T_{i}\) values can be successfully detected under all conditions when \(\sigma_{R}=0.5\) and \(\rho_{max}=0.9\), with the detection rate being 87% for a wormhole HC of 5. A notably aspect of the performance of the \(\Delta T\)_Vector_ extension, is that a minimum of 74% of tampered \(\Delta T_{i}\) values can still be detected even when the wormhole HC is 4. Pragmatically, this means that successful time tampering in wormholes \(\geq\)4 hops will be extremely difficult to achieve since the probability of avoiding detection is less than 30%. For 3 HC wormholes, the time tampering detection performance drops markedly when there are variations in either network traffic load or routing packet service times, because a healthy node can then often produce a higher \(\Delta T_{i}\) than a tampered \(\Delta T_{i}\). This reflects the situation of when heavy network traffic loads (\(\rho\approx 1\)) unavoidably cause longer queuing delays and/or high multiprogramming levels lead to increased service times for routing packets. In contrast, the wormhole nodes and those nodes through which routing packets are tunneled may continue to have negligible loads (\(\rho\approx 0\)) and correspondingly short packet service times. \begin{table}
\begin{tabular}{|p{142.3 pt}|p{142.3 pt}|} \hline
**Parameter** & **Settings** \\ \hline Distance between two successive nodes (\(d\)) & Randomly set: 150 m–250 m \\ Packet propagation speed (\(S\)) & \(3\times 10^{8}\) m/s \\ Routing packet service time per node distribution (\(T_{S}\)) & Randomly chosen from linear probability distributions for variable \(\sigma_{R}\) \\ Routing packet processing time per node distribution (\(\Delta T_{REEO/RREP}\)) & Calculated from Equation (11) \\ Network traffic load per node distribution (\(\rho\)) & Randomly \(\theta\leq\rho\leq\rho_{max}\) for variable \(\rho_{max}\) \\ Route HC & Randomly set: 3–15 \\ Number of samples per test case & 100,000 \\ Wormhole attack type & PM I-B \\ Time tampering attack & Launched according to Equations (7) and (8) \\ \hline \end{tabular}
\end{table} 
Table 1: Simulation parameter settings. Figure 4: FP detection for different wormhole HC under variable network traffic loads (\(\rho_{max}\)) and routing packet service times (\(\sigma_{R}\)) with at least 15 \(\Delta T_{i}\) samples available. Figure 3: Time tampering detection performance for different wormhole HC for variable network traffic loads (\(\rho_{max}\)) and routing packet service times (\(\sigma_{R}\)) with at least 15 \(\Delta T_{i}\) samples available. Despite this decline in performance, tampered \(\Delta T_{i}\) values can still be detected with an accuracy of 57% for 3 HC wormholes, when \(\sigma_{R}=0.5\) and \(\rho_{max}=0.9\). This still characterises a noteworthy enhancement to TTHCA, especially when cognisance is made of the stringent criteria necessary to launch a time tampering attack in the first instance.