# A Survey on Energy Drainage Attacks and Countermeasures in Wireless Sensor Networks
## 4 Recent Review Based on State-of-the-Art Works for Energy Drain Attack
### Network Layer
#### 4.3.1 Selective Forwarding Attacks  
A selective forwarding attack involves selecting particular nodes or packets for forwarding so that malicious intermediate nodes can selectively discard some packets in WSNs. This attack can result in retransmission and affect the application of the report system. Furthermore, if the network is constructed in a hierarchical system, and a dropped packet is from the header node, then the impact of these attacks becomes severe. To prevent this attack, general countermeasures include probing or redundancy through multiple paths. In the case of multipath routing, a different path is established against this attack. Recent studies on this type of attack are discussed as follows. [PERSON] et al. [50] suggested the data clustering algorithm (DCA) for detecting a selective forwarding attack (DCA-SFA). Through the proposed scheme, a malicious cluster header was detected and identified. Unlike the previous approach, the proposed scheme considers link quality. To accomplish this, the detection is dependent on clustering cumulative forwarding rates and adaptive DCA parameters. Through these two approaches, malicious nodes can be distinguished from normal nodes under the same channel. Therefore, this prevents misjudgment for the normal node under poor channel conditions. [PERSON] and [PERSON] [51] presented another countermeasure for SFA under clustering architecture and unreliable channels. Based on cumulative forwarding rates (CFRs) for cluster header and cumulative transmission rates for the member node, three types of nodes, namely malicious, suspicious, and regular nodes, are defined. To distinguish nodes, a non-cooperative game method with reward and punishment is applied according to the node type. The Nash equilibrium was introduced for reward between regular nodes and suspicious nodes. This equilibrium forces the suspicious nodes to increase their forwarding rates. Related to CFR in [51], [PERSON] et al. [52] considered highly dense deployment. In this case, inevitable interference among nodes results in the inaccurate detection of misbehavior. To solve this problem, the authors proposed a novel E-watchdog in which detection agents prevent collaborative selective forwarding attachment as well as filter fake reports from attackers. The agent that is close to the forwarding node is in charge of SFA by monitoring data transmitted by the forwarding node and the receiving node. Figure 6 illustrates an example of SFA detection in E-watchdog. In this figure, if node A recognizes that B forwards the packet to C, and B is regarded as the normal node; otherwise, B is the SFA node. At node B, the (1) forward and (2) normal nodes represent the normal node, whereas (3) drop and (4) SFA detect the SFA node in the E-watchdog scheme. [PERSON] et al. [53] proposed the noise-based density peaks clustering (NB-DPC) algorithm with CFR of all nodes. The new algorithm defines noise points to detect malicious behavior and speeds up the detection step by removing unnecessary steps. The noise point is chosen based on local density. A reinforcement learning-based scheme [54] to detect SFA to extend the previous work in [55] was proposed. They presented a double-threshold density peaks clustering (DT-DPC) algorithm to detect abnormal and suspicious nodes. Abnormal nodes are identified by continuous abnormalities, whereas suspicious nodes are identified by the neighbor voting method. In addition to the previous node's type, the DT-DPC algorithm is applied to divide nodes into three categories. Depending on the node type, the role of each node is set. Abnormal nodes are confirmed as malicious nodes if they are classified as abnormal in the successive five rounds, whereas suspicious nodes are further confirmed by the neighbor voting method. Normal nodes are nodes that are not abnormal or suspicious. [PERSON] and [PERSON] [56] proposed an artificial immune system based on the danger model to address the problem of existing schemes, that is, low accuracy or high algorithm complexity.