# EBR: Routing Protocol to Detect Blackhole Attacks in Mobile Ad Hoc Networks
## 3 Proposed Protocol
### EBR Routes Properties
In Figures 7 and 8, EBR behaves better than other protocols, particularly with a higher percentage of blackhole nodes. This is more obvious when EBR is compared with AODV and AOMDV protocols. Moreover, the performance gain of the EBR is about 5% compared to SUPERMAN. This shows that with increasing the number of blackhole nodes, other protocols have difficulty detecting these nodes, whereas, on the contrary, the EBR protocol uses our TR mechanism efficiently to avoid routes having blackhole nodes. Figure 6: (**a**) Throughput vs. number of nodes (without attack); (**b**) Throughput vs. number of nodes (with attack). Figure 7: End-to-end delay vs. blackhole nodes percentage. In Figure 9 and when TTL increases, the source node is supposed to test more nodes in a route, and this obviously takes more time, which in turn would enlarge the end-to-end delay regardless of having blackhole nodes or not. In Figure 10, TTL has no impact on the PDR when there are no blackhole nodes in the network. On the contrary, when having 10% blackhole nodes in the network, and as TTL increases, the PDR improves because EBR is able to detect more blackhole nodes in the network through our TR mechanism. This is more obvious when TTL is 2 rather than being 1. PDR is indifferent when TTL = 3, as the confidence level does not change according to algorithm 2. EBR has a similar performance in Figure 11.

Figure 8: Throughput vs. blackhole nodes percentage. Figure 9: End-to-end delay vs. time to live. In Figure 12, the throughput increases compared to the case of having 10% blackhole nodes shown in Figure 2:0 At a low blackhole nodes proportion, the source node will consider the path safe because the malicious nodes don't exist close enough and, therefore, can't be detected. Accordingly, the source node considers this path as secure; however, the blackhole nodes may be located farther away. In this case, data packets will be forwarded through this unsafe path where blackhole nodes drop the packets and, therefore, the throughput is relatively low. When the proportion of these suspicious nodes increases, they likely exist close to the source node and in turn can be detected, avoiding the whole path, and, accordingly, the throughput increases, as a lower number of packets will be dropped. Figure 2:1 Time to live vs. throughput. Figure 2:2 Time to live vs. PDR. In Figure 13, as TTL increases, the energy consumption increases as well. EBR will heavily use the TR mechanism when TTL is large, regardless of whether there are blackhole nodes or not. This is a limitation of EBR, where small TTL is recommended to avoid such excessive energy consumption. One of the main advantages of the wireless networks is the ease of nodes mobility. Frequent mobility would result in data loss [48]. As in Figure 14, when nodes mobility increases, the throughput would degrade. On the other hand, EBR still outperforms other protocols with 10% blackhole nodes. Figure 2:3 TTL vs. throughput with 30% blackhole nodes. Figure 2:4 Time to live vs. energy. In Figures 15 and 16, routing overhead presented is calculated using routing packets required to broadcast requests for route discovery and maintenance. AODV and AOMDV have no mechanism to detect or resist malicious nodes; therefore, routing overhead is minimal. SUPERMAN exhibits high overhead, as it uses a complex cryptography mechanism, which in turn increases the routing packets. On the other hand, EBR uses a TR mechanism to detect and avoid blackhole nodes; however, its routing overhead is slightly higher than AOMDV. This shows the efficiency of the EBR protocol. Figure 2:5 Throughput vs. mobility speed (with attack). Figure 2:6 Routing overhead vs. simulation time (with attack). ## 5 Protocol Complexity

In implementation of reactive standard routing protocols such as AODV, three methods, including Snooping, Kernel modification, and Netfilter [49], are required. Our EBR mechanism utilizes the AOMDV protocol, in which it is a multipath version of the AODV standard.