## 1 Introduction
RTT-based wormhole detection schemes, such as _wormhole attack prevention_ (WAP) [13], _transmission time-based mechanism_ (TTM) [15] and _delay per hop indication_ (DelPHI) [14], offer low overhead solutions in terms of hardware, computation and throughput, but have the limitation that variations in a node's packet processing time _i.e._, the sum of the queuing delay and service time must be small. In a real MANET, nodes can exhibit high packet processing time variations, a feature the _neighbour probe acknowledge_ (NPA) method [16] addresses by employing the standard deviation of the RTT as an accurate metric. NPA has not however, been tested in large scale networks and is inherently computationally heavier than either TTHCA or other RTT-based techniques because it uses encryption and time-stamped digital signatures to guarantee the security of the routing packets. In TTHCA, _packet traversal times_ (PTT) are measured instead of the RTT of a routing packet, as this more accurately reflects the distance between a source and destination node. The corollary is that TTHCA affords significantly superior wormhole detection and lower _false positive_ (FP) performance than RTT-based solutions, while concomitantly affording low computational overheads. A potential drawback of TTHCA is that under specific conditions, PM wormhole nodes can alter the time measurements and prevent the wormhole from being detected. In TTHCA, PTT is estimated by initially allowing each intermediate node to measure the packet processing time of the AODV _route request_ (RREQ) and _route reply_ (RREP) packets, before adding this measurement value \(\Delta T_{i}\) to a \(\Delta T_{TOT}\) parameter in the RREP packet. Upon receiving the RREP, the source node can calculate PTT by subtracting \(\Delta T_{TOT}\) from the RTT. A wormhole is suspected if the PTT is unrealistically high in relation to the HC. By falsely increasing \(\Delta T_{TOT}\), a PM wormhole node can evade being detected because this results in a smaller PTT than is in fact, the case. Time tampering attacks are not relevant to HM wormholes because as mentioned above, they never process the routing packets. This paper analyses the time tampering problem and investigates its impacts on TTHCA wormhole detection performance. A solution is presented to accurately identify time tampering in PM I-B wormholes by introducing a \(\Delta T\)_Vector_ extension into the TTHCA algorithm. The \(\Delta T\)_Vector_ replaces the \(\Delta T_{TOT}\) parameter in the RREP packet with a list of the individual \(\Delta T_{i}\) values from all intermediate nodes. A malicious node must thus produce a falsely inflated \(\Delta T_{i}\) in order to perform a successful time tampering attack. By using the \(\Delta T\)_Vector_ extension, a tampered \(\Delta T_{i}\) can be accurately identified by the source node as it typically is significantly higher than a healthy \(\Delta T_{i}\). The remainder of the paper is organized as follows: Section 2 presents a brief overview of the TTHCA algorithm before Section 3 investigates time tampering attacks and the specific conditions necessary for this security breach to ensue. The new \(\Delta T\)_Vector_ extension is then introduced in Section 4 and its performance analysed in Section 5 for diverse MANET scenarios. Finally, some concluding comments are provided in Section 6.