# EBR: Routing Protocol to Detect Blackhole Attacks in Mobile Ad Hoc Networks
## 3 Proposed Protocol
### EBR Routes Properties  
In algorithm 2, there are some cases where their confidence degrees have no change. Each node is supposed to run the integrity test periodically; therefore, confidence degrees will be decided for the close nodes to the source node. In other words, the blackhole node \(W\) is farther away from testing node \(N\); however, \(W\) is close to another testing node \(M\). Therefore, nodes in one route through \(W\) from \(N\) will have no change in their confidence degrees, but their confidence level will be different when \(W\) is tested through node \(M\). In Algorithm 3, array \(A\) will be sorted based on the minimum RTT of those routes obtained by the AOMDV protocol. Next, routes will be checked to find the one with a confidence higher than zero. If this is not available, array \(A\) is searched to find the route in which the confidence degree equals zero. Some nodes might behave normally at some time and their confidence will be determined as TRUST; however, later these nodes will act maliciously. This can be detected if the testing node runs integrity tests more frequently; however, this would increase the traffic overhead. The mobility of nodes would negatively affect the RTT measurement and its accuracy, and this is one of the constraints of the RTT-based methods. There are plenty of protocols that use RTT in data communications of different systems, as outlined in [43]. RTT deterioration depends on types of the connection in the sense of being short-term or long-term connections. For long-term connections, RTT should be updated frequently to avoid performance degradation, especially in networks having high-speed-nodes mobility. Figure 1: Flow chart of Enhanced Blackhole Resistance Method. EBR uses the RTT to predict the congested routes, but this does not conflict with the congestion control protocols, such as NewReno, applied on nodes individually. RTT has been used over the years by researchers to evaluate network performance. RTT can possibly be measured via a few ICMP echo requests and response messages between the source and the destination nodes [44]. On the other hand, the mobility of nodes would result in links failure and packets loss. Multipath routing protocols such as AOMDV produce alternate routes available when communication disconnect occurs. EBR provides such alternate routes that are sorted based on the minimum RTT. ```
1. Begin
2. Input \(n\)
3. When a node joins the network
5. Status = TRUST
6. Confidence = +1
7. Broadcast Test_RREQ to neighboring nodes with TTL = \(n\)
8. If (RREP = 0)
9. Then
10. No blackhole nodes exists
11. Status = No_Change
12. Confidence (all the neighboring nodes) = No_Change
13. Else
14. Blackhole node(s) exist
15. Status (RREP Route) = Threat
15. Confidence (nodes that sent RREP) = X
16. Test threat Route (Algorithm 2)
17. End if
```  
**Algorithm 1**Test Neighbor Integrity  
``` Begin

\(k\) is the total number of successful transactions till the current data transmission instant. Procedure 1:
1. \(RTT_{i}\) (instant RTT of the route we are testing)
2. \(RTT_{a}=\sum_{b=1}^{k}RTT_{ib}/k\)
4. If (\(RTT_{i}\ \leq\ RTT_{a}\))
5. Then
6. Examine RREP for \(r\) = 1, 2,..., \(n\)
7. Switch (r)
8. case (1) if RREP returns from neighboring node
9. This is a blackhole node,
10. Confidence (node) = \(-1\)
11. case (2) if RREP returns from not neighboring node(s)
12. Neighboring node might be victim of a blackhole node,
13. Confidence (nodes in the current path) = 0
14. Default \(r\geq 3\)
15. Suspected node is far from the testing node, and its confidence = \(-1\)
16. Confidence (remaining nodes in the path) = No_Change
17. End switch case
18. Else
19. Suspected node is far from the testing node, and its confidence = \(-1\)
20. Confidence (remaining nodes in the path) = No_Change,
21. Congestion at the nodes of the current path likely exists. 22. End If

## 4 Results and Evaluation

Here, we present our experiment results for the EBR mechanism.