## 3 Proposed Methodology  
In MANETs, the nodes have limited energy to establish communicational links to broadcast the data packets. Malicious nodes send beacon messages periodically in MANETs, creating a huge amount of unnecessary traffic to increase the routing overhead. Malicious nodes should be prevented in order to reduce the extra routing overhead. To cope with this problem, the proposed technique combines two different algorithms (i.e., CDS and IDS) to detect the malicious nodes (i.e., black hole and gray hole) and to reduce the routing overhead in MANETs. A dominating set of nodes is a subset of the network. All of the nodes are not necessarily connected within that subset but at least one node should be a member of that subset of the network. The dominating set must be connected, called a connected dominating set (CDS). A CDS has a lower number of connected nodes to cover the maximum range of the network [41]. The intrusion detection system (IDS) set is also a concept of the subset of the network. It is used to make a set of nodes based on the nodes' sufficient energy within the entire network. The IDS set is also implemented to reduce the traffic load and the overhead routing of the network.  
For the detection and isolation of the malicious nodes from MANETs, we have proposed a technique called the dual attack detection for black and gray hole attacks (DDBG). Initially, the DDBG technique makes small groups of nodes within the network, via the help of the CDS technique. Secondly, the DDBG selects the IDS set of nodes from small groups of the CDS nodes which have enough energy and do not belong to the blacklist. In the third step, an IDS node with the highest energy in the IDS set is selected. The IDS node must be a trusted node. Next, the IDS node sends status packets periodically to detect the malicious node within the IDS set. If any node's behavior is suspected to be malicious then the IDS node broadcasts a block message to inform all nodes. All of the nodes will then stop communication with that particular malicious node.  
From the subset of the network, a small group of nodes runs the IDS to broadcast the status and monitor the energy level. In our proposed technique, we have used an intrusion detection system to design and implement in the network. The IDS node broadcast a status packet to check the status of every node in the CDS. If any node's behavior is suspected to be malicious then the IDS node  
\begin{table}
\begin{tabular}{c c c c} \hline
**S.No** & **Author \& Year** & **Technique** & **Drawbacks** \\ \hline
13 & [PERSON] (2016) [33] & Detection engine on MAC layer & Huge routing overhead due to RTS and CTS \\ \hline
14 & [PERSON] (2017) [34] & Neighbor node opinion & Cannot handle mobility and routing overhead \\ \hline
15 & [PERSON] (2016) [35] & Behavior of nodes & \\  & & (IDSAODV) & Failed in collaborative gray hole attacks \\ \hline
16 & [PERSON] (2017) [36] & Trust value & Fails to detect gray holes \\ \hline
17 & [PERSON] (2017) [37] & Integrated Bloom Filter & Complex and unclear methodology \\ \hline
18 & [PERSON] (2016) [38] & Fuzzy logic generic & \\  & & algorithm & The methodology is unclear \\ \hline
19 & [PERSON] (2015) [39] & Control sequence & \\  & & packets & \\ \hline
20 & [PERSON] (2016) [40] & Route Discovery and & \\  & & Monitoring phase & \\ \hline  & Proposed solution & Technique & Different from existing solutions \\ \hline  & & & \\  & & & \\  & & & \\  & & & \\  & Connected Dominating & & \\  & Set and Intrusion & & \\  & Detection System & & \\  & & & \\  & & & \\  & & & \\ \end{tabular}
\end{table}
Table 1: _Cont._broadcasts a block message to inform all nodes. All of the nodes will then stop communication with that particular malicious node.