# Forensic Analysis of Blackhole Attack in Wireless Sensor Networks/Internet of Things
## 2 Literature Review  
The BH is an active attack among the tremendously harmful possible attacks in WSN and IoT. An antagonist entity claims the shortest path to the destination via a route reply (RREP) packet to the source node, even if it does not have any route to the destination. The sender transmits all the data packets to this entity, and consequently, it drops the data packets instead of forwarding them to the destination [14], distressing the collective throughput and energy of the nodes. The malicious entity is called a \"Blackhole Node\" due to the packet-absorbing behavior. The packet-dropping behavior can be absolute or selective and can also produce a gateway to other catastrophic attacks. In absolute packet dropping, the BH node drops all of the packets, all the time, and for all the nodes. In this case, the network nodes may sense abnormality, and alternative routes may be chosen. However, the selective BH attack is very difficult to detect because the BH node may drop the packets at a selective time period or for specific nodes. Moreover, there are two categories of BH attacks, depending on the number of malicious nodes and single and cooperative BH attacks. If a single node is involved in dropping packets, then it is called a single BH attack, and if multiple nodes are involved, then it is called a cooperative BH attack [6; 15]. The insecurity of WSN and IoT can be classified into the insecurity of nodes, routers, and data traffic. The resource-constrained environment, computational capacity, and limited transmission range make it problematic to operate an entire network steadily at a time [6; 9; 16].The attackers usually benefit from the hop-to-hop dependency of WSN and inoculate malicious nodes in the routes [17]. Now, the research efforts devoted to mitigating the BH attacks, the vulnerabilities of WSN and IoT, DF complications, and forensics investigations studies carried out in this domain will be discussed. An approach [15] functioning by distributing the network into several little zones of the same size, and allocating a unique ID to each zone is suggested to detect the BH attack. The nodes know their particular locations and affiliation by a localization algorithm and broadcast their energy level in the network and to the base station (BS). The highest-energy node is chosen as the cluster head (CH). Some mobile agents support the system by monitoring the network, and if they sense any abnormality, then they mark that specific node as a BH node and trigger a message to the CH and BS. In [18] a control packet (CP), comprehensive extended data routing information (EDRI) is proposed to mitigate the BH attack. The EDRI table includes the parameters of nodes. The information such as neighbor ID, FROM (source), TO (destination), and BH node is included. Binary digits specify the honesty of the node. The CP has the IDs of the source node, neighbors, and a persistent random number (RN) security value. The CP cannot be transmitted by an adverse node, so it works for detecting a single BH attack. The methodology for community attacks is powered by the next hop number (NHN), CP, and a random number generator (RNG). It operates in three phases: discovery of the routes, scrutiny of the route, and elimination of the cooperative BH nodes. A Cluster Reputation-based Cooperative Malicious Node Detection and Removal (CRCMD&R) scheme extending the AODV protocol with additional features [19] discovers an adverse node in the route setup phase. Therefore, the information will not be transmitted through the neighbor's nodes and malicious routes. The CH reserves three tables named legitimacy value (LV) table, neighbor's table, and reputation value (RV) table to compute the trust values of the routes. In another anticipated system [20], a malicious node is inserted into the network to manipulate the determined traffic by promoting the shortest path to destinations. An intrusion detection system (IDS) is mounted on each node to detect the packet drop behavior.