# EBR: Routing Protocol to Detect Blackhole Attacks in Mobile Ad Hoc Networks
## 3 Proposed Protocol
### Methodology  
This mechanism introduces a new concept of Enhanced Blackhole Resistance (EBR), which detects the blackhole node and also avoids the congested route. We introduce a slight addition to the original reactive protocols by storing the successful round trip times. Every network's node must test the performance of its surrounding nodes to detect if any act dishonestly, such as blackholes or those congested nodes. Using our TR mechanism in Figure 1, the major components of the EBR protocol are listed below:  
1. Route Request Tests: Each node in the network periodically sends a Test_RREQ message to a dummy destination node. The time to live (TTL) of the Test_RREQ message has an arbitrary value \(n\). Enlarging \(n\) would increase the number of nodes to be examined and, therefore, the source node will have a better idea of those malicious nodes in a certain path. However, this large \(n\) would create extra overhead traffic in the network that should be avoided. On the other hand, it would be more precious that each node just examine the suspicious nodes in its close neighborhood, so it is ideal to have the value of \(n<=3\);
2. Route Response: Only a maleficent node will respond to this Test_RREQ message. If the source node receives an RREP to its Test_RREQ from one of its neighbors, the source can confirm that the current route has blackhole node(s) and changes its trust level;
3. Trust Levels: We have two types of trust levels: TRUST and THREAT, as shown in Algorithm 1. When a new node joins the network, its trust level is set to TRUST as a good node and, therefore, its confidence is set to +1. When any node responds to the Test_RREQ message, then its trust level is updated to THREAT. In this case, the procedures in Algorithm 2 should be followed;
4. Confidence Levels: If the node is set as a THREAT, we have two further types of confidence levels: negative and zero. When a node thinks its neighbor is a blackhole node, then it gives that particular node \(-1\) confidence. However, if the neighbor is thought to be a victim of a blackhole node, the confidence of that node becomes zero;
5. Node Integrity Test: In case of a THREAT node, we test if a neighboring node is a malignant or a victim node. In doing this, we use our TR mechanism with different possibilities listed below. The TR mechanism includes both Algorithms 1 and 2. \(RTT_{i}\) and \(RTT_{a}\) stand for instant and average RTT, respectively. TTL can have the value \(n\). A. When \(RTT_{i}\leq RTT_{a}\) and TTL value is small: In this case, we can locate exactly the position of the blackhole node(s) using the RREP message. The blackhole node is the neighboring node if \(n=1\). If \(n=2\), the neighboring node is given the confidence of zero, as it is most likely a victim of a blackhole node next to it. Increasing \(n\) would refer to more potential nodes that act falsely in the current route;
6. When \(RTT_{i}\leq RTT_{a}\) and TTL value is large: In this case, the source node can recognize that there is a possibility of having blackhole node(s) in the path, and it is far away from the source node depending on the value of \(n\). However, the location of the blackhole node(s) cannot be determined exactly. This path should be avoided in routing the data packets. The confidence level of the neighboring node is not changed. In addition, the neighboring node is not congested and, therefore, it can be used safely in other paths;
7. When \(RTT_{i}>RTT_{a}\) and TTL value is small: This can locate the blackhole node(s) in a specific route, but most likely it is not the neighboring node(s). In other words, the attacker node(s) is farther away from the source node and responds late because one or more of the preceding nodes, in a specific path, is congested. Therefore, the source node can recognize that the neighboring node(s) are likely congested and the farther node(s) is/are blackhole node(s). However, the neighboring node can be considered in any other route, as it is congested but safe.