## 5 Attacks and Countermeasures
### MANET Countermeasures
#### 5.4.1 Countermeasures for Attacks during Routing and Data Transmission Phase
Since _Watchdog_, several other IDSs were proposed. For instance, [PERSON] _et al_. [41] introduced a more specialized IDS for the _Blackhole_ attack in AODV-based MANETs. In AODV, each routing message sent by a node is marked by a unique sequence number. These sequence numbers are used to determine the freshness of the routing information. _Blackholes_ tamper with the sequence numbers to feign fresh routes and, therefore, increase the probability that routes are established based on the forged messages. To detect forged messages, [PERSON] _et al_. proposed a metric based on the difference between the received sequence number and stored sequence numbers from previously established routes with the same destination node. When the sequence numbers differ strongly, a _Blackhole_ may be involved. After detecting malicious nodes, Intrusion Response Systems (IRS) exclude malicious nodes from routes. The _Pathrater_ was proposed by [PERSON] _et al_. [40] in combination with the _Watchdog_ IDS. Each node in the neighborhood has a trust level defined by the _Pathrater_. The data transmission is monitored by the _Watchdog_ and whenever a node does not forward a packet correctly, the trust level is decreased. During routing, the average trust level per route is calculated and the route with the highest trust level is preferred. Further, the path length is considered by the _Pathrater_ to ensure that short routes (regarding the number of hops) are preferred over longer ones with an equal trust level. A prominent combination of a trust-based IRS with an IDS was proposed by [PERSON] _et al_. [42]. The _Cooperation of Nodes-Fairness in Dynamic Ad-Hoc Networks_ (CONFIDANT) system consists of the _Monitor_, the _Trust Manager_, the _Reputation System_ and the _Path Manager_. The _Monitor_ detects misbehavior of neighbor nodes while the _Reputation System_ records detected misbehavior of monitored nodes. When a threshold is exceeded, the _Trust Manager_ sends an alarm message to neighbors and the _Path Manager_ removes malicious nodes from routing tables. This way, the routing algorithm avoids malicious nodes when they are detected. Both approaches, _Watchdog_ with _Pathrater_ and _CONFIDANT_ are based on detecting malicious nodes by overhearing packets sent in the neighborhood combined with a trust-based metric. However, while a _Watchdog_ node has to detect each malicious node on its own, _CONFIDANT_ nodes cooperate and share information about malicious nodes. Furthermore, besides bypassing malicious nodes, _CONFIDANT_ also denies routing and forwarding services to detected malicious nodes to discourage malicious behavior. A more recent IDS and IRS combination was presented in [43]. Here, a distinction is made between _unknown_, _known_ and _companion_ trust levels for neighbor nodes. The trust level depends on the behavior of the node and can be improved from the initial _unknown_ level up to the high _companion_ level. The metric according to which the behavior of neighbor nodes is rated, is defined as the ratio of correctly forwarded foreign packets and originated own packets. This results in more reliable routes, as trustworthy nodes are preferred for routing.