# Forensic Analysis of Blackhole Attack in Wireless Sensor Networks/Internet of Things
## 4 Simulation and Results
### Analysis of Simulation Outcomes
#### 4.1.8 Discussion and Verification of Results  
A mobile environment for 50 sensor nodes was simulated, and the behavior of a BH attack is defined in the model of the NS3 AODV routing class. The malicious behavior was not assigned to any node by default. Some nodes randomly acquired the malicious behavior because the approach aimed to forensically analyze the behavior of the network and the traffic in the presence of an attack. A significant portion of the network nodes were observed to behave maliciously. The different types of traces from the simulated environment and live statistics of the simulation are analyzed and discussed in the PyViz. Some exciting challenges for this domain are discovered. For example, forensics investigations for these networks are very challenging because sound artifacts are difficult to obtain due to broadcast, resource-constrained, and fragile environments. Mobility induces data corruption. The network forensics for WSN and IoT is hideous because the DE that can be found from the data communication traces is insubstantial and can disappear quickly. The resource-constrained nature of the wireless devices may also vary the stability of traces. Traditional DF mechanisms may be applied at device-level investigations but not for network traffic forensic, especially in the presence of reactive routing protocols. The reactive forensic is challenging for this purpose because solid DE is difficult to obtain from the network traffic artifacts. At the routing protocol level, we have also discovered some interesting facts related to DF investigations. Reactive routing protocols are not compatible or suitable for DF investigations due to their on-demand behavior, i.e., AODV. Routes are established on demand and demolished after their use, so we cannot have any useful route information from the routing tables. The source nodes transmit HELLO packets for route preservation in AODV. The RERR message presents the unreachable destination. Message-receiving nodes inactivate the existing route toward that destination. In the case of intense and cooperative behavior of the attack, the constant growth and load of protocol control packets can jam the cumulative performance of the network, affecting the energy. As the network size grows in terms of number of nodes, the chances of collecting useful DE declines. As the BH attack goes into a worsening state, it also behaves like a smurf attack, which is also a type of DoS. We have noticed this in the PCAP analysis in Figure 11, where the data packet transmissions has fallen to 0, but the AODV control packets were not. For the sake of argument, let us assume that if we develop a mechanism for all network nodes to submit each routing table or routing information to a third party node or a BS, then the on-demand protocols will then also produce a large amount of control traffic to find, sustain, and maintain routes, especially in mobile networks where the position of the nodes is continuously varying. Therefore, the networks using on-demand or reactive routing protocol are not suitable to produce forensically useful data, especially in the case of adverse attacks. The case may become more complicated with the increasing time-span of the attack. On the other side, the AODV self-healing quality is appreciable, as we have observed from the graphs in the Figures 11 and 17. Figure 18: PyViz Visualization. There are also some essential aspects of the research such as the physical topology, strategic positioning, and cooperation of the network nodes. From the past literature, especially in the mitigating schemes, the damage to the network by the attack has usually been shown to be directly proportional to the number of malicious nodes in the network, but this is not always true. We have found that a lower number of malicious nodes occupying important locations can cause more damage than a high number of malicious nodes that are randomly settled. This can be observed in Tables 4-6.