## 1 Introduction  
Mobile _Ad hoc_ Networks (MANET) are self-configuring arrangements of small portable devices interconnected by wireless links, with no fixed infrastructure like base stations and dedicated routers. They can be deployed in a diverse range of application domains including wireless sensor and vehicular networks, military communications, and as a viable solution for Internet connectivity in _fourth-generation_ (4G) networks, especially where nodes are located out of radio range, as for example in underground transport systems. Given their inherent self-configuring nature, each MANET node participates in the routing process, in addition to its other activities. A number of dedicated MANET routing protocols have been proposed, with the reactive protocols _Ad hoc_ On-Demand Distance Vector (AODV) [1] and Dynamic Source Routing (DSR) [2], being the most widely adopted. Security mechanisms have not always been an integral feature or priority in routing protocol development, with the underlying assumption being that all MANET nodes were trustworthy. Security extensions to MANET routing protocols have subsequently evolved, such as Secure AODV (SAODV) [3] and ARIDANE [4], though the corollary of not having trusted routing means MANET routers are especially vulnerable to malicious node activity leading to potentially severe disruption in network communications. Such disruption can range from deliberately ignoring the routing protocol through to tampering with routing packets. For example, to save energy a selfish node may simply not take part in the routing process leading to packet loss, while a malicious node can launch serious network attacks such as, rerouting packets from their original path to an erroneous destination node and even to stealing the identity of a node. One of the most serious MANET security threats is the wormhole attack [5] which is characteristically launched by two malicious nodes, with one capturing routing packets at a particular node location and then tunnelling them through to the other malicious node located some distance away, which in turn relays tunnelled packets to its neighbouring nodes. As a consequence, two nodes from distant parts of the network appear much closer to each other than they are in reality. Once the wormhole has been successfully established, the malicious nodes can disrupt network operation by dropping packets, or launching more pernicious attacks such as eavesdropping and packet sniffing. It has been theoretically proven that the strategic placement of a single wormhole in a uniformly-distributed MANET can either disrupt or control nearly a third of all network communications [6]. There are two classes of wormhole attack: Hidden Mode (HM) and Participation Mode (PM) [7]. HM wormhole nodes are invisible from legitimate nodes as they do not process routing packets. They simply capture, tunnel and forward packets to each other and never appear in routing tables. In contrast, PM wormhole nodes are visible during the routing process since they process routing packets as any normal node. Aside from relaying routing packets to its neighbours, a PM wormhole node tunnels routing packets to the other PM node, giving it the opportunity to deleteriously control network performance. A shortcut link between either two HM or PM wormhole nodes can be established by either an In-Band (I-B) or Out-of-Band (O-B) channel [8]. The former is defined when the wormhole nodes tunnel packets to each other through legitimate nodes in the network, while the O-B channel connects two malicious nodes via an external communication link such as a network cable or directional antenna. From a MANET perspective, wormholes are especially difficult to detect for two reasons:  
1. There is the latent variability in the environment in terms of the number of users, their locations and the applications they are running.