## 4 \(\Delta T\)_Vector_ TTHCA Extension
### Identifying Tampered \(\Delta T_{i}\) Measurement  
The \(\Delta T\)_Vector_ extension is founded on the premise a malicious node can only modify its own \(\Delta T_{i}\) which is a pragmatic assumption since in real MANET environments routing packets must be secured from modification attacks for the routing process to be trustworthy. A wormhole link typically consists of two malicious nodes, so a \(\Delta T\)_Vector_ received through any wormhole infected route will include  
Figure 2: TTHCA route discovery with the \(\Delta\)T Vector extension (RTT= round trip time, RREQ= route request, RREP = route reply, \(\Delta\)T = packet processing time, \(PTT\) = packet traversal time, \(HC\) = hop count, \(R\) = radio range, \(S\) = propagation speed).  
either one or two tampered \(\Delta T_{i}\) values. It is possible to distinguish tampered \(\Delta T_{i}\) values from healthy \(\Delta T_{i}\) measurements by applying an appropriate outlier detection technique, such as the Grubb's test [19], [PERSON]'s Q-test [20] or the Box plot method [21], though several conditions can affect the performance of the chosen outlier method. In this context, two distinct MANET scenarios are defined:  
**CASE 1**: A node has been a part of the network for some time and generated a track record of \(\Delta T_{i}\) values gained from \(\Delta T\)_Vectors_ from earlier route discovery procedures. In this scenario, the availability of a large number of \(\Delta T_{i}\) samples can be reasonably assumed.
**CASE 2**: A node has joined the MANET for the first time and so the only available \(\Delta T_{i}\) values are those existing in the \(\Delta T\)_Vector_.  
Due to the inherently dynamic nature of a MANET, several different types of \(\Delta T_{i}\) distributions can arise which will impact on the performance of the outlier detection scheme. The ideal is when all MANET nodes have identical hardware and the network traffic loads are low. Such a condition would result in negligible \(\Delta T_{i}\) variations and time tampering is then straightforward to detect. This is not however, a realistic MANET situation because there are a myriad of factors which can cause \(\Delta T_{i}\) variations. For example, mixed node processing capacities and packet service times, allied with high network traffic loads in certain parts of the MANET can lead to queuing delays at specific nodes.  
In a heterogeneous MANET consisting of uniformly distributed nodes where the network traffic load is low and there are no queuing delays, the \(\Delta T_{i}\) values can be assumed to follow a linear distribution. In MANETs with high network traffic load variations however, some of the \(\Delta T_{i}\) values will include queuing delays which will be much greater than the actual packet service times [22]. The \(\Delta T_{i}\) values will then tend to follow a nonlinear distribution where a small portion of the \(\Delta T_{i}\) values are significantly higher than the average. For such a distribution, it is very challenging to discriminate a tampered from a normal \(\Delta T_{i}\) value as a modified \(\Delta T_{i}\) can potentially be lower than a healthy \(\Delta T_{i}\) if the tampered measurement contains no queuing delay, while the healthy \(\Delta T_{i}\) does.  
The outlier detection method selected for time tampering detection purposes must therefore be applicable to both large and small \(\Delta T_{i}\) datasets _i.e._, CASE 1 and CASE 2 respectively, as well as for both linearly and non-linearly distributed measurements.