## 1 Introduction
### Research Background
In addition, RTT methods cannot detect either HM or PM O-B wormholes because the time delay on these wormhole links is negligibly small compared to the variation in packet processing delays on intermediate nodes. An alternative HC-based technique that does not require accurate RTT measurement is Multi Hop-count Analysis (MHA) [17]. This provides an efficient solution from both a computational and hardware perspective, but is only effective under specific network conditions. MHA modifies the AODV route discovery protocol to identify several unique routes between the source and destination nodes. A route with a markedly lower HC than other routes is then assumed to include a wormhole and is avoided in network communications. MHA can detect both PM I-B and O-B wormholes, but its key assertion is that a wormhole route always exhibits a significantly lower HC than other routes. If there is no HC disparity between routes, which is often the case in real-world MANET scenarios, the detection rate falls and a correspondingly higher FP number occurs. MHA also targets a fixed number of unique paths during route discovery by using a graylist to distinguish already used nodes. This compromises HM wormhole detection because HM nodes do not appear in the graylist, so there is the inherent risk that all identified routes in fact, traverse a HM wormhole. A recurring feature of many existing wormhole detection techniques is that to some degree, they incur a price in terms of their wormhole coverage capability, computational complexity, route analysis and time measurements, hardware requirements and network outlay to achieve improved detection rates. This ultimately militates against their applicability in dynamic MANET environments, where nodes normally have limited processing and power capability. This provided the impetus to investigate a new generic detection strategy to provide enhanced performance for all wormhole variants, whilst affording a lightweight implementation from a computational and network overhead perspective. This paper presents a new packet-based Traversal Time and Hop Count Analysis (TTHCA) wormhole detection algorithm designed as an extension to the AODV routing protocol combining some of the latent benefits of RTT-based techniques with HC analysis, to afford superior detection performance and full wormhole type coverage under a variety of network conditions. Using link delay analysis to detect a wormhole infected route, TTHCA crucially excludes packet processing delays from the RTT measurements on each intermediate node, to provide a Packet Traversal Time (PTT) measure. A wormhole route is identified if the PTT in relation to the HC of a route is unrealistically high. TTHCA significantly improves both wormhole detection performance and FP occurrence, compared to RTT-based mechanisms, since variations in the propagation speed of a data packet are negligible which means the traversal time of a data packet is proportional to the distance it has travelled. In HC analysis terms, TTHCA adopts the graylist concept [17] for route discovery to prevent wormhole nodes from appearing in multiple routes, whilst embedding greater flexibility in two important aspects. Firstly, it is able to identify wormholes which do not always have the lowest HC route, and secondly, it enables HM wormholes to be effectively detected. TTHCA is not dependent on a fixed number of route samples, but instead the route discovery process is repeated until a safe route is found. TTHCA concomitantly provides low network overheads as it does not have recourse to broadcast routing messages more than once in wormhole-free networks. The rest of the paper is organised as follows: the new TTHCA algorithm is presented in Section 2, while Section 3 analyses both its wormhole detection performance and FP occurrence rate in comparison with existing techniques, together with a statistical significance test evaluation. Finally, some conclusions and future work are discussed in Section 4.