# Method for Detecting Abnormal Activity in a Group of Mobile Robots
## 5 Experimental Results
### Implementation and Analysis of the Impact of Attacks
#### 5.2.2 Black-Hole Attack  
The Black-Hole attack involves the intruder located between two trusted nodes and, instead of forwarding packets, they are dropped. As a rule, the nodes located at a considerable distance from the base station or the group leader can fall victim to such an attack.  
When the experimental stand was developed, one device was the server and other devices were the clients. For each of them, corresponding sockets (server, client) were written in the Python language. The client sent the string packet to the server, and the server sent it back to the client. The attacker's goal was to intercept the data sent by the server. An ARP-spoofing attack was implemented first to intercept traffic.  
Figure 8: Changes in in central processing unit (CPU) load during denial of service attack.  
Figure 7: Energy consumption during denial of service attacks.  
If the attacker needs to perform the Black-Hole attack, then the Ip table rules for the malicious node should be configured so that the attacker drops packets passing through it (Ip tables is a user-space utility program that allows a system administrator to configure the tables provided by the Linux kernel firewall).  
During the Black-Hole attack, the variance level was \(D_{Lg}=829.3\), which greatly exceeded the variance under normal network conditions. This indicated abnormal activity in the network. An efficient parameter in the detection of this attack is to estimate the growth of dropped packets (see Figure 9). It can be seen from the figure that, as the number of malicious nodes increased, the number of dropped packets increased, in comparison with the normal operation of the network.  
This suggests that a greater number of nodes were attacked and isolated from the central server.  
In addition, there was a decrease in the number of received packets, due to the fact that the attacker dropped packets sent through it by the node and the response did not come to the node. An evaluation of the ratio between packages of different types was quite indicative. During normal operation of the network, the ratio of sent and received packets was observed in equal parts, with a small amount presenting dropped packets (see Figure 10). Also, from the figure, it can be seen that, as the number of malicious nodes increased, the traffic pattern changed. The ratio of the number of sent and received packets was no longer equal. This observation can be useful in developing an attack detection system. As for the level of energy consumption, it did not change significantly. It can be said that even lower consumption was observed, since the victim's node did not spend energy receiving the package.  
Figure 10: Changing the pattern of traffic for the network under the Black-Hole attack with a change in the number of malicious nodes: (**a**) for three malicious hosts; (**b**) for nine malicious hosts; (**c**) when malicious nodes were missing.  
Figure 9: Change in the number of dropped packets for the network oversupply of dropped packets (\(ODP_{i}\)) under the Black-Hole attack compared to normal network operation.