## 3 Results Analysis
### Wormhole Detection Performance and False Positive (FP) Occurrence  
Figures 4 and 5 respectively show the detection performance for a HM I-B and O-B wormhole for various wormhole lengths, with the corresponding FP occurrences also plotted.  
Figure 3: Sample environment from the NS-2 simulator showing a 4-hop PM O-B wormhole link, with the source and destination nodes in red.  
The detection results confirm that TTHCA outperformed both DelPHI and MHA for all wormhole lengths without generating any FP. HM wormholes are straightforward for TTHCA to detect because the malicious nodes do not modify the routing packets so their packet processing delays are not added to the RREP packets, causing the HM wormhole route to have a much higher PTT than a healthy route. This reflects the fact that the time to process a routing packet at an intermediate and/or wormhole node is much higher than for a packet to traverse two intermediate nodes. In the simulation, a notational packet processing delay of 4 ms was assumed, which compares with a typical PTT/HC value of \(\approx\)600 ns, so even very short HM and/or I-B wormhole links (1-2 hops) can be detected by TTHCA.  
Figure 4: HM O-B wormhole (WH) detection and FP occurrence performance.  
Figure 5: HM I-B wormhole (WH) detection and FP occurrence performance.  
The lower detection and correspondingly higher FP rates for DelPHI are due to the high variations in routing packet processing delays. MHA displays a similar trend for both metrics, though in this case it reflects the fact that since nodes are randomly distributed in the network area, there are many instances where the wormhole link does not have the shortest HC, which decreases the detection rate and increases FP occurrences. Figures 4 and 5 also reveal that both MHA and DelPHI perform better for I-B link wormholes. For DelPHI, this is because an I-B wormhole has a higher link delay than an O-B wormhole, so an infected route is easier to distinguish from a healthy route. Due to its high link delay, an I-B wormhole does not attract as much traffic as an O-B wormhole, which lowers the instances of identifying a wormhole route not having the shortest HC, which tends to favour MHA.  
The equivalent results for a PM I-B and O-B wormhole are shown in Figures 6 and 7 respectively.  
TTHCA provides superior wormhole detection for all I-B channel wormhole lengths. Despite PM wormhole nodes adding their packet processing delays to the RREP packets, the wormhole link has a high PTT because packets between the malicious nodes are tunnelled via legitimate nodes which do not add their respective packet processing delays to the RREP packets. Conversely, for an O-B wormhole link, TTHCA provided better than 90% detection accuracy for wormhole lengths of 4 or more hops. For shorter wormholes lengths however _i.e._, three hops, the detection rate fell to below 60% due to the O-B wormhole having short link delays which makes the wormhole routes particularly difficult to discern from a healthy route. Overall, the TTHCA wormhole detection performance was still superior to both MHA and DelPHi, with interestingly no FP occurrences identified for all wormhole lengths analysed. As emphasised in Section 2.3, provided accurate packet processing time measurement is maintained then FP occurrences in TTHCA are not feasible, though as will be evinced in Section 3.3, when the measurement accuracy is relaxed, the corresponding FP occurrence rate commensurately increases.  
The reason for the inferior detection performance of DelPHI for PM compared to HM wormholes is that a PM link is always two hops shorter than a HM link, so it incurs a shorter link delay. MHA in contrast, affords weaker HM detection performance because there are many instances where all routes located during the route discovery process traverse the wormhole, since as discussed in Section 1.1, HM wormhole nodes are not included in the graylist.