# Trust and Mobility-Based Protocol for Secure Routing in Internet of Things
## 4 SMTrust Design and Analysis
### Attacks Detection
#### 4.5.2 Blackhole Attack Detection  
Blackhole attack is a kind of packet dropping attacks. SMTrust accomplishes this by overhearing and monitoring the neighbouring nodes as to whether the packets are being forwarded successfully or dropped by the trustee node. A Blackhole attack is detected by the trust index of the preferred parent node. Moreover, an additional check is the success rate in order to know that the packets are dropped by the node and to confirm a packet dropping attack. Algorithm 2 illustrates the detection of Blackhole attack in SMTrust.  
```
Input: Set of potential parents \([\textbf{{p}}_{\textbf{1}},\textbf{{p}}_{\textbf{2}},\textbf{{p}}_{\textbf{3}},\ \ldots,\textbf{{p}}_{\textbf{n}}]\) for node \(\textbf{N}_{i}\), preferred parent, NeighborList Output: preferred parent BEGIN for all \(\textbf{{p}}=\textbf{1}\) to \(\textbf{n}\) belongs to the potential parents list do: //check the validity of rank against NeighborList. if\((PotentialParents(p).DIO\_seq=NeighborList.DIO\_seq) if\((PotentialParents(p).Rank=NeighborList.Rank)\) return\(preferedParent\) //preferedParent selected is good else //preferedParent is not trustworthy. Rank attack detection. Add\(PotentialParents(p)in\)\(suspiciousList[\ ]\) //isolation \(preferedParent=NULL\) Go to parent selection procedure end if return\(preferedParent\)
```  
**Algorithm 1**Rank Attack Detection.  
```
Input: Set of potential parents \([\textbf{{p}}_{\textbf{1}},\textbf{{p}}_{\textbf{2}},\textbf{{p}}_{\textbf{3}}, \ \ldots,\textbf{{p}}_{\textbf{n}}]\) for node \(\textbf{N}_{i}\), preferred parent, NeighborList Output: preferred parent BEGIN for all \(\textbf{{p}}=\textbf{1}\) to \(\textbf{n}\) belongs to the potential parents list do: //check the validity of rank against NeighborList. if\((PotentialParents(p).T_{SR}\) \(\geq SuccessThreshold)\&\&(PotentialParents(p).TrustIndex(N_{i},p)\) \(\geq TrustThreshold)\) return\(preferedParent\) //preferedParent selected is good else //preferedParent is not trustworthy. Blackhole attack detection. Add\(PotentialParents(p)in\)\(suspiciousList[\ ]\) //isolation \(preferedParent=NULL\) Go to parent selection procedure end if return\(preferedParent\)
```  
**Algorithm 2**Blackhole Attack Detection.  
The proposed attacks detection algorithms slightly increase the complexity of the default objective function in RPL, because of the additional loop and check. In the Rank attack detection algorithm, the loop will be executed for all the potential \(n\) parents to check the validity of ran. So the complexity will be \(O(n)\) for the worst case, and if there is only one parent, the complexity will be \(O(1)\), which is the best case. Similarly, in the Blackhole attack detection algorithm the loop will execute for all the parents from \(p=1\) to \(n\), to check the success threshold and the trust index of the potential parents. The complexity of the Blackhole attack detection algorithm will also be \(O(1)\) in the best case if there is only one potential parent, and \(O(n)\) in the worst case of \(n\) potential parents.  
The attack detection algorithms will check the validity of the potential parents unless it finds a trustworthy preferred parent. Once a preferred parent is selected, it will be checked for malicious behaviour through Rank and Blackhole attacks detection. If the node fulfils the specified conditions, it will be deduced that the preferred parent selected is good.  
Otherwise, the potential parent node will be added to the suspicious list, and the parent selection procedure will be called for the selection of another preferred parent from the potential parents list.