## 1 Introduction
### Research Background  
Wormhole detection mechanisms can broadly be divided in two categories: neighbour validation and end-to-end detection. Examples of the former include packet leashes [5] and [6] which involve appending information to a packet relating to either distance or time, to limit that packet's admissible transmission distance. This is an effective preventative strategy against HM wormhole attacks because outlying legitimate nodes appear as neighbours and a packet can be dropped if the transmission distance/time of a received packet is unrealistically long. Such countermeasures however, are unable to detect PM wormholes because malicious nodes appear in the routes and are considered as valid neighbours. In contrast, end-to-end detection mechanisms typically measure and analyse network node and route features like the frequency of node appearances in routes, the geographical positions of nodes, the Round Trip Time (RTT) performance of data packets, and Hop Counts (HC) across multiple routes. Many proposals adopt cryptographic techniques to protect the routing packets such as in the AODV and DSR extensions, SAODV and ARIDANE. Such packet security however, can only be effective against the threat of PM wormholes, and not HM wormholes because these do not need to process any routing packets. Moreover, cryptography is only applicable within closed MANET environments comprising trusted nodes, such as a company intranet where network access can be restricted to employees. In an open dynamic MANET with nodes continuously joining and leaving the network, a reliable check for trustworthiness whenever a node joins the network is not feasible. For instance, in an underground transport system MANET where the network structure is dynamic and the number of users is high, it would be impossible to distinguish a malicious user from a legitimate user. Strategies that measure and analyse the frequency of node appearances in routes [9-11] have been an effective countermeasure for both PM I-B and O-B wormhole nodes because they appear more often in routes. If the MANET is highly dynamic however, it can be difficult to maintain the frequency data unless either a centralized node is assigned the task of storing the data or it is continually shared with other MANET nodes. The ensuing solution can thus impose a high load upon the network bandwidth. Furthermore, HM wormholes cannot be detected using this approach as they are invisible and do not appear in any route. Geographical location based solutions including First End-to-End Protocol to secure _ad hoc_ networks with Variable Ranges (FEEPVR) [12] and Simple and Efficient End-to-End Protocol (SEEEP) [13], utilise information concerning node positions to achieve detection of both I-B and O-B channel wormholes launched in either HM or PM. The main drawback of these techniques is that they require every node to have a positioning device, _i.e._, a Global Positioning System (GPS) facility which pragmatically precludes adoption in MANET applications, where nodes tend to be small low-cost computing devices like sensors. In contrast, RTT-based solutions including Delay Per Hop Indication (DelPHI) [14], Wormhole Attack Prevention (WAP) [15], and Transmission Time-based Mechanism (TTM) [16] do not require dedicated positioning hardware and are based on the premise that a route with a small HC will concomitantly have a small RTT measure. If the RTT per HC of a specific route is higher than a pre-calculated threshold, the route is considered to be a wormhole route. RTT-based solutions are effective in detecting both HM and PM I-B wormhole types, provided that variations in packet processing delay times on the nodes are small. In practical MANET scenarios however, this assumption will not always hold because of the unpredictability of network traffic loads, which significantly compromises the reliability of RTT solutions.