## 1 Introduction  
The mobile _ad-hoc_ network, MANET [1], is a developing wireless technology that has been discussed in many academic research projects in the last decade. An _ad-hoc_ network is inherently a self-organized network system without any infrastructure. Typically, the nodes act as both host and router at the same time, i.e., each node in the network can be independent and based on different hardware, but when communication is needed it serves as a data transmitting router after a route discovery procedure.  
So far, many routing protocols have been proposed for MANET, such as DSDV (Destination Sequence Distance Vector) [2], DSR (Dynamic Source Routing) [3] and AODV (Ad-hoc On-Demand Vector) [4] and so on. To the best of our knowledge, most previous research has focused on protocol establishment and its efficiency in MANET, but secure routing is very important, and some secure routing protocols based on DSR and AODV [5-7] have been proposed in these years.  
Recently, a novel exploit called _wormhole attack_ was introduced [8]. In a wormhole attack, attackers \"tunnel\" packets to another area of the network bypassing normal routes as shown in Figure 1. In practice, attackers can use high power antennas or a wired link, or other methods. The resulting route through the wormhole may have a better metric, i.e., a lower hop-count than normal routes. With this leverage, attackers using wormholes can easily manipulate the routing priority in MANET to perform eavesdropping, packet modification or perform a DoS (Denial of Service) attack, and so on. The entire routing system in MANET can even be brought down using the wormhole attack. Its severity and influence has been analyzed in [9].  
Most previous works protecting against wormhole attack use methodologies assuming the viewpoint of administrator, trying to identify the wormhole, and then defend against it. They can further be classified as centralized systems like MDS-VOW (_Multi-Dimensional Scaling -Visualization of Wormhole_) [10], and distributed systems such as LBK (_Local Broadcast Key_) [11]. Some require substantial calculation and some others employ special nodes in the network. These methods consume effort and bandwidth as overhead. There are other similar schemes such as TIK protocol, SAM, DelPHI and LITEWORP which will be summarized in Section 2.  
Instead of the viewpoint of administrator, we adopt the viewpoint of users and utilize routing information already available in standards like RFC3561. The concept is that we don't have to spend a lot of effort to catch thieves like the police (administators), but rather lock the doors and windows as citizens (users), which is much easier and can avoid most of the threats with minimum effort. Our method selects routes and \"avoids\" rather than \"identify\" the wormhole resulting in low cost and overhead. We propose a multipath routing protocol called _Multipath Hop-count Analysis_ (MHA, for short) to avoid wormhole attacks based on a _hop-count analysis_ scheme. It is a highly efficient  
Figure 1: The wormhole attack in MANET.  
protocol which does not require any special supporting hardware. Furthermore, MHA is designed to use split multipath routes, so the transmitted data is naturally split into separate route. An attacker on a particular route can not completely intercept (and subvert) our content.  
The rest of the paper is organized as follows: We review related works regarding wormhole attack in Section 2. In Section 3, the MHA protocol is proposed. The simulations are given in Section 4, and then comparison and discussion are provided in Section 5. Finally, we present our conclusions and future work in Section 6.