## 2 Packet-Based Traversal Time Hop Count Analysis (TTHCA)
### Limitations and Benefits of Current RTT and HC-Based Wormhole Detection Algorithms  
RTT-based techniques such as WAP and DelPHI, are based on the supposition that the RTT of a route is closely related to its distance and HC, which is true provided all network nodes exhibit a near constant packet processing delay. WAP uses a Wormhole Prevention Timer (WPT) threshold for the maximum permitted RTT per HC; with the underlying assumption that the processing times of routing packets on intermediate nodes are negligibly small. In contrast, DelPHI assumes that a wormhole route has a significantly higher RTT than a normal route. In practical MANET environments however, packet processing delays are high relative to the traversal times and exhibit a high variance. There exists the probability that a healthy route with a short distance and low HC will produce a high RTT due to a momentary high packet processing delay at one of the intermediate nodes caused for instance, by traffic congestion. Conversely, a wormhole infected route with a long distance may provide a low RTT due to low packet processing delays on all intermediate nodes. For these reasons, wormhole detection performance is compromised and FP occurrences increased when RTT-based solutions are used in realistic MANET environments, as will be evidenced in Section 3.  
The HC analysis scheme in MHA is predicated on identifying routes with a significantly lower HC than other routes, and then classifying these routes as wormholes. This is a successful detection strategy provided that the wormhole route always has the lowest HC. In MANET scenarios where this assumption is not valid, the corresponding detection performance is compromised. The example in Figure 1 illustrates the problem, where S and D are the source and destination nodes respectively, while E and F are two malicious nodes forming a PM O-B wormhole.  
The shortest route in this example is two hops (S-A-D), while the alternative route is six hops (B-C-G-E-F-D), so MHA prevents a packet being routed via the shorter route because it has a significantly lower HC. As a consequence, data packets will be routed through the wormhole.  
The graylist attribute used in MHA for route discovery is an effective way of finding multiple unique routes between a source and a destination node since it ensures that PM wormhole nodes for instance, cannot appear in more than one route per discovery phase. This means two different routes are sufficient to be able to detect one PM wormhole route based on HC analysis. The number of requested routes per route discovery in MHA is fixed and known as the Route Reply limit (_RREP\({}_{lim}\)_).  
Figure 1: MANET example where MHA fails to detect a PM O-B wormhole.  
HM wormhole nodes cannot be added to the graylist since they do not appear in routing tables, so there is a risk that all requested routes traverse a wormhole link. This risk can be reduced by increasing \(\mathit{RREP}_{\mathit{lim}}\), though this increases the route discovery delay overhead which is undesirable. In the results analysis (Section 3), it will be shown that when MHA is applied to realistic MANET environments with randomly distributed nodes, the wormhole detection rate is compromised, with a commensurate increase in the occurrence of FP wormholes. It also reveals that the existence of HM wormholes further degrades the detection performance of MHA.  
Despite these drawbacks MHA, WAP and DelPHI exhibit qualities that can be exploited in a unified wormhole attack detection framework. They offer for example, a low overhead solution in terms of hardware, computation and throughput. These features provided the motivation to investigate how they could be combined and extended to improve detection rates, FP occurrence performance and crucially, broaden the detection coverage to all wormhole types.