## 2 Background and Related Work
### Black-Hole Solutions in DT-IoV  
Various mechanisms have been introduced to address black-hole attacks in DT-IoV. One of the first solutions proposed was ferry-based intrusion detection and mitigation (FBIDM) [10]. In FBIDM, ferry nodes assist regular nodes in identifying nodes that might be malicious. Ferry nodes circulate the networks, broadcasting messages that good nodes can decrypt. These nodes will exchange with the ferry nodes information about past node meetings and the delivery probability that is used to detect nodes that might be malicious. If a node is declared suspicious a certain number of times, it will be included in the blacklist that ferry nodes broadcast. Blacklisted nodes will be excluded from the network. The FBIDM overall performance is good but is only suited for routing protocols that use information to route, such as PRoPHET [11] or MaxProp [12], as it requires the encounter and delivery information to make decisions. Furthermore, the dependency on the ferry node is a big problem. If the ferry node fails or misbehaves itself, the network becomes compromised. A similar solution is presented with the mutual correlation detection scheme (MUTON) [13]. MUTON is similar to FBIDM but considers the transitive property when calculating the delivery probability. Despite the improvements, the problems associated with having ferry nodes persist. In [14], the authors proposed a Misbehavior Detection System (MDS) that uses encounter records (ERs), which are similar to encounter tickets. When two nodes meet, an ER is exchanged and used to assess a node's trustworthiness. The ERs are created after transmitting messages to another vehicular node. The ER includes both node identifiers, a unique sequence number from both vehicles that increases by one after each contact, and a set that identifies the transmitted messages. Every node maintains a Meeting List (ML) and a Local Black List (LBL). The ML stores data from past meetings, like identifiers, meeting time, and trust reputation (TR) from the nodes. ML information can be used to validate the ER later. The LBL stores all malicious nodes locally detected by a node. Nodes will not exchange messages with other nodes in their LBL for some time. To incentivize nodes to cooperate, after the LBL time expires, nodes will be assigned a low TR and removed from the LBL. The MDS system comprises the evaluation module and the decision module. In the evaluation module, vehicular nodes assess the trustworthiness of other vehicular nodes and the TR is updated. The decision module makes the decisions when TRs are received. The MDS achieves high misbehavior node detection rates of over 90% and almost null false-positive rates. Nevertheless, it is important to notice that as trustworthiness is calculated upon contact based on the exchanged ERs, nodes that never meet will not be able to assert each other's trustworthiness. This means that not all other nodes might detect a malicious node in the network that has few contacts. This can be a problem as, upon a new encounter, a node does not have information about the level of trust that the encountered node has. By contrast, other nodes in the network might already have determined that the node has malicious intent. Moreover, this scheme detects individual attackers well, but it cannot handle the case where attackers collude. This is because a node is considered malicious if it forwards few messages as compared with the messages it receives, which can be measured using ERs. If attackers cooperate, creating valid ERs, malicious behavior can be undetected. In [15], the authors extend MDS with cluster analysis, allowing better discrimination between good and malicious behavior, but the problems found in MDS [14] still occur. In [16], the authors propose to keep packet delivery records instead of ERs to detect the black-hole attack.