Detection of Black Hole Attack Using Honeypot Agent-Based Scheme with Deep Learning Technique on MANET

A decentralized-based substructure is mentioned as MANET. IoT strategies form in a MANET, there are devices close by. The MANET is made up of a large number of endpoints, all of which employ a peer-to-peer technique to exchange data. There is no need for wireless devices or wireless networks while using a specifically allocated device. The self-built network is useful for MANET creation, but it is much more appealing when linked to the Internet. Because the Internet provides a wide range of administration, it assumes a significant role in many people's daily lives. For the MANET and the associated outer spaces, access points are being employed as a bridge.

Talukdar et al. [13] used the two types of techniques to detect the blackhole attacks, where the first type includes IDS and the second type includes digital signature with the prevention concept. Three types of attacks such as normal, black hole AODV and detected black hole AODV are implemented by this technique. The NS2 simulator is used for validation analysis and the parameters such as PDR, delay, and overhead are used for the simulation process. However, the performance of the network is highly degraded by blackhole attacks.

Elmahdi et al. [14] provided a secure and reliable data transmission under blackhole attacks and developed a modified multipath distance vector (MMDV) protocol. To reach the destination, messages are divided into multiple paths and a homomorphic encryption scheme is used to secure the message transmission. Network throughput and PDR are used for the simulation analysis and the results proved that the MMDV achieved better performance.

Naveena et al. [15] suggested a trust-based routing scheme for secure routing. Two stages are used in this scheme, where the first type is data retrieval and the second stage is data transfer mechanism. In a routing environment, identification and preservation of each node data transfer are carried out by the first stage, where the prediction of the safe path for transmission of the data packet to the target node is processed by the second stage. However, the energy consumption of nodes is high in this approach.

Kowsigan et al. [16] proposed alleviating the effects of a black hole through the identification and protection (ABIP) technique. According to the non-static threshold value of the succession number of receivers, the ABIP technique will be processed. The high receiver succession number is produced by the nodes that produce wrong information. The simulation results proved that the ABIP technique minimized the black hole attack and increased the performance in terms of PDR.

Verma et al. [17] present an effective and safe approach for MANET node confirmation. It's a validation mechanism that's based on the exchange of testaments among the nodes. To maintain the trustworthiness of authentications, their system also uses computerized signatures with debris functions. The re-enactment demonstrated that this protocol performed better in terms of quantity, start-to-finish postponement, and bundle dropping when hostile nodes in the MANET were nearby. The overhead of calculation and correspondence was also reduced, making it appropriate for MANETs.

According to Jain et al. [18], MANETs are a collection of wirelessly connected scheme gadgets. To exchange data, it's used this way. As a result, they researched a procedure based on the trust method to verify MANETs besides attacks. Through the processing of the node's trust estimation, their proposed methodology separates healthy nodes from malignant nodes. The approach makes use of a source node's old sham packets and sends them to the destination node. The goal was to provide a methodology that could validate and enhance the way the Reactive Routing Protocol family was presented.

Mapenduka [19] illustrates techniques that should be effective across the entire protocol stack because assaults are directed at levels that are explicitly identified. While listening to their presentation, they discuss current MANET attack detection tactics. The authors also suggest a half-and-half cross-layer strategy suitable for classifying several known and novel attacks that can be researched to enhance current plans in developing successful security solutions for MANET. Using a fluffy standard-based methodology, Gargan et al. [20] presented a MANET Trust-Based Secure Routing Protocol for planning and examination (TBSRPM). Because nodes have such strong behavior, even a short course does not guarantee a safe path. As a result, security isn't given any care because dynamic MANETs can easily break the rules. Consequently, it's critical to charting a course that you believe in. Their computation is an improvement to the AODV, developed for ensuring a safe path from the source to the destination. They're using it. In the end, the TBSRP improved MANETs.

Individuals who work with Yan and Wang [21] will learn how to overcome their fears of vulnerability and danger by participating in trusted social activities. For controlling PSN statistics access in a heterogeneous approach using property-based encryption, they use two mechanisms of trust levels assessed either by a trusted server or by separate PSN nodes, or both. They formally establish the safety of our strategy and dismantle its correspondence and unpredictability in calculations. According to a thorough investigation and execution valuation based on actual usage, their proposed strategy was both extremely effective and indubitably safe.

Using three indisputable group dropping attacks as a stimulus, Jhaveri et al. [22] examined Trusted Routing Scheme (TRS)-based Pattern Discovery (PD) by modifying the characteristics of several parameters, specifically the framework conditions. To oppose the adversaries that search for specific attack plans near a variety of foes, their work also collects the attack structure disclosure framework, trust model, and routing segment seized by TRS-PD Analyses conducted using the arrange test framework 2 display that the parameter selections made are correct under the given conditions.

Cai et al. [23] suggested an evolving self-cooperative trust (ESCT) plot that mimics the human dynamic approach and relies on trust-level data to anticipate certain coordination disruptive impact ambushes. Adaptable focuses will trade and evaluate trust data obtained from all alone enthusiastic judgment as part of their game plan. It takes time for each node in the network to change its perspective to allow only legitimate parts to pass through the firewall. It's the most enticing feature of ESCT that they can't deal with the scheme regardless of whether the internal attackers know exactly how the security instrument functions. They look at how the ESCT plot displays under various types of routing interruption attacks. To the best of their knowledge, these results show that ESCT plans improve organizational adaptability while also ensuring that routing disruption aggressors cannot disrupt them in MANETs.

Nodes communicate, hand-off, and get traffic from neighbors as the scheme topology changes, according to Jim and Gregory [24]. For MANET, security is critical, and trust calculation is used to boost cooperation among nodes. Maintaining a trusted state for all nodes in a MANET network requires performing trust calculations regularly. If the trust computation is vulnerable to attack, then the trust values recorded may be suspect. It was proposed that an Artificial Immune System (AIS) be used to cope with register trust and to provide a powerful reputation instrument.

For Internet of Things coordination to support dependability and security while carrying finding methods in out of reach frameworks, Dhanya [25] proposes an assessment on TBRP. When dealing with node registration trust, there are several approaches to consider, including the fluffy trust strategy, the trust organization strategy, the crossover strategy, and others. In a dynamic and enigmatic MANET environment, they quickly implement these approaches for establishing trust in the sharing center points. Using the trust model established by Riaz et al. [26], the instant connection trust is determined using the Bayesian measurable technique and proposals from the neighbors. Essential trust can be determined using measurements like the received sign quality, the time it takes to cooperate, and how close nodes are to one another. Traditional Dynamic Source Routing (DSR) serves as the foundation for this trust-based strategy. Observations from the simulations show that the proposed approach improves routing adequacy even with malicious friends in the MANETs.

The Honeypot agent-based approach with deep learning technique will be utilized in this work to solve the problem of detecting black hole attacks in MANETs. Before discussing detection strategies, we first provide a system design.

4.1 Detection system architecture

Figure 2 depicts the proposed honeypot detection scheme's system architecture, which includes the components listed below:

2.png

Figure 2. System architecture

Route Module: Dummy Packet Generator and Constant Bit Rate (CBR) Unit make up the Route module. As soon as the 'testee' enters the honeypot, an RREQ is generated to a known destination. A RREP packet is generated by the 'testee' when it receives an RREQ. Using the received reply packet, the Route Reply Analyzer module checks to see if the received RREP is genuine or a forgery. The RREP packet is analyzed by this module, which records the sequence sum and the hop count. The Dummy Packet Generator then generates dummy packets for the test subject to receive. The 'testee' under examination is either malevolent or trustworthy, therefore these phony packets are employed to test that. A 'testee' receives this communication and forwards it to a predetermined location. The Constant Bit Rate Unit used by the Dummy Packet Generator generates UDP packets at a fixed bit rate. It has been tweaked, however, so that the payload is overflowing with junk data.

Feedback Module: For the blackhole attack to be detected, it needs the feedback module to do its job well. A query packet is sent to the recognized destination to see if it has established any traffic from the testee since the alternate path was discovered. Any time the packet is received, it unicasts a trace reply back to the honeypot, indicating that it was received by the intended recipient. The feedback module determines whether or not the 'testee' is a trustworthy attacker based on his or her response.

Alert Module: If the feedback module finds evidence of malicious activity, it passes it along to the alarm module. Positive output is viewed as a sign of health, whereas negative output indicates an attack is underway. The alarm module sends out a message when it detects an attack so that the intruders know about it and can stop it. To prevent traffic from being forwarded through the malicious blackhole, the alert module exposes the malicious black hole’s identity to all network nodes.

Interactive log: This provides insight into the honeypot's tactics for luring the malevolent MR. Additionally, it collects information on the route responses that the attacker is using to entice other nodes in the network. The Interactive log keeps track of everything that happened throughout the route exploration phase, including any alerts.

4.2 Honeypot agents in detection

Honeypots are used as software detection agents in our concept for detecting blackhole attacks. To detect a black hole attack, honeypots are placed on nodes to entice malicious attackers. Honeypots are also known as network cops because of their role in detecting attacks. The entire process is presented as a flow chart in Figure 3.

The suggested plan is broken down into the following phases, as follows:

Step 1: The ‘testee’ receives an RREQ packet from the Honeypot agent. The honeypot's node is the source address, while the endpoint address is a randomly selected, well-known location. This Honeypot is pre-configured to issue an exclusive RREQ to regulate the legitimacy of nodes in its immediate vicinity, so we believe it already knows the way there.

Step 2: The 'testee' sends an RREP packet to the LSTM technique and is used to verify whether a node is valid or spurious. This information is sent back to the honeypot. LSTM has been designed to resolve the problems and has been performed superiorly. Three gates and one cell memory state exist in the LSTM design. Figure 4 appearances the LSTM standard architecture.

$X=\left[\begin{array}{c}h_{t-1} \\ x_{t}\end{array}\right]$           (1)

$f_{t}=\sigma\left(W_{f} \cdot X\right)+b_{f}$            (2)

$i_{t}=\sigma\left(W_{i} \cdot X\right)+b_{i}$              (3)

$o_{t}=\left(W_{o} \cdot X\right)+b_{o}$                 (4)

$c_{t}=f_{t} \odot c_{t-1}+i_{t} \odot \tanh \left(W_{c} \cdot X+b_{c}\right)$                           (5)

$h_{t}=o_{t} \odot \tanh \left(c_{t}\right)$               (6)

where, $W_{i}, W_{f}, W_{o} \in \mathbb{R}^{\times 2 \mathrm{~d}}$ are the weighted matrices of RREP packet and $b_{i}, b_{f}, b_{o} \in \mathbb{R}^{\mathrm{d}}$ are biases of LSTM, which is the short-term memory solution. They have inbuilt systems, which can control the flow of information, called gates. These gates can find out which data to keep or throw away in one sequence. This enables it over the extended chain of sequences to transmit relevant information to make forecasts of tasks. The main notion of LSTM is the cell condition and its diverse gates. The cell state serves as a transportation route throughout the flow of information. During the processing of the sequence, the cell state can contain useful data of RREP packets. Even early knowledge can thus lead to later temporal stages, which reduce the impact of short-term memory. The information will be added to or withdrawn by gates as the cell state moves on its trip. The gates can find out which knowledge is important in training to remember or forget. As a result, our honeypot detection approach using LSTM allows us to tell whether RREP packets are valid or not in later steps.

3.png

Figure 3. Steps involved in the process

4.png

Figure 4. The standard LSTM architecture

Step 3: The honeypot then creates a data packet for the 'testee' and sends it to it. There is nothing special about the testee packet; it functions just like any other piece of ordinary data. There is a random data stream in the payload, making it impossible for the test subject to determine that the data is coming from the honeypot.

Step 4: When the honeypot receives the test packet, it sends a "Query packet" to the recipient, inquiring about it. The inquiry packet is then sent via this well-established path. The query packets have several different fields that include:

• Packet Sequence Number: This is the sequence numeral assigned to a particular packet once it has been produced.

• IP address of the honeypot's node. This is the IP address from which the honeypot receives its traffic.

• In the honeypot detection strategy, it's the IP address of the known location. c.) Source IP address.

• In the case of a testee, this is the source IP address.

Step 5: This trace inquiry is processed by the destination by looking at its Most Newly Received Traffic Cache, which includes the source ids, the timestamp of when it was received, and the number of packets established from this source.

Step 6: It creates a "Query reply packet (QRP)," whose destination address is equivalent to the basic address of the honeypot from which the query packet came if it discovers that the testee id has been stored in its traffic cache. The count of received packets and the date of the last received packet is also included in the query reply packet's information field. As a result, the honeypot receives the QRP through the same unicast path as the trace packet. The fields in the QRP are identical to those in the QRP and are described as follows:

• IP Sequence Number: This is the IP packet's sequence number as it arrives at the destination computer.

• IP Address of the Sender: This is the address of the node from which the packet is being transmitted.

• IP Address of the Honeypot Node: Address of the honeypot server.

• It keeps track of the number of packets the test subject sends and receives.

• A Time Stamp is a piece of information that tells you when it received the last packet.

Step 7: Query reply packets are handed out to feedback modules by the honeypot agent. The validity of a test depends on the information in the field. The 'testee' is a "Good Node" if the packet is received at the endpoint. The 'testee' is a malicious attacker if the field is empty. The other path is used by the feedback module to retrieve the data.

Step 8: A malicious blackhole attacker is being considered as a "testee" by the honeypot's alert module. As a result, other nodes in the network do not relay the message through the malicious blackhole node in question.

Step 9: To remove a rogue node, this data is also sent to the Internet Gateway (IGW), which in turn sends it to the ISP. To put it another way, honeypots serve as network enforcers, checking to see if a node's routing module's integrity is intact using the LSTM model. You can program the mobile honeypot to follow a predetermined path through the network. When starting from the IGW node, Honeypot can perform a depth-first walk to the leaf nodes using random walks in the network.