Black Hole Attack Detection in Wireless Sensor Networks Using Hybrid Optimization Algorithm

1. INTRODUCTION

Wireless sensor networks (WSNs) consist of a set of sensors, each of which has a transmitter, and this processor is also used to communicate, observe, and respond to events in the environment [1]. In other words, these types of networks usually have more than tens of thousands of sensors that are responsible for collecting information from nature and transmitting this information to the central device. WSN is a type of new technology that is widely used in various fields, including vehicles, health-care monitoring, accident detection, and emergency response at high speed [2]. Considering that these networks are very important, security is also of particular importance in these networks, and also, creating security in WSN can be a challenging operation. Regarding that WSN is physically interacting with the environment, network information can be at risk from security threats. In addition, the main goal of increasing security in WSN is to protect data and available resources against attacks and malicious behavior of hackers. Hence, in this case, reliable methods should be used to maximize security [3]. Not only providing a reliable and efficient model to increase security in WSN is a vital thing, but also analyzing the security method against security threats is very necessary.

Overall, trust in WSN can be separated into two groups: System reliability and user trust. In the proposed model, it is tried to propose a routing for the network and the system will receive a warning against malicious nodes [4]. Moreover, due to the nature of WSN, secure routing in WSN can be very challenging because resources are limited in these networks. In addition, due to limitations in processing capacity, data storage, and battery in sensor nodes are weak against attacks because they are placed in open environments and are attacked physically or by software. Hence, reliability in data transmission and security in these networks are not guaranteed [5]. In this paper, we have used the combined algorithm based on the whale optimization algorithm (WOA) and the sine and cosine algorithm (SCA) to detect black holes (BHs). In this model, the information of the requested messages, which include the ID of the sender, and the ID of the base station, are recorded. Then, if the requested message is received in any node, the sending node is added to the list that contains the information of the senders. If the requested message is found, it will be referred to the information in the list, and if the sender’s information was in the list of previous senders, the normal procedure will continue. However, if there is no information in the list, a value is added to the variable related to the suspiciousness of the node. Then, it begins the optimization phase using the proposed hybrid algorithm, in which the node is tracked and surrounded, and then, the node is attacked. Finally, this node is included in the list of exclusions and attackers [6].

The proposed optimization algorithm is utilized to reduce the computational overhead to increase the accuracy in detecting BH attacks in WSN. This article has tried to eliminate the weaknesses of other methods that have less accuracy or lack of detection of multiple attackers. For this reason, to increase the accuracy in detecting attacks, we have used input parameters with many details obtained from the attackers’ behavior. This approach not only increases accuracy but multi-attacker attacks are also detected. The output is evaluated with a threshold and if the output is large, the node is considered a BH node. This method is such that the input parameters of all three input variables are created and then optimized using the proposed optimizer algorithm, which also optimizes the number of attacks.

Some of the innovations made in this article are explained below.

This article is divided in such a way that in the next section, the previous works are discussed and reviewed; then, the basic concepts are explained and the proposed model is fully explained. In the next section, the proposed model and other methods will be tested and compared, and in the final section, future works and conclusions will be elaborated.

2. RELATED WORKS

WSNs are vital in today’s world. These networks also have some weaknesses that can be considered a very good target for hackers. For this reason, many models have been proposed to strengthen security in WSNs, each of which has advantages and disadvantages. In the following, various types of security-enhancing systems in WSN will be discussed. WSNs are applied in many fields, including industrial, commercial, and health. Previous studies show that the proposed models to avoid BH attacks suffer from very few false positives [7]. In Tripathi et al. [8], one of the popular clustering protocols in WSN, which is LEACH, is explained and it is explained how the network can be compromised by BH and gray hole attacks. In BH attacks, the hacker tries to take control of several sensors and then reprograms these sensors to prevent sending data packets to the main base. In Wazid et al. [9], the influence of BH attacks on the network is evaluated and then a new model for detecting BH attacks in WSN is presented. Radio communications are very vulnerable to wide and various attacks, one of which is BH attacks. In Kaushik and Sharma [10], the attacks carried out in the network layer that are related to BH attacks have been evaluated, and the security measures that lead to the reduction of the destructive effects of such attacks have been discussed.

In Pawar and Anuradha [2], a new system that depends on a deep learning model is presented to prevent and detect BH attacks in WSNs. In this model, different phases are considered, which are equal to collecting data assigning nodes identifying BH attacks, and mitigating BH attacks. This model initially considers a series of nodes to establish communication in the WSN. In this system, attacks are explored using the Bait approach, and wormhole attacks are explored using round-trip validation operations. Data collection is also done using the round-trip time and Bait. Finally, the collected data are trained to utilize the long short-term memory (LSTM) deep learning model, the attack detection operation is performed, and the attacks are eliminated from the network by applying optimal and correct path detection. In Khare et al. [11] of this model, the shortest path is discovered using the WOA algorithm. To increase security in WSN, the BH optimization algorithm is presented to detect the attack node. Furthermore, this algorithm is implemented on a vertex participation function. An improved check agent method for detecting BH attacks is presented in Saputra Andika [12], which performs the discovery operation by sending a search agent to search for the malicious node. The implementation of this model is based on the WSN created using ZigBee technology. The topology of this model can have more than one routing table.

In Khan et al. [13], iterative route configuration based on reactive routing protocol and ant colony algorithm is used to avoid BH attacks in mobile networks. In Srinivas and Manivannan [14], a new method for finding and preventing BH attacks in WSN is presented, and this model has five different stages. In the first step of this method, cluster heads are selected, and then k-routing paths are created, and after that, security against BH attacks is created. The fourth stage is related to creating security for the selective sending attack, and finally, in the last stage, the most optimal possible path is discovered. In this model, a topology is created to discover cluster heads and then create an optimal path, which ultimately leads to the discovery and avoidance of BH attacks using the baiting process. A validation process based on sent and received packets has been used to detect selective sending attacks. Elliptic curve cryptography is used to maximize security. In this model, a combined algorithm based on the dragonfly algorithm and the Deer hunting optimization algorithm is used to discover the shortest possible path based on parameters such as trust and delay, packet loss ratio, and distance. In Pawar and Jagadeesan [15], a BH detection model based on a deep learning algorithm in WSN is presented. To discover useful features, the feature selection technique has been used using a self-adaptive-multi-verse optimization meta-heuristic algorithm. In the next step, the features discovered in the previous step are used to train and test the deep belief network (DBN) algorithm. Furthermore, to increase the detection rate, the optimizer algorithm is utilized to enhance the DBN to optimize the number of hidden neurons.

In Rani et al. [16], a deep learning algorithm and ant colony optimization algorithm are used to increase security in mobile ad hoc networks. In this model, to increase the efficiency, the best nodes are selected to transmit data packets, and the results have been shown to signify the good ability of this model. BH attacks in the demand, distance vector routing protocol have been evaluated in Pullagura and Dhulipalla [17], which are discovered and avoided using a threshold mechanism of the intrusion detection system. Furthermore, maximum objectives are calculated using linear regression. Adaptive Taylor Sail fish optimizer algorithm is used to detect and prevent Sybil and BH attacks, routing is done using this optimizer algorithm, and the optimization parameters are energy, delay, and distance.

In Webber et al. [18], a new algorithm based on proportional overlapping score-based Minkowski K-means clustering was introduced for BH detection in beam sensor networks, which was the main goal of BH detection in health-care applications and it has little computational complexity. In another article [19], Bayesian theory and deep recurrent neural networks have been used to discover malicious nodes and BH in WSN by calculating the path discovery time. After removing the attacker node, a new optimal path is created using the grasshopper optimization algorithm.

According to the discussion and investigation, the presented models often have weaknesses, the main weakness of which is the long execution time. Because deep learning algorithms are often used and these models require a lot of time to train. Furthermore, in some cases, the selected optimizer algorithms have weaknesses in the exploration and exploitation phases, which, if faced with this problem, can in turn cause a decrease in the accuracy rate. In some cases, the optimization algorithms do not have good capabilities in the components of diversity and intensification, which easily causes the solutions to fall into the trap of local optimization during the optimization operation and does not happen with fast convergence. For this reason, the production solutions can have little diversity, which leads to the fact that the entire problem space is not explored. On the other hand, in the low number of iterations, the algorithm cannot discover high-quality solutions, which causes the algorithm to run in a large number of iterations, which increases the execution time. Therefore, choosing optimization algorithms to solve different problems can be a challenging task because each optimization algorithm has a series of strengths and weaknesses. Furthermore, by combining the two algorithms, the positive features of the two algorithms can be integrated and a powerful algorithm with a high search capability can be achieved. The proposed algorithm has very good capabilities in the exploration and exploitation phases because each of the SSA and WOA algorithms has strong points that the WOA algorithm works better in the exploitation phase and SSA in the exploration phase. According to the combined method, the proposed algorithm has a better execution time than other optimization algorithms, and the production solutions have a very good variety, which has led to an increase in the accuracy rate of the proposed model.

In this paper, we have developed a new type of hybrid optimization algorithm with low execution time to detect and prevent BH.

3. PROPOSED METHODOLOGY

In this subsection, the basic concepts in the proposed model will be discussed and each of the mechanisms will be fully explained in the corresponding subsections.

3.1. BH Attack

BH attacks are carried out based on malicious nodes that repeatedly send information to neighboring nodes. This node receives sensitive and important data from neighboring nodes and refrains from sending it to other nodes. These nodes are called BH nodes and the areas close to these nodes are called BH regions. In Fig. 1 these attacks are shown.

Fig. 1. Occurrence of black hole attack in wireless sensor networks.

In Fig. 1, the green areas are the sensor nodes and the red area is the BH region. If a node chooses a path to send data and there is a BH node in its path, if the data reaches the BH node, all the data received in this node will be lost and will not be transmitted. In this example, as can be seen, a large number of nodes are no longer able to send data outside the network. This type of attack takes place in the third layer of the network layer OSI model. Because these attacks take place in the network layer, all the activities in the network are disrupted, and functions such as delay, throughput, and packet loss take place in the network.

3.2. SCA

Meta-heuristic algorithms have shown very good performance in solving optimization problems and are a perfect option for solving problems in different optimization spaces. The SCA [20] is one of the powerful optimization algorithms that use cosine and sine functions to solve optimization problems. This algorithm has performed very well due to its approach to solving highly complex problems because it has a good capability in the diversity component. This algorithm mainly uses Eq. (1) to solve problems.

In Eq. (1), sin and cos represent the sine and cosine functions, and represents the location vector of the superior solution in the entire population, whereas represents the current solution. Furthermore, r depicts the random number generated between 1 and 0. This algorithm uses Eq. (2) to change the exploration and exploitation phases and create balance.

In Eq. (2), a is a variable that must be set with a constant value before starting the optimization procedure, and t signifies the current iteration number and T indicates the value of all iterations for optimization reasons.

3.3. WOA

Meta-heuristic algorithms are modeled and then implemented based on the behavior of animals or natural events, which in the WOA [21] is inspired by group life and how these creatures hunt in nature and are implemented using mathematical equations. This algorithm generally uses two mechanisms to perform optimization operations. The first case is the web bubble attack and the second case is hunting. This algorithm uses Eq. (4) to perform the first phase of its optimization.

In Eqs. (3 and 4), X represents the current solution and X_p represents the vector of the best solution, whereas C and A are both coefficient vectors that are calculated using Eqs. (5 and 6).

Where a is a coefficient vector that decreases linearly from the value of 2 to 0.

In the WOA, the spiral mathematical equation of the logarithm is used to perform the optimization operation, and this mathematical equation is shown in Eq. (7).

In Eq. (7), D’ refers to the distance between search agents and hunting, and b is a variable with a constant value, which must be set before starting the optimization procedure. In Eq. (8), two mechanisms used in the exploitation phase are shown, the first of which is related to the contraction mechanism.

In Eq. (8), P refers to the random number generated between 0 and 1.

In the natural world, whales often search for food randomly in the natural environment. The same thing has been modeled in the WOA, and if the value of vector A is >1, the optimization algorithm enters the discovery phase, and the mathematical equation that models this behavior is shown in Eq. (9).

In Eq. (9), X_rand refers to a search factor among the whole population which is randomly selected.

3.4. Proposed Model

Each optimization algorithm has a series of strengths and weaknesses, which can show very different and diverse effects when faced with different problems. The main reason for this behavior can be the search algorithm of these algorithms in solving different problems. Because, each of these algorithms can be superior in one of the phases of exploitation or exploration, and in solving problems that one of these two cases can achieve good results, the efficiency of the algorithm is also better in the same problem. However, the problem of avoiding the BH requires good performance in both phases of exploitation exploration, and we have combined two SCAs and a WOA to solve this case. Because the SCA has a relative superiority in the exploration phase and the WOA has a better performance in the exploitation phase. Furthermore, the approach used to combine these two algorithms in this paper is to avoid increasing the computational complexity half of the population enters the SCA in each iteration, and the other half of the population enters the whale optimizer algorithm to perform optimization operations. In such a situation, the computational complexity is not increased and the optimization capabilities are maintained in both algorithms. Fig. 2 illustrates the general outline of the proposed optimizer algorithm.

Fig. 2. Overall overview of the proposed model.

Different steps in the proposed model to discover the BH or avoid the BH, there are different steps, and each step has different processes, which are fully explained below. The proposed model goes through the following steps:

• Several nodes are randomly distributed in a square-shaped environment with adjustable dimensions

• Some of the nodes are considered BH randomly. These nodes do not send messages and by creating a hypothetical neighbor and inserting the ID of this hypothetical node in the list, they cause deception in the nodes that send the message. Because of this, the return time of the packets is very fast regardless of the specified path and can be used as a tip

• Normal nodes in the network have normal routing behavior and the return time of packets is also standard. If the packet return time from these nodes is less than the threshold, these nodes can be considered BH

• A central station undertakes the task of detecting BH using the proposed optimizer algorithm

• AODV algorithm is used for routing

• Identification stage, after detecting the suspicious nodes based on the response time, a command is issued through the central station to attack the neighboring nodes, which is the best solution of the central station in the proposed model. If the central node is adjacent to the suspicious node, the central station itself also participates in the attack process. The nodes that have the most warning and reception compared to the node in question are considered the three best nodes

• The top three nodes can change based on criteria at any moment. After being selected, these nodes start sending routing packets to discover BH nodes in a small range. In this phase, BH nodes that have not yet been definitively discovered may be present in the attack and disrupt the discovery of suspicious nodes of their colleagues

• If the number of warnings received in each enclosing node exceeds the first threshold value, it starts sharing this node with its neighbors. If the number of warnings received for the BH node exceeds the third threshold, this node will be saved as a BH node in its list. Furthermore, if the number of warnings of the first three solutions is greater than or equal to the third threshold, the suspicious node is considered a BH node. In addition, in the first three solutions, although the masked nodes warn their neighbors, the first node determines whether a node is a BH and transmits it to the hub. Then, after the definite discovery of a BH node, the station node warns this node to the neighbor so that the neighboring nodes are aware of the said node being a BH

• Neighboring nodes continue to communicate with all their neighboring nodes until the third threshold is reached, even if these nodes are suspicious nodes or BH nodes. However, when the warning level reaches the set value, these nodes are ignored

• In addition to the routing table, each node has another table called blacklist, in which the specifications of suspicious nodes are entered

• In each repetition of the simulation operation, the position of the nodes is updated, and the suspicious nodes are closely related to the number, type, and position of their neighboring nodes.

4. RESULTS AND DISCUSSION

In this section, the suggested model is tested and evaluated and the outcome gained from this evaluation will be depicted in tables and graphs. Furthermore, for a fair test, the results gained from the suggested model have been compared with gray wolf optimization [22], giant trevally optimizer [23], and particle swarm optimization (PSO) [24] algorithms. In addition, to perform this experiment, a computer with RAM 8 specifications and a Cori3-4005U CPU was used, and the implementation was done in MATLAB version 2016b. In this paper, we have used the face-centered central composite design [25] method to find the best parameter value. The best parameter value obtained from this experiment is shown in Table 1. The scenario used to test the proposed model is in the form of a virtual network, in which network nodes are randomly distributed in the network space every time it is executed. The network settings used for the experiment are shown in Table 1.

TABLE 1: Parameter setting

Regarding Table 2, this table shows the ratio of true and false alarms obtained from this test by the proposed model and other algorithms compared.

TABLE 2: Total warn with rate

Focusing on the results demonstrated in Table 2, the proposed model has been able to show the best performance and is superior to other algorithms. The second-best performance is related to the PSO algorithm, which also has an acceptable rate. In the following, the proposed model has been carefully evaluated for a more accurate evaluation using different charts, which is shown in Fig. 3.

Fig. 3. Diagrams of the cost function set and the cumulative cost function.

Fig. 2 shows the graphs of the cost and cumulative cost function. Considering that it is very difficult to discover BH nodes in the early stages, after each iteration, the values have decreased dramatically. In other words, in the initial stages, the values were equal to 0.25, in the later stages of optimization, this value reached below 0.05. According to the cumulative cost diagram, the value of the cumulative function was more than 12 in the first stage. It has been minimized to zero in the next stages, which shows the convergence process of the cost function.

Fig. 4 shows the graphs of the number of participating nodes and BH nodes in BH discovery. By referring to the diagram of the number of BH nodes, it is clear that the proposed model has been able to discover more BH nodes during the optimization operation, which indicates the good efficiency of the suggested model. According to the graph of the number of nodes that participated in BH detection, this graph is the percentage of nodes that participated in BH detection. Participated in the discovery of a BH at least once, it can be seen that most of the nodes participated during the optimization operation to discover the BH, which was almost more than 85%.

Fig. 4. Graphs of the number of detected black holes and the percentage of normal nodes detecting black holes.

Fig. 5 shows the graphs of the total alerts received and the amount of correct and incorrect alerts. By carefully looking at the first diagram, it can be concluded that the number of warnings during the operation declined because the number of BH nodes was discovered during the optimal procedure. Other normal nodes do not send information to these nodes. In the second graph, which is related to the amount of correct and false alarms, the ratio of correct alarms to false alarms is equal to 0.8658, the percentage of correct detection is equal to 100%, and the alarm ratio according to the error correction approach is equal to 0%.

Fig. 5. Cumulative graphs of the received alarm of the whole network and the rate of false alarm and correct alarm.

Fig. 6 shows the simulation areas before and after the optimization operation. In this Fig., the suspicious nodes are shown with red circles, which change color to black if detected after the optimization operation. By looking carefully at this diagram, it is clear that the proposed model has almost been able to correctly discover all the nodes of the BH.

Fig. 6. Network environment before and after starting the simulation.

5. CONCLUSION AND FUTURE WORK

Minimizing energy and consumption and creating safety in WSN during the lifetime of the network is a vital issue because otherwise, the network can easily be out of reach. In this article, a novel linked optimization algorithm depends on the WOA, and SCA is used for computing and also increasing the accuracy in finding BH attacks in WSN. In addition, it has been tried to eliminate the weaknesses in other algorithms, which include low accuracy and failure to detect multiple attackers. For this reason, in this model, an attempt has been made to use more detailed input data, which leads to increased accuracy and detection of multiple attacks. The output results are compared with a threshold value, and if this value is higher, the node in question is considered a BH node. Then, three input parameters in this model are given to the proposed optimizer algorithm to perform the optimization procedure. In this paper, a new type of optimization algorithm is presented to discover BH nodes in WSN. The above algorithm has a very good ability to explore the problem space due to its hybrid nature based on WOA and SCA algorithms. The above algorithm has shown that it has a very good performance in the exploitation and exploration phases.

The results of the experiment demonstrate that the suggested model has a perfect capability of detecting BH in WSNs.

In the future, the suggested algorithm can be applied to resolve various issues, or this model can be utilized to explore various attacks in WSN. Furthermore, in the future, a multi-objective algorithm depending on the proposed optimizer algorithm can be presented to solve multi-objective problems.