This full-text paper was peer-reviewed and accepted to be presented at the IEEE WiSPNET 2016 conference.

Anomaly based detection of Black Hole attack on

leach protocol in WSN
Vishali Bansal Krishan Kumar Saluja
Department of Computer Science and Engineering Department of Computer Science and Engineering
Shaheed Bhagat Singh State Technical Campus Shaheed Bhagat Singh State Technical Campus
Ferozepur, India Ferozepur, India
bansal.vishu494@gmail.com k.salujasbs@gmail.com

Abstract— Wireless sensor network is one of the developing protocols have been proposed for WSN to address these issues.
ranges of research in present situation. A Wireless sensor The routing protocols are divided into flat and hierarchical
network comprises of geographically dispersed self-governing based on the network structure.
tiny sensor nodes with little battery life to screen and control over
the physical parameters or ecological conditions, for example,
temperature, sound, pressure, humidity and so on and this data is
gone by the sensor nodes in the network to a next area. Amid
transmission, the sensor nodes devour impressive measure of
energy. There are numerous requirements on these sensor nodes,
for example, constrained memory, restricted battery power, and
constrained processing capacity. At the point when sensor nodes
send the data to the base station (BS), routing protocols assumes
critical part to convey the data at the BS. Low Energy Adaptive
Clustering Hierarchy (LEACH) is the surely understood
distributed and centralized clustering routing protocol. Wireless
Sensor Networks are inclined to different attacks. Black hole a
sort of Denial of Service attack is extremely hard to identify and
protect. Black Hole attack happens, when a intruder catches and
re-programs a set of nodes in the network to block the packets as
opposed to sending them towards the base station in wireless
sensor network. In this paper, we show the effect of black hole on
LEACH protocol researched by the dynamic authors. Likewise
we have proposed an algorithm for the identification of the black
hole attack.

Index Terms— Wireless Sensor Networks, Black Hole Attack,
Network Security, LEACH
I. INTRODUCTION
Wireless sensor network (WSN) is a type of heterogeneous
network that consists of a large number of tiny; cost effective
sensor nodes deployed in a geographical area for monitoring
the environment. Each sensor node has restricted processing,
storage capacity, computational power. Each sensor node is
equipped with transducer, microcomputer, transceiver, and
battery power. The main function of transducer is to generate
the electrical signal and it is processed by the microcomputer
and is stored in the output of the sensor node. The parameters
monitored by sensor nodes ranges from humidity, temperature,
pressure, wind direction, power line voltage etc. Further WSN
are deployed in a adverse environment where replacement of
battery is nearly impossible. So there are many different issues
like routing, fusion and localization need to be focused.
Routing is the main challenging issue in WSN. Various routing
Fig. 1: General system model for clustered WSN.
As huge quantities of sensor nodes are utilized, it is
difficult to dole out the identity to every node in flat routing.
Consequently there is a need of data centric routing protocols,
where BS gets information from a gathering of nodes.
Clustering comes under hierarchical routing protocol where
nodes are sorted out into clusters in view of a few
measurements. For every cluster a pioneer is chosen known as
cluster head. The CH accumulates all the data from nodes,
totals the data and sends the packed data to the BS. This
maintains a strategic distance from data redundancy,
contention for accessing the channel, and increased network
lifetime. In LEACH, the energy is evenly dispersed among all
the sensor nodes. The CH is chosen in light of pre-defined
threshold value. At beginning of each round, nodes having
remaining energy higher than the threshold worth are chosen
as CHs. LEACH amplifies the system life time and decreases
the energy dispersal by compacting the data sent to BS. The

978-1-4673-9338-6/16/$31.00 2016
c IEEE 1924
 This full-text paper was peer-reviewed and accepted to be presented at the IEEE WiSPNET 2016 conference.

primary drawback of LEACH is, as CH is chosen arbitrarily
among the quantity of nodes, a node with less lingering energy
might be chosen as a CH in a few rounds. In this way the hub
with less lingering energy might die first.
II. OVERVIEW OF BLACK HOLE ATTACK
WSNs are considered as an extraordinary
classification of ad-hoc networks and infrastructure less, and
keep running without human participation. Thus they are
inclined to numerous sort attacks, for example, jamming,
worm hole, sink hole, black hole and Sybil attack.. Be that as it
may, here we have concentrated just on black hole. Along
these lines, other attacks are not examined in this paper.
A, Black Hole Attack
In Black Hole Attack, compromised node tries to pull
in all the traffic from its encompassing nodes. The
compromised node creates false directing data to neighboring
nodes. This occupies all the traffic to the malicious node. Here,
the malicious node publicizes that it has high remaining
energy. By publicizing this, malevolent node gets to be CH at
each round. All the nodes send packets to the malicious node
as it goes about as a CH. The malicious node gathers all
packets and does not forward to BS.
energy when contrasted with the ordinary nodes to have
maximum lifetime amid network operation. We have utilized
appropriated Energy Efficient Clustering, so that nodes with
high starting energy and remaining energy in the further
rounds will have a larger number of opportunities of becoming
cluster head than the nodes with low energy nodes.
Subsequently attacker node will have more opportunity to be
the cluster head and gets more data and influence the network
more. In our network there are two sorts of nodes attacker
nodes and ordinary or normal nodes. Assume E0 is the
beginning energy of normal nodes than the energy of malicious
node is considered as E0*(1+x). In this way total energy will
be:-
E = (N-1)*E0+E0*(1+x)
Cluster-head selection
Let ni denote the number of rounds then Pi=1/ni will be the
average probability of a node I to be a cluster head during ni
rounds. If Popt be the optimal probability for a normal node to
be cluster head than probability of malicious node will be:-
Pmal=Popt/(1+x)
To calculate threshold following formula is considered:-
T (n) = {Pi/1-Pi*(r mod1/Pi) if ni ‫ א‬G
{0 otherwise
From this formula it is clear that attacker which is having high
initial energy have higher probability to end up a cluster head.

V. SIMULATION MODEL
To analyze the performance of LEACH protocol
under black hole attack, we have used NS-2. We have
considered 50 nodes in a sensor field. The proposed WSN field
is shown in Fig. 3. The BS is located at (x=884, y=590) in
1100m*1100m field. For easy simulations, the parameters of
interest have been provided in Table1. In our simulations,
number of nodes in a cluster depends upon the position of
nodes and we have taken maximum 6 clusters. Cluster heads
are selected based on the residual energy of a node. One
malicious node has been considered to perform the black hole
attack.
Fig. 2 shows the example of WSN, where malicious node captures all the Table1. Simulation Parameters
packets and do not forward the packets to the BS
Simulation Area 1100*1100
III. RELATED WORK No. of nodes 50
Karlof et al. [3] was first one to describe the various Channel type Wireless Channel
vulunerabilities to WSNs. They mention various possible Simulation time 45 seconds
attacks such as Sybil attack, HELLO FLOOD attack along Initial energy of nodes 50j
with Black Hole and Gray Hole attack in LEACH. Padamalya
et al. [10] have shown the performance of LEACH protocol Energy Model Battery
under the black hole attack and sinkhole attack. Meenakshi et Communication Channel Bi-directional
al. [14] investigated the performance of WSN under the Black Antenna Model Omni-directional antenna
Hole and Gray Hole attacks and proposed the detection of Radio Propagation Model Two ray ground
these attacks. To the best our study none of the previous works Simulation Time 45 sec
have shown the anomaly based detection of black hole attack
Duration of attack 20-35 sec
in LEACH based WSN.
IV. MODIFICATIONS IN LEACH
We consider that the attacker nodes are having higher

1925
 This full-text paper was peer-reviewed and accepted to be presented at the IEEE WiSPNET 2016 conference.
VI. SIMULATION RESULTS AND ANA
ALYSIS
We have implemented the following stepss to get a clear
understanding and analysis of the attack:
• Examine normal LEACH under vaarious network
parameters as above.
• Examine the LEACH with Black Holle attack under
same network parameters
• Detect the black hole node using beelow described
algorithm.
A. Performance Metrics
a) Packet delivery ratio
The ratio of the number of delivered data packet to the
destination and the total number of packetts sent to the
destination. This illustrates the level of deliveered data to the
destination.
Packet delivery ratio=™ Number of packet receiive / ™ Number
of packet sent (Packets dropped+ packets receivved)
a) Throughput
Throughput can be defined as the number of bits successfully
received through a network per unit of time.
Throughput = ™ number of bits received/Time
b) Remaining energy
It is defined as the residual energy of the nodees after sending
data to the base station during the network lifetim
me.
B. Performance Analysis for LEACH in Normal Scenario
Firstly, we have done our simulations withouut any attacker
node. In second step, we have simulated LEAC
CH with Black
Hole node with other nodes.
Fig.3 Network Topology for simulation
1926
Fig.4 Black hole attack is implemented in thee network. Packet loss occur in
the network due to atttacker
C. Performance Analysis for Black Ho ole LEACH
Figure 3 demonstrates to one o preview of network
topology utilized for the simulattion. Distinctive colors
represent the diverse clusters. At the point when no malicious
node arrives in the system, base statioon gets great measure of
packets and the outcomes are exh hibited in Figure 4 for
LEACH, without malicious node aand in the presence of
malicious node, subject to the reqquirements of prediction
precision. It is watched that in the evvent of malicious node in
the network number of data packetts came to base station
diminishes subsequent to the maliciouus node is dropping every
one of the packets of its group in thiss way the bend of packet
delivery ratio (PDR) amid the length of time of attack drops.
Figure 5 demonstrates the effect of thee Black Hole attack to the
throughput. The general residual energy of the nodes
additionally increments because of B Black Hole impact when
contrasted with that without the impaact of Black Hole attack
since black hole node is not expendin ng the energy in sending
the packets to the station. From Figgure 6 it is watched that
effect of the attack is not colossall if there should be an
occurrence of aggregate residual eneergy in the system, it is
because of the way that in spite of the fact that the attacker is
not sending the information to the base station but rather still it
is taking an interest in every single othher activity in the system,
which consumes energy. We differ thhe quantity of the nodes
and take the outcomes.
WĂĐŬĞƚĞůŝǀĞƌLJZ
ZĂƚŝŽ
Ϯ
WZ
ϭ WZͺďůĂĐŬ
Ϭ ŚŽůĞ
ϭ ϳ ϭϯϭϵ Ϯϱ ϯϭ ϯϳ ϰϯ WZ
^/Dh>d/KEd/D
Fig.5 Packet delivery ratioo
 This full-text paper was peer-reviewed and accepted to be presented at the IEEE WiSPNET 2016 conference.

dŚƌŽƵŐŚƉƵƚ
ϭϱϬϬϬϬ
dŚƌŽƵŐŚƉƵƚ

ϭϬϬϬϬϬ
dŚƌŽƵŐŚƉƵƚ
ϱϬϬϬϬ
Ϭ
dŚƌŽƵŐŚƉƵƚ
ϭ ϲϭϭϭϲϮϭϮϲϯϭϯϲϰϭ ͺďůĂĐŬŚŽůĞ
^ŝŵƵůĂƚŝŽŶdŝŵĞ

Fig.6 Throughput

ZĞŵĂŝŶŝŶŐŶĞƌŐLJ
ϲϬ
ŶĞƌŐLJŝŶũŽƵůĞƐ

ϰϬ ƌĞŵĂŝŶŝŶŐͺ
ŶĞƌŐLJ
ϮϬ
Ϭ ƌĞŵĂŝŶŝŶŐͺ
ϭ ϲ ϭϭϭϲϮϭϮϲϯϭϯϲϰϭ ŶĞƌŐLJͺďůĂĐŬ
ŚŽůĞ
^ŝŵƵůĂƚŝŽŶdŝŵĞ

Fig. 8 Flow chart of detection algorithm

Fig.7 Remaining energy of all the nodes

VIII. CONCLUSIONS
VII. DETECTION TECHNIQUE
In this thesis work impact of black hole attack against
In the absence of attacker node
LEACH protocol on WSN is analyzed using identified
metrics and detection of attack is done using an effective
Cluster formation according to signal strength. algorithm. The contribution of this thesis work is manifold
Simply initiate leach protocol in the next section.
Observed maximum how many times a particular The whole work is done in three steps in first step various
metrics are identified which are suitable to declare the black
node became a cluster head (CH) in the total
hole attack. Analysis of service degradation due black hole
duration. attack is quantified in terms of throughput, packet delivery
ratio, residual energy of nodes. In the second step we
In the presence of attacker node modified LEACH protocol to simulate black hole attacks on
If CH repeats more than the maximum limit: WSN. The impact of black hole attack is analyzed using
identified metrics. The resultant effect of the attack has
network under black hole attack indicated the need of detection of such attacks. In the third
{ step black hole attack is detected. Our experiments have
Base station sends an alert packet to the sensor shown the effect of black hole attack using different
nodes performance metrics.
} IX. FUTURE SCOPE
Else
There is no end of the technology so any work can be
{ further improved or used for new work. Similarly this work
Data transmission across network successfully has lot of scope in new work and expansion of same work.
}

1927
 This full-text paper was peer-reviewed and accepted to be presented at the IEEE WiSPNET 2016 conference.

• This work helps in mitigation approach on black hole

attack in WSN.
• Same work can be extended by using different protocols,
different topology and different simulation parameter
because most of the parameters are tunable.
• Same work also can be done by using different simulator.
REFERENCES
[1] S. K. Sohraby, D. Minoli, T. Znati, Wireless Sensor Networks"
Technology, Protocols, and Applications", John Wiley and Sons,
2007.
[2] Y. Zou, K. Chakrabarty, "Sensor deployment and target localization
based on virtual forces", in: Twenty- Second Annual Joint Conference
of the IEEE Computer and Communications Societies, Vol. 2, IEEE
Computer Society, 2003, pp. 1293–1303.
[3] C. Karlof, D. Wagner, "Secure routing in wireless sensor networks:
Attacks and countermeasures", Special Issue on Sensor Network
Applications and Protocols 1 (2-3) (2003) 1293 –1303.
[4] W. Heinzelman, A. Chandrakasan, H. Balakrishnan, "Energyeŏcient
communication protocol for wireless microsensor networks", IEEE
Transactions on Wireless Communications Vol 1, No.4, 2002 660–
670.
[5] R.H.Jhaveri, S.J.Patel, D. Jinwala, "A novel approach for grayhole and
blackhole attacks in mobile ad hoc networks," in: Second
International Conference on Advanced Computing and
Communication Technologies, IEEE Computer Society, 2012, pp.
556– 560.
[6] S. Lindsey, C. Raghavenda, Pegasi "Power eŏcient gathering in sensor
information systems, " in: IEEE Aerospace Conference, IEEE
Computer Society, 2002.
[7] O. Younis, S. Fahmy, Heed" A hybrid, energy-eŏcient, distributed
clustering approach for ad hoc sensor networks," IEEE Trans-actions
on Mobile Computing 3 Vol 4, p.p 660–669, 2004.
[8] T. Issariyakul, Introduction to Network Simulator NS2, Springer,
2008.
[9] The network simulator ns2, www.isi.edu/nsnam/ns, visited July 2010
(1998).
[10] Padmalaya Nayak, V. Bhiwani, B. Lvanaya, " Impact of Black Hole
Attack and Sink Hole Attack on Routing protocols for WSN,"
International Journal of Computer Application, Vol 116, 2015.
[11] D. Martins, H. Guyennet, "Wireless sensor network attacks and
security mechanisms a short survey," 13th International Con-ference
on Network-Based Information Systems, IEEE Computer Society,
2010.
[12] Y. Law, P. J. Havinga, "How to secure sensor network, in:
International Conference on Sensor Networks and Information
Processing,," IEEE Computer Society, 2010, pp. 89–95.
[13] G. Werner-Allen, K. Lorincz, M. Welsh, O. Marcillo, J. Johnson,
M.Ruiz, J. Lees, "Deploying a wireless sensor network on an active
volcano," IEEE Internet Computing ,10, 2006.
[14] Meenakshi Tripathi, M.S. Gaur, V. Laxmi, "Comparing the impact of
Black Hole and Gray Hole Attack on LEACH in WSN," Elsevier,
2013.
[15] R. Verdone, D. Dardari, "Wireless Sensor and Actuator Networks
Technologies, Analysis and Design," 1st Edition, Academic Press,
2008
΀ϭϲ΁ J. Cai, P. Yi, J. Chen, Z. Wang, N. Liu, An adaptive approach to
detecting black and gray hole attacks in ad hoc network, in: 4th IEEE
International Conference on Advanced Information networking and
Applications, IEEE Computer Society, 2010, pp. 775–780.

1928