Evaluating Blackhole Attack Detection Strategies for Secure Heterogeneous Wireless Sensor Networks

1.1 Background on wireless sensor networks and transition to heterogeneous wireless sensor networks

Wireless sensor networks (WSNs) are collections of spatially distributed sensor nodes designed to cooperatively monitor physical or environmental conditions such as temperature, sound, vibration, or motion. WSNs were traditionally made up of homogeneous sensor nodes, each of which had comparable processing power, energy resources, communication capabilities, and network functions [1]. These networks have been used extensively in industrial automation, healthcare, environmental monitoring, and military surveillance. However, the shortcomings of homogeneous WSNs, particularly with regard to energy economy, processing load, and communication range, became evident as the need for increasingly sophisticated and scalable applications increased [2].

To address these challenges, researchers have introduced heterogeneous wireless sensor networks (HWSNs). The capacities of nodes in HWSNs vary; some have more energy reserves, more computational capacity, or a longer communication range. Increased network longevity, dependability, and scalability are provided by this heterogeneity [3]. Strong nodes, for example, can act as cluster leaders, combining information from lower-tier nodes and sending it to the base station. Although HWSNs increase overall flexibility and efficiency, they also create new security flaws since attackers can target high-capability nodes to cause the most disruption.

1.2 Blackhole attacks: Definition, impact, and the need for detection mechanisms

In WSNs and HWSNs, a blackhole attack is a serious security risk in which a malevolent node deceptively positions itself as possessing the quickest or best route to the target (such as the base station). It creates a "black hole" in the network by silently dropping packets rather than forwarding them once it has begun accepting them. Even one blackhole node can cause significant network disruptions in multi-hop communication networks, such as WSNs, because nodes mostly depend on their neighbors to convey data [4, 5]. This can result in packet loss, reduced throughput, and energy waste from needless retransmissions.

The effects of blackhole assaults are even more severe in HWSNs. When compromised, high-capability nodes like cluster heads or fusion nodes can deceive a sizable section of the network, impairing scalability and dependability. Conventional routing systems are weak because they frequently lack the tools to dynamically assess a node's reliability [6]. Therefore, protecting the availability, confidentiality, and integrity of the data being sensed and sent depends on identifying blackhole assaults. To guarantee the safe and reliable operation of contemporary sensor networks, specific detection methods designed for diverse configurations must be developed.

1.3 Scope and objectives of the survey

The objective of this survey is to provide a thorough analysis of the state of security protocols and detection systems intended to thwart blackhole attacks in HWSNs. Although there is a wealth of research on intrusion detection in homogeneous WSNs, a more concentrated study is necessary due to the special features of HWSNs, including node variety, fluctuating energy profiles, and hierarchical topologies. In the context of HWSNs, the goal is to identify, categorize, and assess current blackhole detection methods, emphasizing their designs, detection tactics, performance indicators, and suitability for practical applications.

A taxonomy of current methods will also be provided by the survey, which will group them into routing-based, AI/ML-based, trust-based, and hybrid models. It will identify research gaps through comparison analysis, such as computational overheads in detection models, energy inefficiencies, or a lack of standardized datasets. The ultimate goal of this work is to give researchers and developers a starting point for creating scalable, lightweight security mechanisms that adapt to changing threats in diverse WSN contexts. The survey advances the development of safe and robust WSN infrastructures by highlighting important issues and suggesting future paths.

3.1 Mechanism of a blackhole attack

In a WSN, a blackhole attack is a kind of network-layer security risk when a malevolent node deceptively positions itself as having the quickest or most effective route to the target, usually the base station. Because they think the rogue node is a trustworthy middleman, nearby nodes use it to transit their data after learning about it. When the blackhole node begins receiving data packets, it secretly drops them rather than forwarding them, causing significant data loss and interfering with network connections [10].

This attack takes advantage of the fact that several WSN routing protocols, like AODV or DSR, are trust-based and do not automatically confirm the legitimacy of routing packets. These protocols are appropriate for contexts with few resources because of their simplicity and low overhead, but they are also susceptible to manipulation. Detection becomes considerably more difficult when attackers use numerous compromised nodes to perform coordinated blackhole attacks [11]. By decreasing the packet delivery ratio (PDR), raising latency, and using more energy as a result of route rediscovery or retransmissions, these attacks impair network performance.

3.2 Attack scenarios and adversarial models

Depending on the capabilities and objectives of the opponent, blackhole attacks might appear in a variety of ways. One malevolent node interferes with communication in its immediate vicinity in a single-node assault. A cooperative blackhole attack involves several malevolent nodes working together to deceive and intercept data over a larger area, causing a more extensive disruption to the network. In clustered topologies, where a hacked cluster head might impact a whole collection of sensor nodes, these attacks are very dangerous. Adversaries might be internal, where malware or physical access compromises legitimate nodes, or external, when the attacker introduces rogue nodes onto the network [12]. The mobility, processing power, and energy availability of adversarial models can also differ. By sporadically forwarding some packets or altering behavior in response to feedback from network monitoring, a skilled attacker who is familiar with the routing protocol and network layout can vary its approach to avoid detection.

Designing efficient detection techniques requires an understanding of these models. Both static and dynamic attackers must be taken into consideration by protocols, which must also be able to differentiate between malicious activity and normal problems like packet loss brought on by congestion or node failure.

3.3 Specific risks in heterogeneous wireless sensor networks compared to homogeneous wireless sensor networks

Compared to homogeneous networks, HWSNs are particularly vulnerable to blackhole attacks. Certain nodes in HWSNs, including cluster heads or gateway nodes, have more energy stores, processing power, and communication ranges than others. These nodes frequently have key roles in routing and data aggregation. Therefore, communication can be disrupted for a large chunk of the network, not just a small neighborhood, if a high-tier node is compromised or behaves maliciously.

Because HWSNs are hierarchical, lower-tier sensor nodes rely significantly on upper-tier nodes to relay information to the base station. At a higher level, a blackhole node can efficiently function as a sink or a bottleneck, collecting and discarding significant amounts of important data. Furthermore, because of node variability, HWSNs frequently lack consistent trust models, which makes it more challenging to apply uniform security measures throughout the network. The mobility or re-tasking of high-tier nodes in dynamic contexts presents an additional risk. Attackers can escape static detection techniques by launching adaptive blackhole attacks by taking advantage of this mobility or role change [13]. Therefore, in order to effectively combat these increased risks, security procedures in HWSNs need to be more resilient and context-aware.

3.4 Real-world implications and case examples

Blackhole attacks in WSNs and HWSNs have significant practical ramifications, especially in mission-sensitive fields like healthcare, environmental monitoring, and military surveillance. A whole mission may fail, and human lives may be lost, for example, if a blackhole node ignores detection signals regarding enemy activity or landmines in a combat situation. Similar to this, blackhole attacks in smart agriculture may result in the loss of sensor data needed for crop protection or irrigation, which could lower yields or cause financial harm. One prominent example comes from smart grid systems, which use sensor networks to keep an eye on infrastructure and electrical lines. A blackhole attack might delay emergency responses by making it impossible to notice power outages or tampering events. Disaster management systems that use WSNs to identify fires, gas leaks, or structural damage are another example. The impact of the disaster may grow, and rescue efforts may be delayed if blackhole assaults stop alert messages from getting to the command center [14]. These situations highlight the need for real-time blackhole mitigation and detection systems. Furthermore, the ramifications of such assaults can spread to larger digital ecosystems as WSNs interface with the Internet of Things (IoT), which emphasizes the need for robust and intelligent security procedures.

Blackhole attacks pose a significant threat to the reliability of WSNs. This section reviews recent security protocols for blackhole attack detection, emphasizing detection mechanisms, performance trade-offs, and suitability for heterogeneous deployments.

Khan et al. [16] presented a trust-based optimized reporting scheme designed to detect and prevent blackhole attacks in constrained routing environments such as RPL-based Low-Power and Lossy Networks (LLNs). The proposed protocol computes direct and indirect trust values for neighboring nodes using metrics including honesty, energy, unselfishness, and similarity, and employs a delta-threshold mechanism with a forgetting curve to dynamically weight recent behavior. This approach enables the root or sink node to make more reliable decisions about malicious behavior while reducing false positives and reporting overhead. The scheme also balances detection accuracy with minimal communication and processing costs, addressing a crucial challenge in resource-limited HWSN deployments where energy efficiency and timeliness are essential. Through simulation and evaluation, the authors demonstrate improved detection performance compared to conventional static threshold methods, making this security protocol a valuable strategy for blackhole detection in HWSNs.

Ramesh et al. [18] proposed an energy-aware and adaptive intrusion detection system (IDS) tailored for WSNs that targets both blackhole and wormhole attacks. The security framework leverages DL techniques combined with advanced feature generation and adaptive learning to improve detection accuracy while minimizing energy consumption, which is critical in resource-constrained environments. Specifically, the method uses generative adversarial networks (GANs) for generating distinguishing attack features, meta-heuristic optimization such as the whale optimization algorithm (WOA) for parameter tuning, and deep Q-learning for adaptive learning of attack patterns, ensuring the model can respond to evolving threats in real time. Simulation results demonstrate that this hybrid approach achieves high detection accuracy, recall, and specificity compared with traditional ML and DL models, highlighting its suitability for real-time deployment in heterogeneous sensor environments.

Ramesh et al. [18] introduced an energy aware adaptive intrusion detection and prevention framework to detect blackhole and grayhole attacks with improved accuracy and reduced false alarms. The protocol integrates the Generative adversarial networks (GAN) and whale optimization algorithm to learn the attack behavior. Simulation results indicate that the hybrid IDS achieves higher detection rates and lower energy consumption than traditional standalone IDS methods, making it suitable for resource-constrained heterogeneous environments. Importantly, the study analyzes the trade-offs between detection accuracy, energy overhead, and scalability, providing insight into how multi-layer security protocols can be effectively deployed in diverse wireless sensor deployments.

Ghugar et al. [19] presented DLTIDS, a dual-layer trust-based IDS designed to detect blackhole attacks in WSNs. Two complementary trust mechanisms are employed by the system. By identifying nodes as either suspect or trusted, the first layer assesses direct trust based on node behavior, particularly packet forwarding and hop count. To further examine node activity and confirm malicious intent, the second layer uses a watchdog mechanism. Cluster leaders are essential to the coordination of trust evaluations and data aggregation. To trace and verify network paths, DLTIDS keeps track of three tables: route, source, and destination. It looks for irregularities by comparing sequence numbers and hop counts. The system is evaluated using both watchdog-based and conventional AODV methods after being simulated in MATLAB. The findings demonstrate reduced false alarm rates, enhanced detection accuracy, and trust stability, particularly at higher network densities. DLTIDS is robust against blackhole and jamming attacks and demonstrates adaptability to dynamic WSN environments. Its dual-layer structure makes it a reliable and scalable solution for real-time WSN security.

Khan et al. [20] proposed an artificial neural network (ANN)-based mechanism to detect routing attacks in WSNs, targeting blackhole, grayhole, and wormhole threats. The method makes use of a feed-forward ANN that was trained using characteristics such as the number of packets, energy consumption, and node trust level. The NS2 simulator is used to implement the model, which was trained using the CICIDS2017 dataset. To increase classification and decrease false positives, it makes use of a three-layer ANN (input, hidden, and output) with optimum parameters. Training on labeled data and testing on unlabeled real-time traffic are the two stages of detection. The ANN demonstrated resilience against a range of routing hazards with an accuracy of 99.49% and a detection rate of 99.21%. According to simulation results, performance was consistent across attack scenarios with low energy usage and packet loss. The technology outperforms traditional techniques by maintaining reliable packet delivery even during attacks. This work highlights the viability of ANN models for real-time intrusion detection in resource-constrained, energy-sensitive WSN environments.

Table 2. A comparative analysis of various blackhole attack detection techniques in wireless sensor networks (WSNs)

Table 3. A Comparative analysis of various blackhole attack detection techniques in wireless sensor networks (WSNs)

Kim et al. [21] introduced a detection mechanism utilizing symmetric key cryptography, specifically AES, combined with signature-based methods. The goal of this distributed architecture method is to identify blackhole attacks without causing appreciable communication lag. Although the technique is successful in preserving a high PDR and minimal end-to-end delay, it necessitates strong key management techniques to manage cryptographic keys throughout the network.

Almseidin et al. [22] proposed a centralized detection model integrating fuzzy logic with genetic algorithm (GA) and teaching-learning-based optimization (TLBO). The goal of this hybrid strategy is to maximize computational efficiency without sacrificing detection precision. However, in large-scale HWSNs, where distributed solutions are frequently more practical, their centralized nature may provide scaling issues.

Saxe and Berlin [23] developed a DL-based detection system employing classifiers trained to identify blackhole attacks. With its high true detection rate (TDR) and distributed operation, this method is appropriate for dynamic and diverse situations. The main drawback is the requirement for large amounts of training data and processing power, which not all sensor nodes may have easily accessible.

Saravanakumar et al. [24] combined encryption methods with deep neural networks in a cluster-based architecture to detect blackhole attacks. This hybrid strategy makes use of cluster heads' processing power to increase data delivery rates and reduce latency. However, the combination of DL and encryption adds computational overhead, which calls for cautious resource management.

Table 2 provides a comparative analysis of various blackhole attack detection techniques in WSNs, focusing on architecture, detection mechanisms, performance metrics, and applicability to HWSNs. Each method is evaluated for its strengths and limitations, highlighting trade-offs such as detection accuracy versus computational or communication overhead.

Clement Sunder and Shanmugam [25] introduced the JDICA technique, a distributed method focusing on joint detection and isolation of malicious nodes. By lowering latency and increasing PDR, this strategy raises network efficiency overall. However, the longevity of sensor nodes may be impacted by the energy consumption related to ongoing monitoring and isolation procedures.

Abdelrahman et al. [26] implemented a blockchain-based detection mechanism, utilizing the immutable ledger to verify node behavior and detect anomalies. This distributed method improves throughput and guarantees efficient detection of rogue nodes. The increased overhead brought about by blockchain operations, which could have an impact on processing time and energy usage, is one of the trade-offs.

Terence and Purushothaman [27] proposed the warning message counter (WMC) method, a behavior-based monitoring system operating in a distributed architecture. This method maintains low false positive and negative rates while increasing the PDR by examining node behavior and delivering warnings. Network traffic may increase if more communication is required to spread warnings.

Ashfaq et al. [28] developed a detection system combining GA with the XGBoost classifier in a distributed setup. Because of its high detection rate, this technique is useful for spotting blackhole attacks. However, such models may not be as applicable in contexts with limited resources due to the computational complexity involved in training and deploying them.

Liu and Wu [29] presented a cluster-based voting decision method, where cluster nodes collaboratively decide on the legitimacy of data packets. This method meets the requirements of HWSNs by achieving low FDRs and low energy usage. The stability and dependability of cluster formations are necessary for this strategy to be effective.

Table 3 offers a comparative analysis of various blackhole attack detection techniques in WSNs, focusing on the simulation tools or datasets used, achieved performance metrics, and limitations of each approach. It includes both ML and meta-heuristic models such as Random Forest, LSTM, and hybrid optimization algorithms. The table highlights detection accuracy, energy efficiency, and improvements in packet delivery or delay metrics. While some techniques show high accuracy, others emphasize adaptive learning or trust-based mechanisms. However, limitations like computational complexity, lack of simulation detail, or applicability to only specific network types are also noted.

5.1 Discussion of trends, performance gaps, and innovative approaches

5.1.1 Several trends emerge from the literature

• Adoption of AI/ML: There is a clear trend toward using ML and DL approaches (e.g., Random Forest, XGBoost, LSTM) for detecting complex or evolving attacks in WSNs, particularly HWSNs.

• Hybrid Approaches: Solutions increasingly combine techniques such as cryptography, trust models, and ML to improve robustness and adaptability (e.g., GA-XGBoost [28], Fuzzy-GA-TLBO [22]).

• Distributed Detection Models: Many techniques favor distributed architectures for scalability and resilience, especially in large and dynamic networks.

• Focus on Energy Efficiency: With the rise of energy-constrained deployments, several models emphasize reduced computation and communication overhead (e.g., cluster-based and low-FDR solutions).

• Behavior-Based Monitoring: Trust-based and behavior-driven models (like WMC) are being used to detect malicious patterns without needing heavy computation.

5.2 Limitations and open challenges in blackhole attack detection

• Lack of Real-Time Validation: Many models perform well in simulation but may not adapt easily to real-time or field conditions.

• Limited Benchmarking: Datasets like WSN-DS are used repeatedly; however, these do not always reflect heterogeneous or real-world traffic conditions.

• Insufficient Focus on HWSNs: While some models claim applicability to HWSNs, many do not account for the diversity in node capability, energy availability, and communication range.

• Overhead from Advanced Techniques: Cryptographic and DL models, while accurate, can impose significant processing and energy burdens, especially on lower-tier nodes.

• Scalability Issues: Centralized models or those requiring heavy coordination (e.g., Fuzzy-GA-TLBO) face challenges in scaling to large networks.

5.3 Few novel methodologies for blackhole detection in heterogeneous wireless sensor networks, including deep learning and blockchain-based systems

• Ensemble Learning [40]: Adaptive ensemble models (e.g., Random Forest, XGBoost, Hoeffding Tree) offer high accuracy and resilience to concept drift in streaming data environments.

• LSTM-Based Detection [41]: DL with LSTM enables modeling of sequential behavior in routing, improving detection of stealthy attacks like blackholes.

• Blockchain-Based Detection [42]: Using distributed ledgers to verify node behavior adds tamper-resistance and traceability to network monitoring.

• Trust Degradation Metrics: Exponential trust reduction strategies help identify persistent malicious nodes by analyzing patterns of packet drops.

• Voting Mechanisms in Clusters: Consensus-based validation among cluster nodes enhances robustness and reduces FDRs.

5.4 Adaptability of existing protocols from homogeneous wireless sensor networks to heterogeneous models

Although many intrusion detection protocols were initially created for homogeneous WSNs, they are still not very adaptable to HWSNs unless they are changed. Networks with heterogeneous node capabilities are incompatible with protocols that assume uniform energy or bandwidth. Nonetheless, certain models can be easily adapted to HWSNs, particularly trust-based, cluster-based, and mobile agent-based architectures. For example:

• Cluster-based IDS can leverage high-power nodes as aggregators or monitors.

• ML models like ensemble learners can handle data from heterogeneous sources if designed with dynamic feature weighting.

• Distributed trust-based systems can be adapted for local anomaly detection across tiered nodes.

Overall, successful adaptation requires that protocols recognize node role and resource diversity, offload complex computation to capable nodes (high-power), and enable lightweight participation for energy-constrained nodes.

The framework overview for HWSNs integrates intelligent, time-sensitive attack detection mechanisms to support secure network communication against blackhole attacks. The network is structured into three major layers: The Sensor Network, Processing and Management, and Security and Attack Detection. In the Sensor Network layer, low-power sensor nodes with limited resources perform basic sensing tasks and transmit raw data to nearby high-power sensor nodes, which possess enhanced aggregation, processing, and communication capabilities. The high-power nodes aggregate the sensed data and forward it to the central sink node within the Processing and Management layer. The sink node collects behavior and communication patterns from multiple nodes and forwards the structured behavior data to a time-aware attack detection module in the Security and Attack Detection layer.

The detection module utilizes sequential behavior analysis to identify anomalous activities such as packet drops and suspicious routing patterns associated with blackhole attacks. Once an anomaly is identified, the information is passed to a response engine responsible for generating alerts, isolating compromised nodes, and updating routing paths to ensure secure network operation. The response engine then communicates routing decisions back to the sink node and the high-power nodes, maintaining the continuity and integrity of data transmission. This modular, learning-based detection architecture supports adaptability to evolving attack behaviors while preserving energy efficiency and meeting the real-time requirements of heterogeneous wireless sensor deployments. Figure 1 shows an overview of HWSN-based attack detection. Table 4 shows the design considerations for security protocols in HWSNs.

Figure 1. An overview for heterogeneous wireless sensor network (HWSN) based attack detection

Table 4. Design considerations