TBAR-IoT: A Lightweight Trust-Based Adaptive Routing Protocol for Secure IoT Networks under Blackhole Attack

2.1 Proposed work

To mitigate blackhole attacks, we present the TBAR-IoT protocol, designed to address the challenges typical of IoT ecosystems, namely dynamically changing topology, constrained power resources, and heterogeneous routing behavior. TBAR-IoT uses a lightweight multiplicative trust model that estimates node reliability dynamically from five locally observed factors, namely interaction recency, interaction frequency, interaction duration, residual energy and PFR, in order to identify trustworthy nodes. The major innovations provided by TBAR-IoT are:

(1) Dynamic Performance Optimization: TBAR-IoT continuously adapts to network conditions by choosing reliable nodes based on dynamic trust measures such as forwarding reliability and node activity characteristics.

(2) Lightweight Multiplicative Trust Model: TBAR-IoT uses a simplified trust computation scheme based on the weighted geometric mean of five behavioral parameters with a fixed-weight threshold activation. The weights are fixed by design rather than learned, since on-node training is not feasible under the memory and energy budgets of constrained IoT devices; no claim of learned behavior is made.

(3) Advantage over Conventional Protocols: TBAR-IoT outperforms legacy AODV, LDTS, and Trust-AOMDV in terms of packet delivery ratio (PDR), energy consumption per delivered packet, and robustness.

(4) Explicit Blackhole Detection and Mitigation: a deliberate drop is distinguished from loss caused by collision, mobility, link failure or congestion by comparing what a node observes with what its other neighbors observe, and a confirmed attacker is excluded both locally and by its neighbors for a bounded hold-down period after which it may recover.

2.2 Weighted multi-parameter trust model

The reliability of nodes in dynamic IoT networks varies over time due to frequent topology reconfiguration, device heterogeneity, and random node failures. TBAR-IoT employs a weighted multi-parameter trust computation mechanism that processes real-time behavioral and environmental signals.

2.2.1 Mapping trust metrics in Internet of Things networks

TBAR-IoT computes the trust value of each node using five key parameters: interaction recency, communication frequency, interaction duration, residual energy, and PFR. The mapping is summarized in Table 2.

Table 2. Trust and routing parameters in Trust-Based Adaptive Routing for IoT (TBAR-IoT)

Each neighbor is entered at the minimum trust value, T(n_i, n_j) = 0, and must earn trust through observed forwarding behavior; the value is then updated dynamically as the neighbor participates in forwarding. The trust update process is triggered whenever a new communication event occurs or the topology changes. Because every neighbor starts from the same value, selection at network start is resolved by the energy and recency tie-breaks of Algorithm 2 rather than by trust.

2.2.2 Trust computation

Trust in TBAR-IoT is directional: node n_i computes its own trust in each neighbor n_j from its own observations, and routine operation exchanges no trust value between nodes. The neighbors that n_i and n_j have in common are asked for their own observations only after a node has already failed the test of Eq. (3), as specified in Algorithm 3. The evaluation rests on a vector of five behavioral observations that n_i holds about n_j, as shown in Eq. (1):

$f\left(n_i, n_j\right)=\left(P_1, P_2, P_3, P_4, P_5\right)$       (1)

where, P₁ is the interaction recency, P₂ the interaction frequency, P₃ the interaction duration, P₄ the residual energy level and P₅ the PFR, each normalized to the unit interval as defined below; P_i(n_i, n_j) denotes the value of P_i that n_i observes for n_j.

1.png

Figure 1. Threshold activation function with trust parameters

In Figure 1, the parameters P₁, P₂, P₃, P₄, P₅ carry the weights w₁, w₂, w₃, w₄, w₅ as exponents and are combined at a product node before the threshold activation. Here, P_i denotes the normalized trust parameters and w_i the weight of each parameter. The individual trust parameters are defined as follows: P₁ = 1 − min(Δt / T_w, 1), where Δt is the time elapsed since the last interaction with the neighbor and T_w is the observation window, so that P₁ = 1 for an interaction in progress and falls linearly to 0 once a full window has passed without contact; P₂ = Frequency of interactions from n_i to n_j, where i ≠ j and i, j ∈ {1, 2, ..., N}, N being the number of nodes in the network, normalized as P₂/P_2max where P_2max is the highest observed frequency among neighbors; P₃ = Total duration of interactions, normalized as P₃/T_w over the same observation window T_w; P₄ = Residual energy level, normalized as E_remaining/E_initial; and P₅ = PFR. The corresponding weights are equal, w₁ = w₂ = w₃ = w₄ = w₅ = 0.2, so that their sum is unity. For each node n_i, this function activates for all neighboring nodes, i.e., for all n₁, n₂, ..., n_i-1 and n_i+1, n_i+2, ..., n_N, as shown in Eq. (2):

$x=\prod_{i=1}^5 P_i^{w_i}$        (2)

This value is passed through the threshold activation function φ, as shown in Eq. (3):

$Z=\varphi(x)$      (3)

where, the activation function is defined as shown in Eq. (4):

$Z=\left\{\begin{array}{cc}0, & \text { if } x<\theta \text { (node untrusted) } \\ 1, & \text { if } x \geq \theta \text { (node trusted) }\end{array}\right.$      (4)

The stored trust value is then moved towards the observed evidence x by a fixed fraction of the difference between them, as given in Eq. (5):

$\begin{gathered}T_{\text {new}}\left(n_i, n_j\right)=T_{\text {old}}\left(n_i, n_j\right)+\eta\left[x-T_{\text {old}}\left(n_i, n_j\right)\right], \\ 0<\eta<1\end{gathered}$        (5)

The five parameters are weighted equally, w₁ = w₂ = w₃ = w₄ = w₅ = 0.2. Equal weighting is a deliberate design decision rather than a fitted result: the model provides no principled basis on which to rank one observation above another, so the symmetric assignment is adopted and no parameter-specific weight has to be estimated, tuned or defended. With all weights equal, Eq. (2) reduces to the unweighted geometric mean of the five parameters. The discriminating power of the scheme therefore comes from the form of the aggregation rather than from the choice of weights, which is what the following four properties establish. Aggregation is multiplicative rather than additive, and this choice gives the trust function four properties that a weighted sum does not possess. First, since every P_i lies in [0, 1] and the weights sum to unity, the aggregate score satisfies x ∈ [0, 1]; the activation threshold can therefore be placed in the interior of the range and is set to the midpoint, θ = 0.5, a value attainable from both directions. Second, x is strictly increasing in every P_i whenever the remaining parameters are positive, so for each i there exist parameter vectors at which a change in P_i alone changes the activation outcome; no parameter is ignored by the decision. Third, the aggregation is non-compensatory: x = 0 if and only if the smallest of the five parameters is 0, so a node that forwards no packets receives an aggregate score of zero however favorable its contextual indicators appear. The same property applies in the opposite direction, which is why the boundary conditions stated below exempt a neighbor with no observation of some parameter from evaluation rather than scoring it at zero. A weighted sum offers no such guarantee, because a node scoring highly on four parameters can offset a zero on the fifth. Fourth, by the inequality of arithmetic and geometric means the multiplicative score never exceeds the corresponding weighted sum, with equality only when all five parameters are equal, so the scheme is uniformly more conservative than additive aggregation. Packet dropping consequently requires no separate bias term and no externally signalled drop event: a node that drops forwarded traffic exhibits a falling P₅, which lowers x directly; the observation window over which P₅ is measured and the procedure that separates deliberate dropping from benign loss are specified later in this section and in the Nomenclature. P₁ decreases with the time elapsed since the last interaction, so a higher P₁ indicates more recent contact and therefore more current evidence. For implementation the test x ≥ θ is equivalent to testing whether the product of the five parameters is at least 0.03125, the fifth power of θ, so no root extraction is required and the decision costs four multiplications and one comparison per neighbor.

The update rule of Eq. (5) gives the stored trust value four properties that the original increment did not possess. Since T_new is a convex combination of T_old and x with 0 < η < 1, and both T_old and x lie in [0, 1], the updated value also lies in [0, 1]; the range declared in the Nomenclature is therefore respected by construction and no separate normalization or upper bound is required. The update is signed: when the observed evidence exceeds the stored value the trust rises, and when it falls below the stored value the trust falls, so misbehavior is penalized by the same rule that rewards cooperation and no additional penalty term is needed. Because the correction is proportional to the difference, the stored value tracks the current evidence rather than remaining at a historical value; the influence of any past observation is reduced by a further factor of (1 − η) at each subsequent update, so the metric forgets past behavior geometrically as new observations arrive. Finally, a node whose behavior improves sees x rise again and its trust recovers along the same trajectory, so exclusion is not permanent. For example, a node holding T = 0.75 whose forwarding degrades so that x falls to 0.55, which is still above θ and therefore still admissible, is updated to 0.75 + 0.5(0.55 − 0.75) = 0.65 at the next observation, then to 0.60 and 0.575, converging towards 0.55, so that it is progressively deprioritized by Algorithm 2 without being excluded. If it resumes forwarding and x returns to 0.80, the value climbs back from 0.575 through 0.6875 and 0.7438 towards 0.80. A node whose score falls below θ is not smoothed down gradually in this way: Eq. (3) marks it untrusted at once and Algorithm 3 is invoked on it. The update rate is set to η = 0.5, which weights the stored history and the current observation equally. The resulting trust value is stored in the Route Cache (RC) to guide routing decisions in the IoT network.

Two boundary conditions complete the definition. First, each normalized parameter is clipped to [0, 1], so that an interaction duration exceeding the observation interval, or a frequency equal to the observed maximum, cannot carry the score outside the unit interval. Second, because the aggregation is non-compensatory, a neighbor for which no observation of some parameter yet exists within the current window would otherwise receive x = 0 merely for being new. The activation of Eq. (3) is therefore evaluated only once at least one observation of every parameter has been recorded within T_w; until then the neighbor is marked unevaluated, is not subject to Algorithm 3, and is ordered by the energy and recency tie-breaks of Algorithm 2.

The two quantities play distinct roles. The aggregate score x of Eq. (2) is the instantaneous evidence and, through Eq. (3), governs admission: a neighbor whose current behavior places it below θ is not used as a next hop. The stored value T of Eq. (5) is the smoothed history and governs preference: among admitted neighbors, Algorithm 2 selects the one holding the highest T. Admission therefore responds immediately to a change in behavior, while the ranking remains stable against a single unrepresentative observation.

For example, suppose node n₁ observes P₁ = 0.9, P₂ = 0.8, P₃ = 0.6, P₄ = 0.8 and P₅ = 0.95 for neighbor n₂. The product of the five parameters is 0.9 × 0.8 × 0.6 × 0.8 × 0.95 = 0.3283, and x is its fifth root, x = 0.80 ≥ θ, so Z = 1 and n₂ is accepted. Consider instead a neighbor n₃ that advertises attractive routes and therefore presents favorable contextual parameters, P₁ = 0.9, P₂ = 0.9, P₃ = 0.6 and P₄ = 0.95, but forwards almost nothing, P₅ = 0.05. The same computation gives a product of 0.02309 and x = 0.47 < θ, so Z = 0 and n₃ is rejected. Note that n₃ is excluded despite matching or exceeding n₂ on all four contextual parameters, and that no packet-drop event has been signalled to the trust function: the activation outcome is determined by the trust parameters themselves. In the limiting case of a node that forwards nothing at all, P₅ = 0 gives x = 0, so rejection is immediate and independent of the remaining four parameters.

A falling PFR is a symptom rather than a diagnosis: a node may fail to forward because it is dropping traffic deliberately, but equally because of a collision, because the link broke, because it moved out of transmission range, or because its queue overflowed under load. TBAR-IoT separates these causes with three questions put to W, the neighbors that n_i and n_j have in common, and answers all three from the forwarding observations the trust model already records for P₅. The first asks whether n_j is receiving at all: if any member of W holds too few observations of n_j to judge it, its packets are not reaching n_j, so the loss lies on the link rather than in n_j and is attributed to collision, mobility or link failure. The second asks whether n_j forwards for anyone: a node that still forwards for at least one member of W is not dropping indiscriminately and is left unclassified. The third asks whether the neighborhood itself is working: if the members of W are not forwarding for one another either, the loss is attributed to congestion or overload, so a benign but heavily loaded node is not classified as malicious. Only a node that receives packets and forwards for no one while its neighborhood forwards normally is classified as a blackhole, and it is then excluded both by n_i and by the neighbors n_i informs. The members of W are asked once, at the point where a node has already failed the test of Eq. (3), and never periodically, so the exchange adds no standing overhead. The procedure is stated in Algorithm 3 and its parameters are listed in the Nomenclature. Every exit path other than the final classification leaves the neighbor unclassified, so the procedure fails towards inaction rather than towards a false accusation.

2.2.3 Trust evaluation, routing and blackhole detection algorithms

The notations and parameter values used in this section are summarized in the Nomenclature at the end of the paper. Building on the trust model described above, TBAR-IoT operates through three procedures executed at each node n_i. Algorithm 1 evaluates and updates the trust value of every neighbor n_j from the five observed parameters using Eqs. (2)-(5). Algorithm 2 uses these trust values to select the next intermediate node on a route, resolving ties by residual energy and then by interaction recency. Algorithm 3 is invoked whenever Algorithm 1 marks a neighbor as untrusted; it separates deliberate packet dropping from losses caused by collisions, mobility, link failure or congestion before a node is classified as a blackhole and blacklisted.

This paper examined the performance of the proposed TBAR-IoT protocol and compared it with the existing routing methods AODV, LDTS, and Trust-AOMDV. The performance indicators used for the comparison were PDR, energy consumption per delivered packet, average end-to-end delay, and resilience to blackhole attacks.

The simulation results show that TBAR-IoT consistently achieves a higher PDR than both baseline and trust-based schemes. Under blackhole attack, the PDR of AODV decreases sharply because it has no trust awareness. TBAR-IoT, by contrast, maintains consistent packet delivery by isolating malicious nodes dynamically through behavioral trust assessment. Compared with LDTS, TBAR-IoT adapts better to varying network conditions, since LDTS relies on hierarchical trust structures that are sensitive to topology change. Trust-AOMDV improves delivery through multipath routing, but the additional routing overhead reduces its effectiveness in dense IoT settings. This same multipath overhead also explains why Trust-AOMDV, despite its relatively strong PDR, does not translate into energy savings; LDTS remains more energy-efficient than Trust-AOMDV precisely because its clustering limits control-message exchange, even though it delivers fewer packets successfully. TBAR-IoT reduces this trade-off in the evaluated scenario, combining the highest delivery ratio with the lowest energy cost per delivered packet among the protocols compared. The lowest average end-to-end delay was also recorded for TBAR-IoT, which is consistent with the reduced number of failed transmissions and route rediscoveries that follow from trust-aware next-hop selection. These observations support the conclusion that routing decisions based on adaptive behavioral trust can significantly improve network reliability without a corresponding increase in resource cost.