Dual-stage machine learning approach for advanced malicious node detection in WSNs

Within wireless sensor networks (WSNs), a multitude of vulnerabilities can arise, particularly those originating from malicious nodes (MNs), which lead to compromised data integrity, network stability, and critical application reliability. Although security and energy efficiency remain critical, current MN detection methods are resource-intensive and time-consuming, rendering them unsuitable for constrained WSNs. Although machine learning-based methods excel at detecting MNs, they often incur significant time overhead owing to extensive data transmission and coordination, leading to increased latency and energy consumption within the network. This study introduces DSMND, a novel dual-stage MN detection scheme that harnesses machine learning to enhance MN identification in WSNs. The initial stage uses dynamic threshold detection and decision-tree algorithms at the cluster head (CH) level. This adaptive detection process optimizes CH resource levels, feature counts, and threshold values for efficient MN identification. When thresholds are exceeded, the second stage activates on the server side, employing an advanced MN detection model that seamlessly integrates a hybrid convolutional neural network and a random forest classifier to boost detection accuracy. Leveraging SensorNetGuard, a dataset with diverse node and network features, further enhances reliability. Extensive analysis shows that our scheme achieves up to 99.5 % detection accuracy at the CH level and nearly 100 % at the server side. The average execution time is 124.63 ms, making it 97 % faster than conventional methods. Additionally, DSMND reduces CH power consumption by up to 70 % and extends network lifetime by 2.7 times compared to existing methods. These results confirm the effectiveness of our approach for real-time detection and mitigation of MNs within WSNs.