The network contains wsn in clustered architecture with a base node this sensors

are stationary with unique identity. In homogeneous wsn all the nodes have same
configuration such as same processor,sensor, the amount of battery power
transmission capacity and equal storage capacity is considered for this work and
this nodes are assumed to be tamper resistant.The sensor node can be captured and
can be reprogrammed accordingly to the need of the adversary, which are later
deployed randomly to cover the region of interest evenly. The location and the
coordinate are not known To the nodes. The nodes use omnidirectional antenna to
communicate with each other with wireless radio. The cluster consists of 5-10% of
total nodes which is optimal. Cluster heads are selected to cover the entire region
uniformly and have maximum energy level among members. The network area Is a 2D
region. There are two types of attack models that are discussed. In the first model
the adversary captures the sensor nodes in the network and Then he access the
information and reprogram's the node. Later This modified nodes are deployed
throughout the network and each malicious node present multiple sybil identities
in the network as shown in fig1.
Many existing algorithms perform poorly in detecting this kind of attack and
sometimes not even detect s single sybil node so This attack model is both difcult
and time consuming for an adversary as it involves capturing, decoding
reprogramming and deploying several nodes.In the second attack model, the adversary
captures minimal set of nodes from the network and Then accesses the
information and the application program to modify. The modifed nodes deployed into
the network are malicious nodes. Each of these malicious nodes have multiple Sybil
identities in the network. The malicious nodes are normal sensor nodes and are
stationary, not mobile. So the each nodes joins with one or more cluster head
(Table 1). So in this paper they considered the second attack model for detecting
the sybil ID'S as the malicious node dose not become the cluster head using the
sybils identity but the node joins to single or multiple or all the cluster
simultaneously of the wsn. And the probability of detection rate is high by the
sink if the malicious node acts as the cluster head as shown in the fig2.