## 3 The Proposed Approach
### Anomaly Detection and Data Mining Techniques  
The foundation of our hybrid detection method relies on anomaly detection. This phase utilizes statistical models to establish a baseline of normal network behavior. The continuous monitoring of network traffic enables the early detection of deviations that may indicate potential security threats. The process begins with the establishment of a baseline through the statistical modeling of network parameters, including packet arrival rates, routing request frequencies, and hop counts. This baseline defines a profile of normal network operations based on historical data. Real-time monitoring then compares ongoing network traffic against this established baseline. Anomalies, such as unusual traffic patterns, unexpected spikes in data transmission rates, or irregular route requests, trigger alerts. The anomaly detection process can be mathematically represented as follows:  
\[AnomalyScore=\frac{|x-\mu|}{\sigma} \tag{1}\]  
where \(x\) is the observed value, \(\mu\) is the mean of the normal behavior, and \(\sigma\) is the standard deviation. Building upon initial anomaly detection, the method further refines its analysis through advanced data mining techniques. This stage involves clustering and classification algorithms to categorize nodes based on behavioral patterns, isolating those exhibiting signs of malicious activity. K-means clustering is employed to group nodes based on behavioral features such as packet forwarding rates and response times. The clustering process can be represented as follows:  
\[J=\sum_{i=1}^{k}\sum_{j=1}^{n}||x_{j}^{(i)}-\mu_{i}||^{2} \tag{2}\]  
where \(J\) is the objective function to be minimized, \(k\) is the number of clusters, \(x_{j}^{(i)}\) is the \(j\)-th node in cluster \(i\), and \(\mu_{i}\) is the centroid of cluster \(i\). Moreover, key features indicative of malicious behavior are extracted, and classification algorithms such as decision trees and support vector machines (SVMs) are used to classify nodes as legitimate or malicious. The decision tree algorithm can be represented as follows:  
\[E(T)=-\sum_{i=1}^{m}p_{i}\log_{2}(p_{i}) \tag{3}\]  
where \(E(T)\) is the entropy of the node set \(T\), and \(p_{i}\) is the proportion belonging to class \(i\). The final tier of our proposed method incorporates cryptographic techniques to verify the legitimacy of nodes flagged as suspicious. Public key infrastructure (PKI) and digital signatures serve as critical tools in this phase, facilitating the authentication of node identities and the integrity of their data transmissions. Nodes sign their transmissions using private keys, with verification performed using the corresponding public keys. This process can be represented as follows:  
\[Signature=Sign_{private}(H(m)) \tag{4}\]  
where \(H(m)\) is the hash of the message \(m\). Data integrity is ensured through the use of hash functions:  
\[H=SHA-256(m) \tag{5}\]  
In Equation (5), H(m) represents the hash value generated from the message mmm using the SHA-256 hash function. SHA-256 (Secure Hash Algorithm 256-bit) is a cryptographic hash function that produces a fixed-size 256-bit (32-byte) hash value from an arbitrary-size input message. This hash function is designed to be a one-way function, meaning that it is computationally infeasible to reverse the hash value in order to retrieve the original input message. The use of SHA-256 in our method ensures the integrity of data by providing a unique hash value for each message. If the data are altered in any way during transmission, the hash value computed at the receiver's end will differ from the original hash value, thereby indicating potential tampering. This mechanism is crucial in verifying the authenticity and integrity of the messages exchanged within the network, especially in the presence of malicious nodes attempting to disrupt communication. Node authentication is further reinforced through the use of certificates issued by trusted certificate authorities (CAs).