## 1 Introduction
In distributed detection, more than one sensor node in different locations acts as witness node, which avoids a possible stumbling block existing in centralized detection. In 2005, [PERSON] et al. [13] presented a distributed scheme called the Randomized Multicast Algorithm for replicas detection. In the presented scheme, the position information of sensor node is broadcast to \(\sqrt{n}\) random witness nodes for detection. [PERSON] et al. presented the other method called Line-Selected Multicast, in the presented scheme. The position information of sensor nodes is forwarded to witness nodes which are selected through the analysis of the routing topology. Meanwhile, geometric probability is applied for replica detection. The two protocols share one crucial feature in common, that is the witness nodes selected from networks for detection are random and distributed. In practice, it is hard to achieve the efficiency and security simultaneously in the design of a protocol due to the low success rate of detecting replicas or high communication cost. Therefore, how to select the witness nodes is a dilemma [12]. In particular, it needs a large amount of multi-hop routing overhead to transmit the related information to the witness node for detection in mobile sensor networks. How to reduce routing overhead is another dilemma. In our study, a novel distributed scheme is presented for detection of node clone attacks, which is called Encounter-based Sequential Hypothesis Testing protocol (ESHT). The basis of the ESHT protocol is the meeting of mobile nodes and the sequential hypothesis testing. In the ESHT scheme, \(\sqrt{N}\) random tracked nodes are pre-allocated to each mobile sensor, and every tracked node has \(\sqrt{N}\) witness nodes. When the tracked node and its witness node meet, the related location information is transmitted to the witness node, and the witness node judges whether the tracked node is a comprised node or a replica according to whether or not the measured speed \(\
u\) is over the system-configured \(\
u_{\max}\). However, this can easily cause many more wrong judgments, if the judgment is made based on only one such observation. To improve the precision, a sequence of speed samples is collected and the Sequential Probability Ratio Test is applied to provide upper bounds for the false positive and false negative rates. Therefore, if two witness nodes with same tracked node encounter, the related detection information is forwarded to one of them and the sequential hypothesis testing method is applied to detect the replica. One major advantage of the ESHT protocol is that the overhead of maintaining a traditional multi-hop routing path is reduced to achieve energy saving effects, and an equally important benefit of the ESHT protocol is that the mobile replicas can be found quickly with a few samples for each tracked node. The rest of the paper is organized as follows: we describe some of the related studies in Section 2. The Random Waypoint Mobility Model is introduced, which is adopted in our scheme as the mobility mode in Section 3. Section 4 illustrates the system environment, while the encounter-based protocol for detecting mobile clones is presented, which utilizes sequential probability ratio testing. Section 5 describes the theoretical analysis of security and efficiency, and shows our experimental investigation. Finally, the conclusions and guidelines for further research are drawn in Section 6.