## 2 Related Work
In addition, it is a challenge for UWSNs to build a real and effective data set for IDS based on supervised learning algorithms that rely on training data sets. In addition to the trust model described above, the researchers also built IDS in other ways. The authors in [15] proposed a malicious attack detection algorithm based on DS evidence theory, which performs fusion evaluation on the suspicious probability of node temperature and packet loss rate to identify malicious nodes. However, the algorithm does not address the problem of how the neighbor node evaluates the suspicious probability of the suspicious node. The authors in [16] proposed a feature-based IDS to detect and mitigate routing attacks in UWSNs. Based on the local monitoring method, IDS is embedded in each sensor node to detect the malicious packet loss or tampering behavior of its neighbor nodes by comparing the difference between the input and output traffic. Moreover, this paper proposes a response scheme to the malicious node so that the neighbor node does not accept or send any data packets from/to the malicious node through a broadcasting alarm, thus isolating it from the whole network. However, the scheme does not consider the influence of an underwater acoustic channel on detection results. A detection technique for identifying underwater wormhole attacks is proposed in [17]. The round-trip time of a wormhole attack is shorter than that of normal links, which can be used to judge the existence of wormhole links. This method has certain requirements for a network structure and does not consider the serious spatiotemporal uncertainty of underwater acoustic channels. In [18], an anomaly location detection system in UWSNs is proposed. The use of false location estimation information will lead to the wrong location. Therefore, it is necessary to identify and ignore the relevant location data that have been maliciously tampered with. This paper designs an independent anomaly detection scheme for the sensor node and anchor node. The anomaly of a data packet sent from an anchor node to a sensor node is predicted by an auto-regression model. Due to the spatial correlation of sensor nodes, some neighboring nodes have similar movement patterns, so the anomaly index of each packet can be monitored by fuzzy logic at the anchor node. Routing protocols are essential for efficient data transmission. Most traditional UASN geolocation routing is designed using an OR paradigm [19]. [PERSON] et al. proposed the classical depth-based routing (DBR) [20] protocol, where the source node forwards the packet to the next hop with lower depth using the greedy criterion. The DBR protocol is based on multiple sinks, which increases PDR and reduces end-to-end latency. In [21], the authors proposed geographic and opportunistic routing based on Depth Adjustment Routing (GEDAR). Each node greedily forwards packets to the node with the lowest depth to reduce collisions. In addition, the Energy-efficient Cooperative Opportunistic Routing (EECOR) protocol is proposed in [22], which uses fuzzy rules to select the best forwarder to reduce packet collisions. Even the most reliable OR algorithms cannot operate efficiently in the presence of routing attacks in the network [23]. For example, a sinkhole attack can disrupt the route planning of the entire network, increasing the end-to-end delay and average energy consumption of data packets transmitted from the source node to the sink node, and reducing the delivery rate. Therefore, in order to improve the security of data transmission in UWSNs and reduce the impact of routing attacks on data transmission, this paper proposes a DBSCAN-based IDS for OR in UWSNs. Currently, there are few IDS dedicated to OR security in UWSNs. The research in [9; 10; 13] is designed for UWSNs based on hierarchical structures and cannot be applied to OR based on distributed structures. Other IDS proposed for distributed architectures cannot be directly applied to OR.