## 1 Introduction
In view of the scarcity of relevant data sets of UWSNs, they can only be stuck in the simulation stage. (3) Traditional schemes usually consider that malicious nodes can only perform one attack mode. This paper considers a hybrid attack mode, which is different from the traditional attack scheme. A hybrid attack is a malicious node embedded with multiple attack modes, and can switch between the two over a period of time. Therefore, in order to remedy the defects of the above detection mechanism and enhance the data transmission security of OR in the distributed structure of UWSNs, this paper proposes an IDS based on DBSCAN, an unsupervised clustering algorithm in machine learning [14]. Firstly, the energy consumption and forwarding rate of nodes are selected as indicators according to the behavior characteristics of common routing attacks. However, in the actual underwater scene, environmental noise can affect the judgment of node types and produce swamping and masking effects. For example, changes in the underwater environment may create weak acoustic communication links, resulting in low-quality interaction between sensor nodes, and unstable energy consumption and forwarding rates. Therefore, link quality information is taken as the third indicator. Second, the nodes in the candidate forwarding set work in similar environments and tasks, so their performances are somewhat similar. According to this feature, the majority of legitimate node samples are clustered by the DBSCAN clustering algorithm, and a few abnormal samples (noise points) caused by the malicious behaviors of nodes or weak link connections are excluded from the cluster, so as to identify abnormal samples. Then potential malicious nodes and channel abnormal nodes in abnormal samples are distinguished according to the underwater acoustic link information. Finally, in order to reduce the impact of the DBSCAN false positive rate on DOIDS detection accuracy, this paper defines a decision function according to the time decay function to determine whether the node with potential malicious behavior is a malicious node. The final analysis shows that our work is helpful in reducing the negative impact of routing attacks on OR-based data transmission. The main contributions and novelty of this paper include:  
1. Based on the underwater OR protocols, we design a DBSCAN-based IDS to enhance the security of data transmission in UWSNs. The DBSCAN clustering algorithm is an unsupervised learning algorithm that can be used for anomaly detection without sufficient and complete training samples. It is suitable for complex and changeable underwater environments. 2. We defined a novel decision function according to the time decay function to make a final decision on the node type (legitimate or malicious), so as to reduce the influence of the DBSCAN false positive rate on DOIDS detection accuracy. The rest of this paper is organized as follows. Section 2 investigates and analyzes previous work on the IDS based on the trust model as well as others and the OR protocol. In Sections 3 and 4, the DOIDS and its related models are introduced in detail. The simulation and evaluations are explained in Section 5. Finally, Section 6 concludes this article.