## 1 Introduction  
Underwater Wireless Sensor Networks (UWSNs) are mainly composed of ground base stations, surface sink nodes, and underwater sensor nodes, which can complete military and civilian applications such as ocean monitoring, resource exploration, and target tracking. They are important technologies for countries to develop and utilize marine resources. Faced with a massive increase in the types and volumes of data, UWSNs need to transfer data to the data center efficiently, reliably, and securely. However, the propagation speed of an underwater acoustic signal is about \(1.5\times 10^{3}\) m/s, which is five orders of magnitude smaller than the existing radio signal with a long propagation delay (3 \(\times\) 10\({}^{8}\) m/s). Compared with radio communication, underwater acoustic communication has serious temporal and spatial uncertainty. Node positions change dramatically due to factors such as wind, waves, and ocean currents, which increase the probability of packet loss caused by packet conflict. Moreover, underwater acoustic channels have a serious multipath and Doppler effect, high transmission loss, and high environmental noise, which also causes high error rates and high packet loss, to some extent. These features pose great challenges for reliable data transmission [1; 2]. In this regard, opportunistic routing (OR) protocols have been proposed to solve the problem of the poor and variable quality of underwater acoustic channels and to improve data transmission in UWSNs [3; 4]. OR makes full use of the broadcast features of UWSNs by forwarding packets to a group of nodes (candidate node set) at a time, from which the node with the highest priority is selected as the relay node according to a specific algorithm. Therefore, OR can effectively improve the reliability and energy efficiency of UWSNs in the sparse sensor node deployment environment, and alleviate the routing void problem. However, the open underwater acoustic communication environment and unsupervised characteristics make sensor nodes in UWSNs vulnerable to malicious attacks, such as a sinkhole attack. It tampers or disrupts routing by attracting traffic so that packets cannot reach the sink node through the shortest path, thus affecting the efficiency and security of data transmission. Therefore, research on secure data transmission is very important for UWSNs. Many security mechanisms proposed for UWSNs can effectively defend against malicious attacks. Key management and identity authentication can effectively prevent the disclosure of sensitive information and prevent malicious nodes from invading the network [5; 6]. As the second protective wall, the intrusion detection scheme (IDS) can effectively address the failure of the prevention mechanism and help networks to identify internal attackers. Intrusion detection research on Terrestrial Wireless Sensor Networks (TWSNs) has gained increasing attention [7]. However, these methods cannot be directly applied to UWSNs due to the complexity of underwater acoustic channels (serious multipath effect, large environmental noise, large time delay, etc.) and the hardware equipment limitations of underwater nodes. Therefore, the design of IDS should be based on the characteristics and limitations of UWSNs, and consider the communication, memory, and energy consumption of the detection system, as well as the detection accuracy. Moreover, suitable detection schemes for different network functions should be researched. In the past decade, the research of IDS based on trust management [7; 8; 9; 10; 11; 12; 13] in UWSNs has achieved some achievements; however, there are still some defects. (1) The weight of each piece of trust evidence in the trust management mechanism based on the weighting algorithm is usually determined empirically, so it cannot be assumed to be optimal. (2) IDS based on a supervised learning classification algorithm [9] can effectively distinguish between legitimate nodes and malicious nodes, while such methods require sufficient training samples.