A Two-Stage Machine Learning Model for Detecting Wormhole Attacks in Wireless Sensor Networks

Wireless Sensor Networks (WSNs) underpin many Internet of Things (IoT) applications, yet their open wireless medium, unattended deployment, and limited resources make them highly vulnerable to routing-layer attacks, particularly wormhole attacks that distort network topology without breaking cryptographic primitives. This paper proposes a two-stage Hybrid Machine-Learning Intrusion Detection System (Hybrid‑ML‑IDS) that combines unsupervised K‑means clustering with Random Forest (RF) classification to detect wormhole attacks using flow-level traffic features from the Wormhole at-tack‑Contr2 v2 dataset. In Stage 1, K‑means partitions normalized flows into latent clusters and derives structure-aware features—cluster identifier and centroid-distance statistics—which are concatenated with the original attributes. In Stage 2, a tuned RF classifier is trained on this enriched representation to discriminate normal from wormhole traffic. Experiments on 637,862 network flows (20 attributes plus a binary label, with approximately 76% at-tack and 24% normal instances) show that the proposed K‑means+RF model achieves 99.36% accuracy, 99.50% precision, 99.66% recall, 99.58% F1‑score, and a 1.60% false positive rate on the test set. Comparative evaluation against SVM, KNN, Decision Tree, Naïve Bayes, standalone RF, and XGBoost demonstrates that Hybrid‑ML‑IDS delivers superior wormhole detection capability with modest computational overhead, making it suitable for deployment at WSN gateways and cluster heads.