Abstract: The topology of sensor network routing changes dynamically, the boundary between normal and abnormal is blurred, the sources of error information are complex, and traditional intrusion detection is difficult to distinguish between real intrusion and temporary faults. To address this challenge, a novel intrusion detection method for anomalous nodes in sensor networks based on roughness improved bee colony algorithm is proposed. This method aims to accurately identify and distinguish abnormal behavior, reducing the false alarm rate caused by system dynamics. Roughness function is introduced to extract and screen intrusion data feature values of sensor network nodes, intrusion detection objective function is constructed using coefficient matrix, bee colony algorithm is improved with information entropy, new fitness function is constructed, important features are distinguished, real intrusion and temporary system faults are identified, and intrusion detection of abnormal nodes in the network is achieved. The test results show that the average accuracy of this method for detecting abnormal node intrusion is 96. 0% , the average missed detection rate of node intrusion is 1. 3% , and the average detection delay is 0. 25 s. The proposed method can effectively cope with the detection difficulties caused by the dynamic changes in the routing topology of sensor networks, accurately distinguish between real intrusion and temporary system failures, and demonstrate the advantages of high accuracy, low missed detection rate, and short detection delay in detecting abnormal node intrusion, providing reliable guarantee for the safe and stable operation of sensor networks. 

Key words: improve the bee colony algorithm, sensor network, roughness function, abnormal nodes, intrusion detection