Abstract: Mobile Ad hoc networks(MANET) arc highly vulnerable to be attacked and difficult to deploy complicated safe protocols and algorithms due to the open medium, dynamically changing network topology,lack of centralized monitoring and management point, and limited resources. To detect efficiently anomaly behaviors in MANET, this paper proposed a online clustering and detective cost based anomaly detection scheme for MANET, TCDC. In this scheme, TCDC firstly analyzes and deals with access behaviors in single node using online clustering based on access behaviors, and then validates farther access behaviors by cooperative detection based on detective cost among different nodes. Simulation results show TCDC can efficiently detect anomaly behaviors in MANET with less resource consumption.

Key words: Mobile ad hoc networks, Online clustering, Detective cost, Anomaly detection