node 1(sender) Node 2 Node 3 Central node

(Intruder) (receiver)
register

register

register

store header
data sent
store header

ACK

store header

data sent intrusion

modified data
store header

send headers

send headers

matching process

multicast intruder
multicast intruder

4: store header 10: intrusion

8: store header

9: data sent
Node 2
node (Intruder)
1(sender)

1: register
13: send headers
2: register

7: ACK5: data sent 16: multicast intruder

11: modified data

15: matching process

6: store header
12: store header

3: register
14: send headers Central
node
Node 3
(receiver) 17: multicast intruder
 register

store sent and received headers

Node
Central node
send headers periodically

Data transfer

Multicast intruder Perform matching process

Suggest safe path