This paper discusses one of the route security problems called the black hole attack. In the network, we can capture some AODV route tables to gain a rank sequences by using the FP-Growth, which is a data association rule mining. We choose the rank sequences for detecting the malicious node because the rank sequences are not sensitive to the noise interfered. A suspicious set consists of nodes which are selected by whether the rank of a node is changed in the sequence. Then, we use the DE-Cusum to distinguish the black hole route and normal one in the suspicious set.
In this paper, the FP-Growth reflects an idea which is about reducing data dimensions. This algorithm excludes many normal nodes before the DE-Cusum detection because the normal node has a stable rank in a sequence. In the simulation, we use the NS2 to build a black hole attack scenario with 11 nodes. Simulation results show that the proposed algorithm can reduce much vain detection.