Figure 2

Working produces [38]. Figure 2 is working produces and the four sub-modules of Distributed Cooperative Mechanism (DCM). In the local data collection phase, an estimation table is constructed and maintained by each node in the network. Each node evaluates the information of overhearing packets to determine whether there is any malicious node. If there is one suspicious node, the detect node initiates the local detection phase to recognize whether there is possible black hole. The initial detection node sends a check packet to ask the cooperative node. If the inspection value is positive, the questionable node is regarded as a normal node. Otherwise the initial detection node starts the cooperative detection procedure, and deals with broadcasting and notifying all one-hop neighbors to participate in the decision making. Finally, the global reaction phase is executed to set up a notification system, and sends warning messages to the whole network.