Abstract: This paper presents a method based on the clustering of the abnormal nodes report mechanism of networking malicious behavior selection algorithm. On the basis of node clustering analysis, through the feature sampling construction characteristics of the node values, and according to the actual situation taken to increase the key characteristic parameters of malicious node behavior to carry on the accurate localization; then constructs the cluster mechanism, take the clustering partition continue to suspected nodes aggregate, to further reduce the misjudgment; rules for the prosecution of the definition of malicious nodes, the partition selection further reduces the normal nodes appear in the malicious node in the collection probability and improve the algorithm's perception of malicious nodes. Simulation results show that compared with the commonly used PSO algorithm and the SDR algorithm, the algorithm of the malicious node detection rate, and can effectively avoid tampering of malicious nodes to transmit data, has a strong practical value.