In a WSN, there are two ways to find out inconsistency of object (i.e., an outlier) single-sensing find threat and multiple-sensing find threat. In the single-sensing find threat, the outlier can be successfully find threat by a single user sensor node. On the area, in the multiple-sensing find threat , the outlier can only be find threat by multiple cooperating user sensor nodes .In some applications, the sensed information provided by a single user sensor node might be poor for recognizing the attacker. It is because particular user sensor nodes can only sense a portion of the outlier. For example, the location of an outlier can only be determined from at least three user sensor nodes sensing. The goal of using a layered interface model is to minimize computation and the overall time required to find irregular events. The time required to find anomaly an intrusive event is important and can be minimized by filtering the communication overhead among different layers. This can be achieved by making the layers independent and self-handle to manage to block an attack without the need of a central decision-maker. Every layer in The MLMD framework is learn and adopt separately and then deployed sequentially. We planned 4 protocols that related to the four attacks groups mentioned in the map data.