Abstract: As routers in wired networks or access points in managed (infrastructure) wireless networks. Instead, each node participates in routing by forwarding data for other nodes and so, the determination of which nodes forward data is made dynamically based on the network connectivity. In addition to the classicrouting, ad-hoc networks can usefloodingfor forwarding the data. The objective is to find out the malicious node that performs the wormhole attack in network. We have assumed that the MANET consists of group of nodes. We have proposed an algorithm where intrusion detection has been done in a group based manner to take care of the wormhole attacks. The ABR routing protocol is used as the underlying network topology. A two layer approach is used for detecting whether a node is participating in a wormhole attack. The layered approach is introduced to reduce the load of processing on each group heads. From security point of view, this will also reduce the risk of a group head being compromised. In this study, presents a new, simple and bandwidth-efficient distributed routing protocol to support mobile computing in a conference size ad-hoc mobile network environment. Unlike the conventional approaches such as link-state, distance-vector distributed routing algorithms and TORA, the protocol does not attempt to consistently maintain routing information in every node. We employ an associativity-based routing scheme where a route is selected based on nodes having associativity states that imply periods of stability. In this manner, the routes selected are likely to be long-lived and hence there is no need to restart frequently, resulting in higher attainable throughput. To discover shorter routes and to shorten the route recovery time when the association property is violated, quick-abort mechanisms are incorporated into the protocol. The protocol is free from loops, deadlock and packet duplicates.