Packet dropping and modification are common attacks that can be launched by an adversary todisrupt communication in wireless multihop sensor networks. Many schemes have been proposed to mitigateor tolerate such attacks, but very few can effectively and efficiently identify the intruders. To address thisproblem, we propose a simple yet effective scheme, which can identify misbehaving forwarders that drop ormodify packets. In Wireless Sensor Network, sensors at different locations can generate streaming/ discretedata, which can be analyzed in real-time/Non real-time to identify events of interest. A sensor node is oftenplaced in an unfriendly environment to perform the monitoring and data collection tasks. When it isunfriendly environment, node may subject to compromise. After compromising one or multiple sensor nodes,an adversary may launch various attacks to disrupt the in-network communication. In this paper, twoalgorithms are proposed, firstly, one node categorization algorithm to identify nodes that are droppers ormodifiers for sure or suspicious droppers or modifiers. As the tree structure dynamically changes every timeinterval, behaviors of sensor nodes can be observed in a large variety of scenarios. The information of nodebehaviors has been accumulated. Secondly, the sink will periodically run heuristic ranking algorithms toidentify most likely bad nodes from suspiciously bad nodes. And an extension to identify modified packetsusing Message Authentication Code.