NOVELTY - An event received by a node, from a neighboring node, in the network is evaluated, to determine whether the event satisfies predetermined security test. The entry associated with the neighboring node in the topology data is modified, if the event fails the security test. An alarm notification indicates the security failure of the node, is sent to other nodes of the network. USE - For security management of node in data processing network (claimed). ADVANTAGE - Storage and processing requirements in each node of the network are minimized by each node employing a localized neighborhood watch for generating a warning of malicious behavior based on observation of neighboring nodes, and by each node sharing with other node information relating to malicious behavior experienced.