A method for processing an intrusion in a communication network including a plurality of node equipment, including a current node, which: discovers of a neighborhood of the current node, including assigning a resilience group to the neighboring node, according to at least one piece of information representative of a resilience level of the neighboring node to at least one type of attack; detecting an intrusion affecting at least one suspect node of the neighborhood of the current node; establishing a consensus concerning the at least one suspect node in a neighborhood by counting a number of resilience groups having detected the intrusion in the neighborhood of the suspect node and a total number of resilience groups represented in the neighborhood of the suspect node; and deciding to change a status of the suspect node based on a result of the consensus by comparison of both numbers.