I think Sybil nodes are changing their own identity in the network frequently. Also they use multiple ip address, MAC address, so u need to work with ip and mac of those nodes.

Thank you for your suggestion. But as I know sybil nodes are the nodes, controlled by a malicious node. This malicious node is able to create some fake nodes, those nodes are sybil nodes and Sybil nodes are controlled by a malicious node. Sybil node itself can not change their own identity.

OK u need to detect malicious node first for these u can use trust based technique for finding trust value of each node and then based on some threshold u can detect those malicious nodes.