The importance of Internet of Things (IoT) lies in its far-reaching impact on our daily lives, so it is prone to risks. Therefore, security measures must be considered before deploying IoT networks to avoid intrusions. Most of the relevant work in the literature have been dedicated to improve the intrusion detection system and security systems. However, most current Intrusion Detection System (IDS) approaches suffer from the lack of a proper testing procedures before an actual attack. In this paper, we propose a low-cost solution to detect malicious nodes by ensuring that witness nodes work properly. We propose an effective automatic detection strategy for the test sequence and selection of witness nodes. The goal is to test the automatic correct actions of a witness node when an attacker launches a replication or cloning attack. We present a case study of replication attacks in IoT and use the CupCarbon simulator to evaluate our approach and demonstrate how a compromised node could be detected among witness nodes.