Mobile ad hoc networks offer very interesting perspectives in wireless communications due to their easy deployment and their growing performances. However, due to their inherent characteristics of open medium, very dynamic topology, lack of infrastructure and lack of centralized management authority, MANET present serious vulnerabilities to security attacks. In this paper, we propose an intrusion detection scheme based on extended finite state machines (EFSM). We provide a formal specification of the correct behavior of the routing protocol and by the means of a backward checking algorithm, detect run-time violations of the implementation. We choose the standard proactive routing protocol OLSR as a case study and show that our approach allows to detect several kinds of attacks as well as conformance anomalies.