Does a node only ban the IP address of a malicious node? or, there are other identities included. I mean, if a malicious user can generate multiple IP addresses to send fake tx, what will be the countermeasure then? Suppose, the other node, which will verify this tx, also a malicious attacker.
First of all, IP addresses are not stored in transactions nor can a node just "generate IP addresses".
How banning works is that nodes connect to each other via TCP sockets which are stream sockets so both nodes know the IP address of the other node. So when a node is banned, the banning node refuses to open a connection to the banned node. Nothing else is involved in banning, so if a node connects through another IP address (not by "generating IP addresses", that's not a thing, but rather by using proxies or VPNs), it would not be banned.