## 3 Background and Preliminaries
### Challenges of Anomaly Detection in Wireless Sensor Networks  
The main challenge of anomaly detection in WSN is how to achieve high detection effectiveness with minimum energy cost. In other words, the aim is to provide high detection effectiveness and high efficient resources utilization at the same time during the design of anomaly detection solution. Many anomaly detection solutions have been proposed in the literature for traditional networks systems. However, the nature of sensor data and the context of WSNs make these solutions unsuitable to be applied for WSNs. The challenges that should be considered during the design of suitable anomaly detection solution for WSNs are summarized in the following paragraphs:  
_Computational and Storage Resource Limitation_: WSNs are made up of cheap sensors which are very resource constrained in terms of memory, and processing. The process of anomaly detection in WSN requires the utilization of the computational and storage resources for processing data in real time.  
_Communication Overhead_: Some traditional anomaly detection solutions are built based on the centralized approach in which the data is collected from sensors and sent entirely to be processed by the cluster head or the base station. However, the cost of data transmission is several orders of magnitude higher than the cost of data processing [1]. In addition, the design of distributed online anomaly detection models also requires the communication between sensor nodes. As a result, the energy consumption is affected by the amount of communication overhead incurred by the distribution process.  
_Dynamic Network Topology Change_: The mobility of nodes in some WSN applications and the communication failures increase the network topology change. This change negatively affects the validity of the normal reference model used by the anomaly detector.  
_Network Heterogeneity_: Sometimes, the application of WSN needs to use different types of nodes or assign different jobs to different nodes. In addition, the current sensor nodes may be equipped with many sensors for measuring different environmental phenomenon at the same time. Another aspect of heterogeneity appears when the data collected by sensors obey to different data distributions which make the anomaly detection model, which was learned using one type of distributions, not capable to cope with such kind of heterogeneity.  
_Dynamic Streaming Data_: The dynamic streaming nature of sensing data is another challenge. Generally, there is no prior knowledge available to build the normal distribution of sensing data (normal reference model). Even if this knowledge is available in a specific point of time, it is insufficient for the future because of the dynamic streaming that may change the nature of distribution over the time.  
_Network Scalability_: Some WSNs applications expand over the time such that some nodes may be added to the network. As a result, the old normal reference model which was built for the network needs to be updated. The high false alarm rate resulting from the expansion poses a challenge to anomaly detection. Besides, the large amount of data produced due to network size expansion is also a challenge for real time detection [9].  
_High Dimension Data_: Besides the possible increase of network size, the dimensionality of the collected data may also increase. The increase of data dimensions incurs a higher computational cost that drains the energy and memory of sensors. As the anomaly detection process depends on the data measurements, the increase of data dimension becomes a problem for efficiency aspect of anomaly detection.