# Difficulties and Challenges of Anomaly Detection in Smart Cities: A Laboratory Analysis
## 2 Background  
Environmental sustainability, economic growth, technological progress and population growth are, among many others, new challenges that contemporary cities need to face [15]. In order to address these challenges, many projects propose to use technological elements to gather city data and interact with citizens and urban institutions and, in this way, create new services and explore efficient ways to improve existing ones. These projects are normally included in what is popularly known as smart city. Some popular smart city proposals are: the PlanIT Urban Operating System [16], Rio Operation Center [17], Ubiquitous city (u-city) [18] or SmartSantander [19; 20]. In order to gather street data, it is common that WSNs and other IoT elements are deployed in the urban landscape. These elements are generally installed and operated by city councils and several external providers. Generally, different providers use different technologies, which have to not only coexist in the same physical space, but also they have to share certain equipment (e.g., gateways, electrical grid) in order to function properly and deliver collected data to the smart city data center. From the data analyst perspective, this creates a scenario difficult to analyse: data are dynamic, heterogeneous, and can easily be compromised. Regarding security, the plethora of different technological solutions deployed in a smart city makes it impossible to install a reduced set of security countermeasures. Furthermore, security problems are especially important in WSNs. These networks are made of low-power devices that rely, in many cases, on multi-hop capabilities to build an extensive network and deliver packets from the most remote nodes to a base station. In addition, nodes are frequently battery-powered and, therefore, are designed also with restringed processing capacity to save power. The limited computational and energetic constraints of nodes are an obstacle to applying conventional computer network security countermeasures in WSNs. Additionally, in these networks, nodes become more vulnerable when they are placed in unprotected environments like streets. In these circumstances, attackers can easily capture nodes, access confidential information in their memory (e.g., cryptographic keys) and reprogram their behavior. Attackers may also benefit from the wireless nature of the communications to intercept the messages or to obstruct frequency bands to impede the proper reception of some packets. In [21; 22], the authors survey the most popular attacks on WSNs. Given the above, the task of data analyst or IT administrator is to ensure that the data collected in the server is trustworthy and reliable. This means, on the one hand, that external providers must apply proper security mechanisms to their networks, but it also means that sound anomaly detection mechanisms must be put in place. However, this anomaly analysis is far from simple and requires sophisticated techniques, as we show below. A lot of research has been carried out to tackle the anomaly detection problem in wireless sensor networks. In [23], the authors survey the different techniques and propose a categorization based on the model learned by each algorithm. On the one hand, statistical techniques use a density distribution representing the behaviour of the data. Once the parameters of the distribution are estimated, anomalies can be detected as data points with low likelihood. On the other hand, non-parametric techniques do not rely on the availability of parameters describing the data behaviour. Some of the best known non-parametric techniques are rule-based approaches, data clustering or machine learning. Rule-based approaches use signatures (or attack patterns) of previously known attacks to identify anomalies. In data clustering, data are grouped into clusters according to some measurement. Data points encountered outside these clusters are labeled as outliers. Finally, machine learning techniques generate a data model that can be used to identify outliers.