# Difficulties and Challenges of Anomaly Detection in Smart Cities: A Laboratory Analysis
## 2 Background
This model can be created from labeled data (data tagged as normal or abnormal) when supervised learning is used. Conversely, when using unsupervised learning, the model can be generated without prior knowledge of the analysed data. The problem of statistical approaches is that data distributions are usually unknown because sensors are mobile or the networks are dynamic. Rule-based approaches have a similar drawback: predefined signatures are of no use against unknown attacks or network changes. By using clusteringor machine learning techniques, on the other hand, data can be modelled even when its distribution or behaviour is unknown, and models can be updated periodically to adapt to new data patterns. This is the reason why these type of techniques are usually preferred in complex heterogeneous environments that evolve over time. The problem of data analysis from complex environments has also been studied taking into account their big data nature. In [5], [PERSON] reviews different machine learning techniques and their applicability in scenarios with high amounts of data. The author highlights the excellent classification accuracy of support vector machines (SVM)-based approaches, but also warns about the computational complexity of these algorithms in a big data context, since these techniques have a high computational cost. In [24], [PERSON] et al. propose a system based on two detection levels that are used to support maximum scalability for large amounts of data. The first level is based on using a historical data model that provides very fast detection rates. The second level, which is more computationally expensive, uses k-means clustering to sharpen previous detection results using contextual information such as location, time of the day, etc. Smart cities are, by definition, complex environments where one can find high volumes of data with a dynamic and heterogeneous nature. The current state of the art reviewed above clearly shows that data analysis and anomaly detection cannot be based on statistical or rule-based approaches alone. These approaches should be combined with sophisticated techniques based on machine learning, as suggested in [25; 26]. As we previously introduced, the main goal of this paper is to demonstrate to what extent this is really feasible in a smart city context, not theoretically but in practice. In order to do so, we have carried out an anomaly analysis testing two well-known machine learning algorithms, SVM and isolation forests, which are described in the next section. In order to conduct our test, we might have used deep learning, a subset of machine learning which uses a hierarchical level of artificial neural networks to carry out the data analysis. In this regard, recent advances show that this is a very promising field. As an example, algorithms based on deep belief networks [27] convolutional neural networks [28] or recursive neural networks [29] have been used successfully in several scenarios to improve the performance obtained with previous machine learning techniques. However, the use of deep learning for anomaly detection is a research field still in its infancy. Deep learning techniques, in general, require costly training processes, which is something easily attainable in fields such as computer vision, speech recognition, etc. However, in the case of smart city WSNs, obtaining large training datasets is much more complex due to their heterogeneous nature, which makes every smart city environment different from the rest. Therefore, the use of deep learning techniques has been considered inappropriate for the purpose of our work.