## 4 Design Choices  
### One-Class Classifier  
Statistical-based and rule-based approaches [10; 33; 34] use some thresholds to distinguish between normal and abnormal behaviors. These thresholds depend on some physical parameters, like signal noise and other radio parameters that vary from a network deployment scenario to another. Hence, it is not feasible to calculate the required threshold for each network deployment and upload the corresponding binary code to the sensor node.  
The one-class classifier (OCC) assumes that all of the training instances belong to one class, named positive class. The negative class, which represents abnormal behavior is absent or unknown,The aim of the classifier is to find a separating boundary between the normal instances and the rest of instances [35]. The OCC is solved using either density estimation or boundary description methods. In the density estimation method, an object is considered to be non-positive (or outlier) when the object falls into a region with a density lower than some threshold value. However, this method requires large data sets [36]. In the boundary description method, the classifier sets a boundary that encompasses almost all of the positive points with the minimum radius. Any test instance that does not fall within the learned boundary is declared as anomalous. The main issue that arises is when the training data set is composed of different regions with different density levels. Instances in low-density regions will be rejected although they are normal. Additionally, when the boundary of the dataset is long and non-convex, the required number of training instances is likely to be very high [35]. Thus, the one-class classifier gives its best results in terms of detection rate and false positive rate when the training instances are close to each other and can be grouped into one small region. The question that might arise is whether this small region can be constructed in WSNs or not. To answer this question, we are going to state the following observations and results.  
[PERSON] et al. [37] experimentally studied the stability of a testbed WSN. In this study, the transmissions are scheduled to avoid collisions and it is observed that the packet reception ratio of stable links (i.e., link quality remains constant at a certain level) are experiencing small fluctuations that are mainly caused by multi-path fading of wireless signals. According to this study, this case occurs, especially at right when there is no human movement or Wi-Fi interference.  
DOZER [38], KOALA [39], and DISENSE [40] are three periodic-based data collection protocols that are designed for long-term monitoring applications in WSNs, and have been implemented and tested on real platforms. DOZER and DISENSE provide a packet delivery ratio of 98-99%. KOALA, on the other hand, achieves a ratio of 99.99%. This implies that the average packet reception ratio of a link is also lower-bounded by 98-99%.  
The above results show that the instances comprising the normal traffic behavior (i.e., number of received packets) are close to each other and, hence, it is possible to build a small bounded region composing all these instances. This implies that the choice of one-class classifier here is appropriate and justified to monitor stable links or WSNs under quasi-stable conditions (i.e., constant flow rate, collision-free transmissions, no mobility, no signal interference, \(\ldots\), etc). The boundary, which separates between normal traffic and attack, is self-learned from each deployment setting, and it does not depend on a predefined threshold as in the statistical-based and rule-based approaches. In this situation, we adopt the one-class classifier to train the intrusion detection system.