## 2 Related Work  
A number of custom IDSs for sensor networks have been proposed. Some representative solutions are given in [1, 2]. However, they are mainly focused on misbehaviour detection, and hence are capable of detecting only a limited number of attacks, _i.e._, known attacks and their variations. In order to detect new attacks, they need to be adjusted by humans.  
Recently a few solutions that deploy machine learning techniques have appeared [3, 4]. Among these solutions we can also find a few anomaly-based solutions [5, 6], that claim to have the capability to detect unknown attacks. They uphold the idea that machine learning techniques offer higher level of flexibility and adaptability to the changes of the environment, as it only requires retraining the algorithms with new data, which can be done automatically. Furthermore, in reality we often have to deal with incomplete and noisy information, and the security requirements themselves are often fuzzy and incomplete. Machine learning techniques are known to cope well with these sorts of problems, which is the main reason they are becoming part of security solutions, even commercial ones [7].  
However, the feature sets they deploy mostly include those features that capture the properties of known attacks, _i.e._, those that are known to change under the influence of an attacker, or are known to be weak spots. This is their major deficiency, as relying on these features only known attacks or their variations can be detected. Furthermore, it assumes that an attacker can exploit only the known vulnerabilities, but general experience is that vulnerabilities are detected after being exploited by an adversary. Some of them assume that the feature sets can be expanded [1], yet this again has to be done through a human intervention. In addition, taking into consideration the existence of mobile nodes in the network is greatly unexplored and untreated subject in the current state of the art [8]. A summary of the most representative existing solutions for intrusion detection is given in Table 1, from which we can conclude the following: although there are many proposed solutions, none of them is general enough to be able to handle a greater variety of attacks. For this reason, most of the solutions should work aside with few more that address different aspects of security breaches. However, this can introduce high overhead and consume significant resources. Another issue is that most of them are able to detect known attacks, but the experience from the network security tells us that the attackers always manage to find new possibilities to launch their attacks. Finally, almost none of them address difficulties introduced by mobile nodes. One example is given in [6], but it just deals with the attacks on routing protocols. Furthermore, this work does not assume any special treatment of mobile nodes. Thus, our aim is to provide a machine learning based solution that does not suffer from these issues, _i.e._, a solution that would be capable of detecting wide range of attacks, including the previously unseen ones, which would also be adaptable automatically and address the existence of mobile nodes in the network.