# Attack Classification Schema for Smart City WSNs
## 5 Proof of Concept
### Scenario Description  
In this section, we build a scenario for the demonstration, and we analyze the data using the core packages included in R [30] and the packages e1071 [31] and caret [32] for the OC-SVM classification and FPC [33] for the clustering algorithms. The original data came from two Barcelona service providers from July-November 2015. The two services collect data from street parking and sound meters. The data from the parking service include the gateway identifier used by each packet to send the data from the parking sensors to the central servers. The sound data do not include this information. For this proof of concept, it is necessary to extend the real data to have a dataset with the minimum amount of information to be able to simulate attacks and, subsequently, perform anomaly analysis. Therefore, in order to have a proper dataset for this demonstration, the following actions are performed:  
* The sound meters are placed in the area of the parking network respecting the layout of both networks. Figure 6 shows the node position in both networks.
* A gateway identifier is assigned to each packet received from the sound network. The assignment of a gateway to each sound packet is based on the gateway computational load. Thus, gateways processing many parking network packets receive fewer sound packets. As we will see later on,this gateway identifier is only used to simulate the attack. When we perform the analysis later, the gateway identifier is considered unknown in the sound packets.
* The data types described in Section 3.1 are received at the data center from diverse services and are generally considered available to any service. However, in this scenario, the sound service does not provide the sequence number of the application packets, which can be used to easily calculate the application packet loss. Therefore, the packet loss rate is added to the sound meter data.
* A normal packet loss rate (i.e., not due to attacks) is also considered. There is a wide variability on ordinary packet loss rates in WSNs, depending on several network characteristics, such as the communication protocols or the node density. In [34], the authors performed measurements using the collection tree protocol (CTP), which is one of the most popular routing protocols in WSNs, and they found end-to-end packet delivery rates from 90.5%-99.9%. Thus, in this simulation, the sound monitoring service has a conservative 90% packet delivery rate (i.e., 10% packet loss rate without attack).  
In this scenario, we simulate a selective forwarding attack in one of the gateways, where 20% of the received packets are randomly dropped. This causes data loss from sensors belonging to the two services spread throughout the neighborhood. This scenario, with only two services, is a basic configuration for a smart city and demonstrates the value of the proposed classification schema. Scenarios including more services and providers would increase the complexity of the analysis; but, at the same time, more alarms from other WSNs would be triggered, and then, there would be more evidence of the attack, which would enhance the value and the results of the classification procedure.