# Attack Classification Schema for Smart City WSNs
## 6 Conclusions  
Smart cities are generally managed by city councils that outsource urban data collection to specialized external providers. In many cases, considering the point of view of smart city administrators, this results in a loss of view and control on the incidents in the data collection process. The goal of this article is to ease smart city administrators' tasks in the case of attack in the urban WSNs. Thus, in this paper, we have proposed a framework designed from the point of view of the smart city administrators to detect intrusions in the WSNs. The framework includes two types of detection engines. On the one hand, it includes a rule-based detection engine in order to detect known attacks identifiable with an attack signature. On the other hand, it includes an engine based on searching for anomalies to be also capable of detecting unknown attacks for which there are yet no implemented signatures or for which it is not feasible to implement them. Taking into account the most popular intrusion detection techniques and the way WSNs in the context of smart cities operate, we have analyzed the alarm types that can typically be triggered with these two detection engines, and we have collected the most suitable techniques to trigger each alarm type. Furthermore, in an environment such as the smart city, system administrators have a large amount of data from diverse devices, and the intrusion detection systems usually trigger a plethora of alarms, which, in addition, are not always important and are difficult to interpret. Therefore, intrusion detection in smart city WSNs is not a straightforward task and cannot be fully automatized and treated like a black-box in which a set of anomaly detection algorithms can be used to detect any attack in any specific scenario. Administrators have to select the variables to monitor, draw conclusions in the case of alarms, create correlation rules to trigger meaningful alarms that deserve their attention, etc. Nowadays, specific protocols guiding smart city administrators on how to resolve these types of situations do not exist. Thus, in this article, as a first contribution in this research field, we have proposed a schema to classify the evidence left by attacks against smart city WSNs into seven different attack models. With this schema, we provide smart city administrators with guidelines to identify the attacks and the compromised network components. These models have been devised by taking into account the effects that the attacks have on the components of smart city WSNs in a generic  
Figure 9: Sound sensors and parking sensor clusters where the attack has been detected. way. For each attack model, we have provided a list of attack types to narrow down the most likely cause of attack, and we have provided a set of contingency plans to mitigate short- and medium-term consequences of the attacks. This article also shows that the combined use of rule-based detection and OC-SVM by means of simple correlation rules can significantly improve detection results. Thus, the combination of the two detection engines' output in a correlation rule can outperform the other techniques operating separately, and this has been shown in a complex detection scenario with a 20% selective forwarding dropping rate (only 10% more than the normal loss rate for the sound network). To the best of our knowledge, this is the first approach towards studying the effects of correlating WSN security analysis of different services in the smart city. The proof of concept has also exemplified the procedure to follow to figure out the most likely attacks and components compromising two WSNs. The proposed schema does not claim to be comprehensive, and therefore, it does not include all of the possible attacks for all possible smart city configurations. This schema has been designed to be adaptable to many smart cities, and it should be treated as a guideline to develop a security and incident response system for smart city WSNs.