# Attack Classification Schema for Smart City WSNs
## 1 Introduction  
In the coming decades, cities are facing new challenges characteristic of contemporary societies: population aging, reduction in energy consumption and carbon emissions, the struggle for greater sustainability, economic growth, etc. In addition, migratory movements are rapidly increasing the size of cities. Nowadays, 50% of the world's population lives in cities, and it is foreseen that by 2050, this percentage will be around 70% [1]. To address these challenges, smart city initiatives have emerged proposing new ways of looking at development and city management. Generally, smart city projects have the goal of improving metropolitan infrastructure planning, automatizing urban operations, reducing costs, increasing city competitiveness, opening new business lines, creating employment and enhancing transparency and openness [2]. From a technological point of view, information systems are being deployed to transform infrastructure management towards a data-driven approach following four basic building blocks: data, analysis, feedback and adaptability [3]. In order to feed these information systems, wireless sensor technology and, more generally speaking, the Internet of Things (IoT) are used to collect data from the streets and send them to the smart city data centers. For instance, WSNs are used to manage parking lots [4] and lighting infrastructure [5]. In this context, cities are often outsourcing to external providers the installation and maintenance of their necessary WSNs. Normally, providers select technologies and implement communication protocols that are more suitable to their specific use cases, not taking into account the holistic requirements of the smart city. Thus, smart cities become highly heterogeneous and distributed environments, in which deploying standard security measures is complex, and sometimes, it is even unfeasible. Moreover, security data are hard to obtain in many cases because networks and devices are normally operated by external providers. This results in open cyber security problems affecting the smart city infrastructure [6]. Hence, in addition to the local security countermeasures that WSN providers implement in their networks, smart city administrators require systems and methodologies to discover and manage security incidents from a global perspective. Although this has been widely studied in enterprise environments, the security administration of smart cities cannot be handled in the same way, and another approach is required. At this point, smart city administrators are overwhelmed by the large amount of data, from diverse devices, multiple services, different providers, etc., and at the same time, they are not granted access to all of the necessary data and devices required to perform an adequate security analysis. In order to improve smart city security, increase the reliability of the data obtained with WSNs and ease their subsequent analysis, this article presents two main contributions. On the one hand, we propose a framework designed to analyze smart city data combining two intrusion detection engines: a rule-based detection engine and an anomaly-based detection engine. Offering these two types of detection engines, administrators can discover known and unknown attacks. Moreover, as shown in more detail below, a security information and event management (SIEM) system is the base of the proposed framework. In this way, the framework is capable of gathering, indexing and processing the large amount of data sent by providers to the smart city central servers. On the other hand, we introduce guidelines to manage the alarms generated by the two detection engines. These guidelines provide administrators with a procedure to identify the most likely attacks, the compromised devices and providers.