## 2 Anomaly Detection  
Abnormal changes within monitored IWSN systems can be detected using anomaly detection algorithms [31]. In cyber-physical systems for instance, a fault in system the system caused by general wear and tear would cause significant changes to the sensed data which could have disastrous consequences. The same is true if an intruder were to successfully feed false data into the system in an attempt to affect the system functionality. Both of the examples would result in data that deviates from norm and should be flagged by anomaly detection.  
Figure 1 shows a generic framework for anomaly detection [32] which was derived from the generic intrusion detection framework. The input to an anomaly detection scheme is a dataset which consists of data instances which in turn consist of data attributes. Depending on the detection scheme, the data may need to be pre-processed before proceeding further. A normal profile is then produced through data processing by using either a training procedure or prior knowledge. Once a normal profile is produced, a test instance can be classified as anomalous with the aid of some established threshold.  
Anomaly detection schemes can be categorised using several different indicators. The model used in detection schemes is a popular indicator used to classify them. The two general categories in this regard are parametric (also known as statistical) and non-parametric models [28]. Parametric methods are suitable in stable environments where the data distribution is well known and unlikely to change frequently. Non-parametric models can be used in dynamic environments where the statistical distribution is unknown and unfamiliar. The first category provides f  
Figure 1: Generic Anomaly detection framework.  
second category provides detection generality. Table 1 shows a comparison between parametric and non-parametric schemes.  
Anomaly detection schemes can also be broadly classified as those that require prior knowledge of the system data and those that do not [23]. As with the previous categorisation, the first category provides faster detection while the second category provides detection generality. In the first category the classifier can either use supervised or semi-supervised learning [33]. The former uses a large training set and has to be retrained if normal system behaviour changes while the latter generalises results using a smaller data set and adapts to changing system behaviour on the fly. The second category, which does not require prior knowledge, uses unsupervised learning and assumes that abnormalities are far removed from the norm. Table 2 shows a comparison between the different training methods and this section is summarised in Figure 2. This paper focuses on these two categorisation because they focus on information designers need to have about the data before they can use the algorithm which, as will be explained later, is paramount in anomaly detection schemes.  
\begin{table}
\begin{tabular}{c c c} \hline \hline  & **Parametric** & **Non-Parametric** \\ \hline Prior-Knowledge? & Statistical distribution & Labelled training data \\ Environment? & Static & Dynamic \\ Detection speed? & fast & Moderate/slow \\ Detection generality? & No & Yes \\ \hline \hline \end{tabular}
\end{table}
Table 1: Parametric vs. Non-parametric anomaly detection.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Supervised** & **Semi-Supervised** & **Unsupervised** \\ \hline Prior-Knowledge? & Yes & Yes & No \\ Environment? & Static & Dynamic & Dynamic \\ Detection speed? & Fast & Fast/moderate & Moderate/slow \\ Detection generality? & No & Yes & Yes \\ \hline \hline \end{tabular}
\end{table}
Table 2: Comparison of anomaly detection training methods.  
Figure 2: Anomaly Detection Summary.