# Attack Classification Schema for Smart City WSNs
## 3 Intrusion Detection Framework  
In this section, we describe the basic components of the framework that we propose to gather and process smart city WSN data. Principally, the framework includes a rule-based detection engine and an anomaly-based detection engine. As we will see in Section 5, combining these two intrusion detection methods results in an improvement of the detection rate and/or the false positive rate. Below, the steps and the components involved in the data processing through the two engines included in the proposed framework are enumerated. These are also represented in Figure 3:Different sources generate a plethora of data of different types. Section 3.1 provides more details of typical fields received in the smart city data centers from WSNs. Most of the data are sent by the WSNs and collected, parsed and normalized by centralized data collectors within the smart city premises. Occasionally, remote data collectors can be required to gather the data directly from the source (e.g., to collect system logs that are not sent by the network devices). 2. At this point, two engines can access the data to detect intrusions: * The rule-based detection engine can correlate data from different sources. It is capable of finding patterns in the data to identify attacks that have already been reported in the literature and that are known to information security researchers. * The anomaly-based detection engine can warn administrators in the case of situations that do not follow the normal system behavior, even when there are no patterns matching known attacks. In this way, popular attacks can be easily identified and prevented, and new attacks, exploiting unknown vulnerabilities, trigger alarms that give smart city administrators the first warning signs in order to start more in-depth inquiries. 3. Alarm databases index the alarms triggered by the two detection engines. 4. The rule-based detection engine can be used again to correlate the alarms in the alarm databases and, in this way, trigger new alarms that have to be considered more reliable and having a higher priority. Section 3.2 provides more details about alarm types. 5. Administration and visualization tools provide dashboards and warning mechanisms in order to manage the system and to inform practitioners in case of an incident. This framework is designed to be easily adaptable to different smart city architectures, and since it is deployed within the smart city central servers, it is transparent to the external providers. Thus, it can handle the high heterogeneity of the urban WSN systems. Additionally, as we will see later on, the variables used in the detection algorithms recommended in this paper are already being sent by many WSNs. In this way, our proposal not only avoids extra requirements for the providers, but also it is energy efficient, because sensor nodes do not have to send additional packets with system status variables. Preserving the energy of the nodes, which are frequently battery powered, is paramount to sensor networks in smart cities. Moreover, as can be seen in Figure 3, the two intrusion detection engines are included in a SIEM, which have to be deployed within the city council network premises. In the enterprise context, system administrators are successfully using SIEM technology to reduce the complexity of the security administration and to automate certain tasks and security controls, such as log management, system monitoring, malware protection, vulnerability scanning, security configuration assessment  
Figure 3: Architecture of the proposed intrusion detection framework. and incident management [27]. Furthermore, SIEM systems offer big data collection, storage and processing services, and therefore, this guarantees the scalability of the framework's architecture. Furthermore, data correlation and historical data management, which are generally very relevant in intrusion detection analysis, are especially efficient on this type of platform.