# Attack Classification Schema for Smart City WSNs
## 2 Background and Related Work
### Intrusion Detection  
Misuse detection and anomaly detection are the two basic types of techniques normally used in intrusion detection applications. On the one hand, misuse detection searches for known attack patterns in security logs. These patterns, popularly known as signatures, are defined using rules that are recorded in large databases, which, in many cases, are publicly available [20; 21]. These rule-based detection systems are normally highly reliable and do not trigger a high number of false alarms. In smart cities, simple rules can monitor certain WSNs that send data in regular intervals or where sensor readings fall within clearly-defined thresholds. However, this is not the case of numerous services, and the city is a dynamic environment, which requires additional detection techniques.  
On the other hand, anomaly detection identifies data that do not follow their typical behavior. Using anomaly detection, security practitioners are able to notice attacks where data are modified beyond their normal boundaries. In [22], the authors survey popular anomaly detection techniques used in a wide range of domains. Following, the most relevant techniques for the problem described in this article are highlighted:  
* [PERSON]'s method [23] is popular for computing boundaries from a numeric univariate dataset.
* Autoregressive models [24], such as autoregressive integrated moving average (ARIMA): These models are based on the assumption that each value is somehow correlated with the previous recorded values. In this way, autoregressive models use previous values to predict future values within a confidence interval. The lower and higher boundary in the interval can be used as thresholds to point out anomalies. Autoregressive models are very common in time series analysis.
* Support vector machines (SVM) have successfully been used in [25; 26] to detect intrusions. One-class SVM (OC-SVM) are a semi-supervised (i.e., labeled data are not required to train the models) version of this machine learning technique. OC-SVM are capable of training models to identify if new samples belong to the same class as the training samples.  
As mentioned before in this section, in the literature, there are techniques to prevent and detect attacks in WSNs. However, as far as we know, there are no studies that analyze and propose solutions for the specific open problems related with the WSN security in a smart city, such as:  
* Smart city administrators have limited access to network devices and data, which can be necessary for a complete security management. The implementation, maintenance and control of security protocols are the responsibility of external providers in many cases.
* Generic security solutions able to handle highly heterogeneous and distributed environments, with multiple systems with different technologies and security requirements do not exist.  
Moreover, there are also no studies addressing the challenge of administering the plethora of warnings and alarms of different security levels that can be generated by global intrusion detection systems of the future smart city, in which there will be many more sensors, and their deployment will cover wider areas of the city. Below, in the following sections, we propose a framework and several guidelines to ease smart city administrators' tasks related to this challenge.