# Attack Classification Schema for Smart City WSNs
## 3 Intrusion Detection Framework
### Alarms
#### 3.2.1 General Alarm Types  
This section outlines the different types of alarms that can be triggered with the intrusion detection framework sketched in Section 3. Moreover, for each alarm type, recommendable techniques to generate the alarms are given:  
* AT1, alarms triggered by simple thresholds: This type of alarm is triggered by simple rules that check whether a variable stays within pre-set thresholds. These thresholds can be computed manually for certain variables, for which administrators know a priori their normal boundaries; or they can be computed using methods to find outliers, such as [PERSON]'s method [23]. In the case of an attack that triggers an alarm of this type, administrators can have a valuable hint to find the origin of the incident, because the rule that triggers the alarm is generally associated with a single variable of a single node. However, by focusing on just one variable, several attacks may show the same effects, and therefore, other evidence needs to be gathered.
* AT2, alarms triggered by complex models: The alarms triggered by complex anomaly detection models allow administrators to disclose attacks that leave more subtle evidence than just single variables going over thresholds. Thus, these allow monitoring the normal state of several variables, involving different nodes and services at the same time. Compared to AT1 alarms, these alarms allow administrators to know that data are anomalous as a whole, and therefore, they have less information about the specific variables or nodes that are affected. In the article [28], we have compared several multivariate anomaly detection techniques, and we have concluded that OC-SVM is especially recommendable in this context.
* AT3, alarms triggered by time series analysis: Time series analysis is useful in smart cities because many services generate times series data. In these cases, new observations are closely related to previous ones. For these types of data, static thresholds are sometimes inadequate. Mathematical models, capable of predicting future values, are more suitable to point out the real values that deviate from the forecasts, which, therefore, can be considered anomalous. ARIMA models have been used in this type of analysis in various contexts, including anomaly detection in WSNs [29].
* AT4, alarms triggered by correlation: These types of alarms result from establishing certain relationships between an attack and its effects in an area or in some network components. These effects are in turn detected by other alarms. Therefore, this type of alarm is created to aggregate other alarms into a single one.  
When system administrators create any of the alarms described above, they have to assign a severity level to the alarm. Administrators then have an easy way to filter the alarms that will actually receive their attention. Identifying the severity of the alarms is generally a specific task dependent on the specific smart city and on the security policies. For instance, administrators can flag an alarm as severe if it is implemented on an especially critical service or node; or if the alarm is implemented on a highly reliable protocol and, therefore, any sign of anomaly is a clear sign of attack. Moreover, as we will see in the next section, it is also recommended to create AT4 alarms with a high-severity level, because they are more reliable and can affect several systems.