## 4 Non-Parametric Methods
### Hybrid Systems  
In intrusion detection systems, the traditional definition for a hybrid system is one that combines signature-based classifiers with anomaly detection methods [24]. In this paper that definition will be extended to include all systems that combine two methods to produce a stronger intrusion detection system. While increasing in popularity, hybrid systems do not always result in a better overall system because what you gain in detection accuracy could be lost in efficiency. So the challenge in these kinds of systems is creating robust schemes that have high detection accuracies and low false positive rates while still being feasible for practical implementation.  
The use of a hybrid model that combines signature-based classification and anomaly detection using SVM was proposed for intrusion detection by the authors in [56]. The system is designed to work for networks that use clustered architectures where cluster heads are elected to forward aggregated data packets to the base station. The cluster heads are not more powerful than the other sensor nodes and are selected based on the remaining energy of the nodes in the cluster. Each node runs a local intrusion detection agent while the cluster head runs the global one which is responsible for making decisions based on two detection schemes. The proposed scheme yielded a high detection accuracy and low false positive rate when tested with a range of known attacks. It also had better or comparable result to state of the art techniques.  
A scheme that uses a combination of spectral clustering (SC) and deep neural networks (DNNs) for intrusion detection was proposed in [57]. SC is used to improve the performance of DNNs which usually perform poorly when exposed to camouflaged attacks. In the learning phase, spectral clustering is used to extract features and divide the data into categories depending on their similarities using cluster centres. Each category is then used to train a DNN which then learns specific characteristics of each category. Once trained, the DNNs detect intrusions by first categorising the input data into the above mentioned categories using SC. Based on the learned behaviour, the DNNs are able to distinguish between normal and malicious behaviour. The proposed scheme outperforms state-of-the-art techniques when tested using known datasets. The scheme was tested using the simulator NS-2. However, no evaluation was conducted to verify the feasibility for practical implementation given the scarce resources in the application scenario.  
One could go further than hybrid systems by using an ensemble of algorithms to detect anomalies. This would theoretically result in a better detection accuracies than hybrid systems because there are more algorithms working together to overcome each other's limitations. Owing to the resource constraints of IWSNs, these types of systems are not as popular in these applications. The authors in [58] however proposed a framework for the use of ensembles of incremental online learners for anomaly detection. Their decentralised approach was able to outperform their centralised offline learner counterparts. While the complexity of the algorithms used will ultimately be the determining factor, they find that ensemble schemes are feasible for practical implementation.