## 1 Introduction  
Industrial wireless sensor networks (IWSN) have gained popularity in recent years and are being used in a variety of different applications [1; 2; 3; 4; 5]. One of their most important applications involves critical infrastructure, where they form part of supervisory control and data acquisition (SCADA) systems [6]. They are popular in these systems because they provided the same control features as their wired counterparts but have a much lower deployment and maintenance cost. These systems also introduce the potential for intelligent monitoring and control within the Internet of Things (IoT) application environment. The rapid rise of IoT technologies has meant that in the future these devices are going to be an integral part of smart city applications. A recent study has shown that by 2020 there could be over 100 billion IoT applications in existence and the market value for these projects is currently over 11 billion Euro in Europe alone [7]. The complex nature of the application environment also means that IWSNs require a multidisciplinary team of experts for both development and application [8]. In the application domain these networks are usually deployed in hostile environments and their resource constraints introduce several security challenges [9; 10; 11; 12]. This is particularly problematic in these critical infrastructure applications because compromised systems can lead to disastrous consequences for the underlying infrastructure. In this scenario control theory and network security are combined to protect the system and this is collectively referred to as cyber-physical security. These cyber-physical systems [13] can be conveniently monitored and controlled remotely but this added convenience comes at the cost of increased vulnerability. This is because attackers can compromise the corporate network using conventional network security attacks and use this access to seize control of the SCADA system. This was the case in the attack on the Ukrainian power grid [14] which resulted in over 200,000 consumers not having access to electricity due to power outages. Intrusion detection provides a second layer of security in case of the failure of normal network security policies and the system becomes compromised. This secondary defence is paramount in these applications because it would limit the resultant damage of a compromised system. An example of this can be seen from the Maroochy water treatment system attack where it took three months to detect that the system was compromised and during that period 150 million litres of untreated sewerage was released into local waterways [15]. An important consideration of protecting IWSNs is that conventional network security policies cannot be applied to these networks in their original format because they are deployed in vastly different environments and thus have conflicting priorities to conventional IT networks. This is especially the case with intrusion detection schemes which are conventionally resource intensive [16]. Anomaly detection is a branch of intrusion detection which is popular in IWSNs because of its flexibility and relative resource friendliness [17]. An anomaly is defined as something which deviates from the norm/standard. In the application environment, an anomaly can be found by analysing the sensed data or traffic patterns to find abnormal behaviour in the system. The sensor nodes in IWSNs consume the most energy while transmitting data as opposed to the data processing tasks [18; 19; 20; 21]. A major limitation in these systems is the finite power supply which is usually a conventional battery. It is for this reason that anomaly detection algorithms in this application scenario should seek to limit the amount of communication required to perform the task [22]. This can be achieved by making use of distributed in-network processing. Another important consideration is that an anomaly might not necessarily be the result of a security breach [17].