# Attack Classification Schema for Smart City WSNs
## 4 Attack Classification
### Attack Models  
Attacks in WSNs are traditionally detected analyzing particular parameters from each of the affected communication layers. Nevertheless, as previously mentioned, from the smart city administrators' perspective, it is unrealistic to count on the availability of all of the parameters, and maintaining very specific detection systems for each WSN would be unmanageable. This section presents seven attack models, which are used later on to classify security incidents. The models in this attack schema are a general classification, based on the anomaly traces that most common attacks in WSN leave on the affected data described in Section 3.1 and on the attack's geographical influence. For each attack model, a list of attack candidates is provided. These are the most common attacks reported in the literature (see more details in Section 2.2.2). Figure 4 shows graphical representations of the seven models. These models are described as follows:  
**Model 1: Vertical attacks**:  
**Description:**: Attacks that show vertical attack traces (i.e., from a group of node leaves to the base station) on a single WSN. The main aims of these attacks is to obstruct one or more paths in order to increase the arrival time of the packets from the target leaves, to crash intermediate routing nodes, to decrease node batteries or to provoke a general DoS. **Affected data:**: Application data, packet latency, battery level. **Geographical influence:**: Attack traces along large network paths starting near the leaves and ending near the base station. **Attack candidates:**: Path-based DoS, overwhelm, misdirection, spoof, alter or replay routing information, wormhole, Sybil to an important routing node, black hole on an important routing node, sinkhole. **Model 2: Transmission medium attacks**:
**Description:**: Attacks that affect nearby nodes using the same frequency bands or MAC protocols. Other bands or protocols are not affected. Basically, attackers take advantage of the transmission medium in order to prevent the proper delivery or reception of packets from certain nodes. These attacks applied to routing nodes also hamper the correct communication of other nodes outside of the attacker's direct influence area. **Affected data:**: Network status data (e.g., RSSI, SNR), application data, packet latency, battery level. **Geographical influence:**: Reduced area of nearby nodes. **Attack candidates:**: Unfairness, collision, jamming. **Model 3: Locally-dispersed attacks**:  
**Description:**: Attacks that affect dispersed nodes from a single WSN with the main goal of creating delays, dropping packets and depleting node batteries. **Affected data:**: Application data, packet latency, battery level. **Geographical influence:**: No geographical influence. **Attack candidates:**: Misdirection, spoof, alter or replay routing information, Sybil, data tampering, wormhole, selective forwarding, sinkhole. **Model 4: Widely-dispersed attacks**:
**Description:**: Attacks that affect dispersed nodes from several WSNs. Attackers aim to reduce the proper operation of one or several WSNs. In this case, attackers do not use constant attack techniques, which would be more effective, in order to cover up their intentions and delay the moment of their discovery. **Affected data:**: Application data. **Geographical influence:**: No geographical influence. **Attack candidates:**: Selective forwarding at a gateway, unfairness at a gateway (not-constant), collision at a gateway (not-constant), jamming at a gateway (not-constant). **Model 5: Widely-intensive attacks**  
* **Description:**: Attacks that affect a great percentage of nodes from several WSNs using the same gateway. Attackers use these techniques to completely stop the service provided by one or more WSNs. * **Affected data:**: Application data, battery level. * **Geographical influence:**: Wide area of nearby nodes.