The world is experiencing the new development of smart cities. Smart cities’ infrastructure in its core is based on wireless sensor networks (WSNs) and the internet of things (IoT). WSNs consist of tiny smart devices (Motes) that are restricted in terms of memory, storage, processing capabilities, and sensing and communication ranges. Those limitations pose many security issues where regular cryptography algorithms are not suitable to be used. Besides, such capabilities might be degraded in case cheap sensors are deployed with very large numbers in applications, such as smart cities. One of the major security issues in WSNs that affect the overall operation, up to network interruption, in smart cities is the sinkhole routing attack. The paper has three-fold contributions: (1) it utilizes the concept of clustering for energy saving in WSNs, (2) proposing two light and simple algorithms for intrusion detection and prevention in smart cities—threshold-based intrusion detection system (TBIDS) and multipath-based intrusion detection system (MBIDS), and (3) utilizing the cross-layer technique between the application layer and network layer for the purpose of intrusion detection. The proposed methods are evaluated against recent algorithms—S-LEACH, MS-LEACH, and ABC algorithms.