# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
## 5 Results and Discussion
### Assessment of the Resources Requirements  
The evaluation of the resources required by SEHIDS models is one of the crucial valuations for their suitability for IoT networks. Instigated by this importance, the number of FLOPS and memory usage required by the SEHIDS models during their processing for the IoT-BoT, TON-IOT, and IoTID20 datasets are measured and illustrated in Figure 5(a)-c, respectively. The results in Figure 5(a) show that the maximum number of FLOPS required by the SEHIDS to process the BoT-IoT dataset is around 4000, which is far below the processing power of most microcontrollers used in modern IoT devices. To put things into perspective, the range of low-power microcontrollers that are typically used in these devices have the capability to carry out several megaFLOPS per second [76]. This not only attests to the appropriateness of SEHIDS for low-power networks but also provides an explanation for the FLOPS required by SEHIDS elapsed for a fraction of tiny interval during the lifetime of the devices. Interestingly, this figure shows that the number of FLOPS decreased dramatically and scattered over long intermediate intervals. The main rationale behind this characteristic is the reliance of SEHIDS on cascade correlation as a learning scheme. With this approach, it is not necessary to perform extensive training every time the architecture is evolved. Instead, in the cascade correlation, training is limited to only those connections that are relevant to the newly added layer. This leads to a significant reduction in computational costs during the evolution process of the SEHIDS models. Another plausible reason for the low computational cost of the three SEHIDS models is the use of Quick Propagation as a means of updating the weights. Recall that this scheme adaptively steers the weights to the optimal regions based on the curvature of the loss function. Moreover, the Quick Propagation schemes perform updates for the fan-in and fan-out of each new hidden layer separately. This, in turn, makes the computational cost per time associated with updating the weights low. It is interesting to note that the fluctuations that engulf the FLOPs values are due to the updating of the weights performed by the SEHIDS models whenever their recent errors are within the 95% confidence intervals of the residuals, as described in the pseudocode. A comparison of the FLOPS characteristics of the SEHID models processing the BoT-IoT dataset (Figure 6(a)) with the FLOPS characteristics of the SEHID models processing IoTID20 and TON-IoT datasets (Figure 5(b),c, respectively) shows that the number of FLOPS required for the latter two cases is lower than for the former. An interpretation for this characteristic can be gained by considering that the fewer classes there are in a dataset, the fewer neurons are required to represent them in SEHID and, consequently, lower computational costs. Face validation for the result shown in the above figures can be obtained by computing the number of FLOPS demanded by SEHIDS theoretically during the initialisation phase. According to [79], the number of FLOPS of an MLP network with \(n\) neurons in the input layer and \(m\) neurons in the output layer is \(\text{FLOPS}=(2*n-1)*m\). The pseudocode in Figure 3 shows that in the initialisation phase, the number of neurons in the input layer is set to MTU (128 in this assessment), and the output layers of the three SEHIDS models are set to the number of classes of these datasets (17, 11, 10 for BoT-IoT, IoTID20, and TON-IoT, respectively). Substituting these numbers into the said equation yields the same FLOPS number illustrated in Figure 7. it is worth noting that the maximum number of FLOPS is obtained at the initialisation phase, after which a single layer with a few neurons is added, which demands small FLOPs. The characteristics of RAM utilisation of SEHIDS, shown in Figure 7, demonstrate that SEHIDS has s small memory footprint. These characteristics are due to the various lightweight techniques used in the development of SEHIDS.