# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
## 5 Results and Discussion
### Performance Metrics  
In this study, the following standard statistical metrics are used to quantify the performance of the proposed model: \(TP\), \(FP\), \(TN\)\(FN\), accuracy, precision, recall, and F1-score, where the first four metrics stand for the overall True Positive, False Positive, True Negative, and False Negative exhibited by model concerning all classes, respectively, i.e., the \(TP\) is computed as \(TP=\sum\limits_{1}^{\|C\|}TP_{c_{i}}\), where \(TP_{c_{i}}\) is the sum of all cases that belong to the \(i\)th class and are classified by the model correctly in agreement with their corresponding ground truth. Similarly, \(TN_{c_{i}}\) counts all cases that are classified by the model not in the \(i\)th class, and they are truly not in this class, hence \(TN=\sum\limits_{1}^{\|C\|}TN_{c_{i}}\). The \(FP_{c_{i}}\) and \(FN_{c_{i}}\) sum up the number of cases belonging to the \(i\)th class that our model classifies them in opposition \begin{table}
\begin{tabular}{c c c} \hline \hline
**Parameter** & **MLP Architecture** & **ReNN Architecture** \\ \hline Number of classes & According to the dataset & \(\|C\|=2\) \\ \hline Number of neurons in the input layer & \(n_{1}^{(1)}=\mathcal{O}(MTU)\) & \(n_{1}^{(1)}=\mathcal{O}(MTU)\) \\ \hline Number of neurons in the input layer & \(n_{1}^{(L)}=\|C\|\) & \(n_{1}^{(L)}=n_{1}^{(1)}\) \\ \hline Output of neurons in the input layer & \(\mathbf{y}_{t}^{(L)}=\left[\Pr\Bigl{(}c\big{|}\mathbf{x}_{t}^{(1)}\Bigr{)}\right]\); \(\forall c\in\mathbf{C}\) & \(\mathbf{y}_{t}^{(L)}=\mathbf{\xi}_{t}\) \\ \hline Loss function & \(\epsilon_{t}=\sum\limits_{c=1}^{c-\|C\|}\mathcal{T}(\xi_{t,c})\log\Bigl{(}y_{t,c }^{(L)}\Bigr{)}\) & \(\epsilon_{t}=\|\xi_{t}-\mathbf{y}_{t}^{(L)}\|_{2}\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Parameters of the initial versions of MLP and ReNN architectures. to their real classes, either by putting them in different classes or putting the instances of other classes in the \(i\)th class, respectively. Based on the above, the latter four metrics can be defined as:  
\[Accuracy=\frac{TP+TN}{TP+TN+FP+FN} \tag{8}\]  
\[\text{precision }=\frac{TP}{TP+FP} \tag{9}\]  
\[\text{recall}=\frac{TP}{TP+FN} \tag{10}\]  
\[\text{F1-score }=\frac{2 TP}{2 TP+FP+FN} \tag{11}\]  
In addition to the above statistical metrics, this study employs the following measurements to quantify the resources utilisation demanded by the proposed model: FLoating point OFerations per Second (FLOPS) which counts the number of floating points executed by the model to obtain the results per second and memory footprint in KiloBytes. The assessment presented in this paper used the specifications of the OpenMote-B board [76] as a baseline to measure the performance of SEHID. OpenMote-B is empowered with an ARM Cortex-M3 microcontroller running at 32 MHz with 32 kB RAM and 512 kB internal Flash. This device is powered by 2 xAA batteries. The proposed algorithm, as shown in the pseudocode in Figure 3, was implemented on Arm Development Studio [77], a C/C++ IDE and embedded toolchain platform that was built to allow developers to code and validate their proposals before deploying them on microcontrollers. In addition, our implementation uses the Cortex(r) Microcontroller Software Interface Standard Neural Network (CMSIS-NN) library [78], which provides a collection of resource-efficient neural network kernels that can be invoked via standard header files and an application programming interface (APIs). These tools were chosen for evaluation because they can provide an environment that closely resembles real IoT devices. In this study, SEIDS is used to develop the two common types of IDS systems: signature-based and anomaly-based. Since these two types differ in the way they learn and operate, two different training strategies are used here: Online and Batch. The online strategy is used with the signature-based SEIDS models. In this strategy, all the ground truths of three datasets are extracted.