# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
###### Abstract
Several approaches and techniques are utilised to design SEHIDS. These include devising the conditions under which a new layer is added, specifying the number of neurons in the new layer, developing the pattern used to connect this new layer to the current architecture, and the learning scheme used to train the model. To ensure the tractability of SEHIDS, the constructive neural networks [28] and cascade correlation learning [29] are used as the design framework. While maintaining the learning capacity of SEHIDS in coinciding with the traffic dynamics is carried out by devising novel versatile criteria for the evolution of SEHIDS based on the divergence between the errors produced by the model due to the new input and the residual errors produced by the model so far. To avoid exhausting the resources of the IoT devices by expanding the hypothesis space of SEHIDS beyond what is required, the number of neurons in newly added is adjusted based on the number of remaining parameters to achieve the optimal degrees of freedom. More importantly, the use of these approaches and techniques enables us to decouple the simple ANN architecture that is fed into the SEHIDS in the initial phase from the evolving mechanism. This, in turn, facilitates using SEHIDS with different ANN architectures. In order to take advantage of this capability, this study develops the two common types of IDS: signature-based and anomaly-based. In the signature-based IDS version, a supervised architecture (i.e., MLP [19]) is used to classify different types of attacks, while in the anomaly-based IDS version, an unsupervised architecture (i.e., ReNN [30]) is used to distinguish benign from malicious traffic. The performance of SEHIDS was comprehensively assessed against three contemporary datasets containing a variety of cyberattacks targeting IoT networks: BoT-IoT [31], TON-IOT [32], and IoTID20 [33]. These assessments are designed to serve two purposes: firstly, evaluating the ability of SEHIDS to make an accurate detection for different types of attacks, and secondly, investigating the ability to run SEHIDS on devices with scarce resources. These two assessments were quantified using various performance metrics, including the standard statistical measurements that are usually used to determine classification accuracy, e.g., True Positive, False Positive, True Negative False Negative, accuracy, recall and F1-score and those metrics that are used to measure the number of resources, e.g., FLOating Point OFerations per Second (FLOPs) and memory usage. The results of these assessments demonstrate the high competence of SEHIDS to fulfil both purposes. Indeed, the average achieved true positive rate is 1. Furthermore, these results show that the resources consumed by SEHIDS are in the order of small fractions of typical IoT devices' resources. The rest of this article is structured as follows: Section 2 reviews the most pertinent works presented in the open literature, and Section 3 describes the datasets used to assess the performance of our proposal. The methods used to develop SEHIDS are presented in three subsections: Section 4.1 provides the problem formulation and assumptions underlying SEHIDS, a detailed description of SEHIDS is given in Section 4.2, finally, Section 4.3 discuss how SEHIDS can be used as a signature classifier or anomaly detectors. Section 5 presents the results and discussions, and finally, Section 6 concludes this paper.