# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
## 4 Methods
### Problem Formulation and High Level Abstraction for the Proposed Model  
This study considers an IoT network comprising a set of battery-powered devices with wireless communication capabilities that are spread over a given area to form a multi-hop network. No further assumptions or restrictions regarding the operational modes or communication protocols are imposed here; instead, our concentration is on the traffic as seen by each node within the networks. Here, we use \(\mathcal{S}\) to denote the set of all nodes and \(f\) to refer to any arbitrary device \(f\in\mathcal{S}\); accordingly let \(\xi_{t}\) be a vector comprising the octets of a packet received by \(f\) at the time instant \(t\). In this instant, the SEHIDS model consists of a sequence of layers numbered from \(1\) to \(L_{t}\), each of which is equipped with several artificial neurons whose number, input, learnable parameters (i.e., weights and biases) and output are denoted by \(n_{t}^{(l)},\mathbf{x}_{t}^{(l)}\), \(\mathbf{w}_{t}^{(l)}\) and \(\mathbf{y}_{t}^{(l)}\) respectively, where \(1\leq l\leq L_{t}\). Furthermore, the \(f_{t}^{(l)}\) is used to denote the activation function employed by the \(l\)th layer to map its input \(\mathbf{x}_{t}^{(l)}\) to the corresponding output \(\mathbf{y}_{t}^{(l)}\) in terms its parameters \(\mathbf{w}_{t}^{(l)}\), i.e., \(\mathbf{y}_{t}^{(l)}=f_{t}^{(l)}\Big{(}\mathbf{x}_{t}^{(l)}\Big{|}\mathbf{w}_{t}^{(l)} \Big{)}\). The input of the first layer \(\mathbf{x}_{t}^{(1)}\) is \(\mathbf{x}_{t}^{(1)}\) i.e., \(\mathbf{x}_{t}^{(1)}=\xi_{t}\) and the output of the last layer \(\mathbf{y}_{t}^{(L)}\) is the class of this traffic which can be expressed as:  
\[\mathbf{y}_{t}^{(L)}\ =\Big{[}\text{Pr}\Big{(}c\Big{|}\mathbf{x}_{t}^{(1)}\Big{)} \Big{]};\ \forall c\in\mathbf{C} \tag{1}\]  
where \(\mathbf{C}\) is a vector of all considered classes; hence, the \(\mathbf{y}_{t}^{(L)}\) can be written as the result of a sequence of composite functions starting at the \(L_{t}\)th layer, passing all hidden layers and ending at the 1 st (i.e., input) layer, i.e.,  
\[\mathbf{y}_{t}^{(L)}\ =f_{t}^{(L)}\Big{(}\mathbf{x}_{t}^{(L)}\Big{|}\mathbf{w}_{t}^{(L)} \Big{)}\circ f_{t}^{(L-1)}\Big{(}\mathbf{x}_{t}^{(L-1)}\Big{|}\mathbf{w}_{t}^{(L-1)} \Big{)}\circ\ldots\ldots\circ f_{t}^{(1)}\Big{(}\mathbf{x}_{t}^{(1)}\Big{|}\mathbf{w}_ {t}^{(1)}\Big{)} \tag{2}\]  
The distinguishing feature of SEHIDS is that it is not of a fixed architecture; rather, it is evolved by each node based on its prediction performance in response to the traffic it receives. Specifically, a node starts with the most compact form of the SEHIDS model (i.e., a model with an input layer and an output layer, \(L_{1}=2\)) and then a new hidden layer is added and trained as the performance of the model degrades. Realising this approach requires specifying the criteria for the evolution process, including the conditions under which a new layer is added, the number of neurons in the new layer, the pattern used to connect this new layer to the current architecture and the learning scheme used to train the model. Interestingly, the stringent characteristics of IoTnetworks pose great challenges to the design space of these criteria. More specifically, using lenient conditions for adding a new layer can expand the hypothesis space of SEHIDS beyond the reasonable limit, which in turn leads to larger generalisation errors. In contrast, employing harsh conditions for adding a new layer to SEHIDS can reduce its learning capacity leading to biases between different classes. Similarly, adding a new layer with an inappropriate number of neurons negatively affects the performance of SEHIDS. Increasing the number of neurons in the new layer can boost the model's ability to extract new features from the raw data but at the expense of a higher computational budget and resource utilisation. Although appending a new layer with fewer neurons can cut off the redundant cost, it cannot add real benefits to the classification performance of the model.