# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
## 2 Related Works  
Designing an effective Intrusion Detection System (IDS) is one of the long-standing practices that has been carried out using various approaches and techniques. Most studies and systematic reviews deal with the enormous number of proposals by compartmentalising them according to different criteria: for example, according to the location where IDSs are deployed into host-based and network-based, according to the detection strategy into signature-based and anomaly-based, according to the responsiveness to intrusions into active and passive, according to the way by which they are updated into offline and online. As these criteria are neither mutually exclusive nor endless, we concentrate here on the detection strategy, as it plays a paramount role in designing IDSs for IoT networks. The underlying assumption of signature-based IDS is that an intrusion can be typified by a set of rules and patterns; hence by comparing the ongoing traffic with those that preceded and/or coincided with the occurrence of the well-known intrusions, potential attacks can be identified. The anomaly-based HIDS, on the other hand, is devised on the concept that anomalous traffic deviates from normal behaviour; therefore, intrusions can be figured out just by determining whether a particular traffic instance is normal or not. This, in turn, makes signature-based systems an excellent candidate for timely detection of known attacks with high accuracy. However, this excellent performance can be discredited in the face of unknown attacks such as polymorphic malware and zero-day attacks. Although anomaly-based systems can perform better in these circumstances, the validity of these systems is endangered when they are tricked either maliciously, as is the case with adversarial attacks [34; 35; 36], or benignly by the emergence of legitimate but never-before-seen traffic profiles due to appearing of new services or protocols [37; 38]. The remaining of this section is devoted to reviewing the fundamental concepts used to develop IDS for IoT with the aim of highlighting the merits of our work in comparison to related work. Employing devices' resource usage as an indicator of malicious activity is one of the earliest approaches that was used to design network-based intrusion detection systems for resource-constrained networks. The work presented in [39] uses this approach to develop three statistical machine learning models based on linear regression, multilayer perception (MLP) and Recurrent Neural Networks (RNNs) to identify different types of IoT attacks, including unauthorised access, port scanning and viruses. The proposed models poll resources used by each IoT device (e.g., CPU usage, memory usage, storage occupancy) within a predefined time window and then feed them into each of the three models. These models compare the actual usage values with the predicted values they generated at the previous time window to determine the presence of an attack. The results reported in this paper show that the model is able to detect the said attacks just by monitoring the misuse of resources. However, this assessment uses a bespoke dataset generated from a simple network of only 12 BeagleBone Black devices. This makes its performance questionable in more realistic cases. The model presented in [40] follows the same approach as in [39], except that it uses energy consumption in lieu of other resource utilisation readings. This work argues that energy anomaly is an effective indication of attacks and that the type of attack (either physical or cyber) can be detected from the energy profile. Nevertheless, this model uses several pre-processing techniques to reduce the noise that affects the energy values before feeding them into the Deep Learning model. A fixed CNN model of nine convolutional layers with three flat and three dense layers is used to disaggregate different components of the received energy before passing them to another CNN model to make the prediction.