# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
###### Abstract
Another major shortcoming of transfer learning is the significant latency required to train and then transfer the knowledge to each device. Federated learning is another technique that has been proposed to facilitate the deployment of ANN models on tiny resource devices. The core idea of this technique is that each device can train its model locally. After that, models 'parameters are sent to a designated server whose main task is to aggregate these weights and then disseminate them back to each node to update its weights accordingly. Although such an approach can save a significant number of computational resources by distributing the computational load across multiple devices, the exchange of parameters over the network can squander this saving, as the energy required to transmit a bit is about a hundred times the energy required to process it locally [27]. Quantisation is another simplification approach that aims to reduce the computational complexity of ANN models by scaling down the space required to represent the operands (i.e., the weights and biases) and the operations (i.e., the activation functions of the neurons) and/or even the input to the model. Various scaling strategies have been proposed, ranging from removing the floating part of the quantised numbers to binarisation. The obvious advantages of quantisation are that it can reduce computational costs, memory requirements, and the storage capacity required by the model. However, this comes at the expense of lower prediction accuracy, a slowdown in learning speed and the need to use more training examples [25]. Despite the differences among these thinning techniques, the mainstay method for developing most ANN models is to evaluate the performance of a bunch of them with different configurations using one or more training datasets. Then the model with the best result is put into practice regardless of how well it responds to the real field data. Nevertheless, using a fixed ANN model by different devices whose requirements are different, together with the lack of well-representative training datasets for IoT traffic, can lead to a waste of resources, poor predictions, or even a combination of both. Notwithstanding, we argue that designing an effective HIPS for IoT networks requires a more agile approach that allows each node to tailor its own ANN architecture in accordance with the dynamics of the received traffic. Inspired by this argument, this paper proposes a novel class of HIDS for IoT networks: Self Evolving Host-based Intrusion Detection System (SEHIDS). Basically, SEHIDS equips each IoT node with a simple ANN architecture consisting of an input and an output layer and a lightweight mechanism through which an IoT device can train this architecture online and evolves it whenever its performance prediction is degraded. SEHIDS meets the stringent characteristics of IoT networks from different perspectives. Firstly, SEHIDS facilitates retaining the ANN architecture to its near-minimal configurations, which can save the resources required to compute, store, and manipulate the model's parameters as well as the time needed to generate the results. Another significant advantage of SEHIDS in terms of maintaining the near-minimal model is that it speeds up the convergence of the model and avoids the problems associated with the recruitment of dispensable layers in the model, e.g., overfitting and/or exploding and vanishing gradients [19]. Secondly, SEHIDS allows each node to generate the architecture that matches its own traffic characteristics and adapts it accordingly. This is not only compatible with the discrepancy and turbulence of traffic amongst nodes, but it can also widen the applicability of our proposal by eliminating the need to make a priori assumptions about the position of nodes or their role in the network. Finally, SEHIDS eliminates the need for conducting a separate training phase to select the best model by evolving the model incrementally using the data as received, which can speed up the plan-to- the production cycle of our proposal.