# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
## 5 Results and Discussion
### Assessment of the Evolving Process  
Although the previous two evaluations show that SEHIDS can achieve high classification accuracy on different datasets, it is interesting to investigate how SEHIDS can achieve these results. To satisfy this interest, this section traces in detail the evolutionary process that each SEHIDS instance undergoes in response to the three datasets considered above. The number of hidden layers and the number of their neurons, as a function of time, of the three SEHIDS instances, are shown in Figure 5.  
Figure 4: Normalised error versus time of (**a**) BoT-IoT, (**b**) IoTID20, and (**c**) TON-IoT. As can be seen from these results, all three architectures have zero hidden layers at time \(t=1\) (i.e., the time instance at which the three SEHIDS architectures are initialised); however, as time passes, the different architectures evolve differently. For example, it can be seen that the number of hidden layers of the SEHIDS architectures processing the TON-IoT dataset increases faster than the other two architectures. This behaviour is due to the fact that the number of classes in the TON-IoT dataset is higher than the number of classes in the other two datasets, which in turn requires a deeper architecture to compartmentalise them in an unchallenge way. Moreover, it is evident from these results that some of the hidden layers in the SEHIDS architectures used to process the TON-IoT have only a few neurons, while other hidden layers include a large number of neurons. This characteristic can be attributed to the fact that the TON-IoT dataset comprises different types of attacks, some of which have intelligible patterns, while other attack types have complicated patterns. In particular, about 31% of the entire TON-IoT dataset belongs to scanning attacks, which are essentially based on sending numerous messages with almost identical content. In a typical scenario, the attacker attempts to scan victims' open ports by sending multiple probing packets, each targeting a specific port. Consistent patterns of packets facilitate their classification by SEHIDS once a sufficient number of packets have already been already assigned to this class, without the need to use a large number of neurons. It is interesting to note that the above discussion highlights the advantages that the SEHIDS model reaps from using the content of raw packets as its input. Inasmuch as this enables SEHIDS to recognise almost all possible combinations that occur in a type of attack at a fine-grained level and to embed their features firmly in its parameter space, when this advantage is considered in conjunction with the fact that the second-largest portion of the TON-IoT dataset belongs to Distributed Denial of Service (DDoS) attacks targeting the three common ports: HTTP, UDP, and TCP allow us to deduce that the deeper hidden layers of the SEHIDS model processing TON-IoT were developed with a small number of neurons to detect these types of attacks. The results in Figure 6 also show that although the depth of the SEHIDS used as IDS for the BoT-IoT datasets is comparable to the SEHIDS acting as IDS for the TON-IoT datasets, the number of neurons in some layers is higher in the latter case than in the formers. An interpretation of this difference can be gained by considering that the majority  
Figure 5: Evolving of SEHIDS for BoT-IoT, IoTID20 and TON-IoT. of the records in the BoT-IoT dataset belong to DoS attacks, either centralised or distributed (i.e., about 97.5% in the IoT-BoT dataset compared to 42% in TON-IoT). The strategy on which the DoS attacks are based is to flood the victim's selected service port(s) with a large number of requests to make these services inaccessible to the intended users. Since these attacks involve packets targeting the same port but containing different requests, these packets have similar headers but different payloads.