# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
## 4 Methods
### Self Evolving Host-Based Intrusion Detection System
This optimisation is accomplished by adjusting the weights of all layers proportionally to their contributions towards the error. Depending on the characteristics of the problem at hand and the availability of training datasets beforehand, several approaches have appeared in the open literature. Gradient descent, stochastic gradient descent, nonlinear conjugate gradient, limited-memory Broyden-Fletcher-Goldfarb-Shanno and quick propagation [18; 19] are a few to name. Nevertheless, this study considers the limited resources of the IoT devices along with the lack of training datasets that possess the intrinsic characteristics of IoT network's traffic beforehand and employs the Quick Propagation algorithm (QuickProp) [71] as an optimization algorithm. QuickProp is a second-order optimisation algorithm that utilises a lightweight version of Hessian's diagonal approach to update each weight in secant steps independently. According to QuickProp the new weights of the \(l\)th layer at time instance \(t\), i.e., \(\mathbf{w}_{t}^{(l)}\) can be written formally as:  
\[\mathbf{w}_{t}^{(l)}=\mathbf{w}_{t}^{(l)}+\frac{\
abla_{\mathbf{w}_{t}^{(l)}}\mathcal{L} \big{(}\hat{\xi}_{t},\hat{\xi}_{t}\big{)}}{\
abla_{\mathbf{w}_{t}^{(l)}}\mathcal{ L}\big{(}\hat{\xi}_{t-1},\hat{\xi}_{t-1}\big{)}-\
abla_{\mathbf{w}_{t}}\mathcal{L} \big{(}\hat{\xi}_{t},\hat{\xi}_{t}\big{)}}\
abla_{\mathbf{w}_{t}}\mathcal{L}\big{(} \hat{\xi}_{t},\hat{\xi}_{t}\big{)}} \tag{6}\]  
where \(\
abla_{\mathbf{w}_{t}^{(l)}}\mathcal{L}\big{(}\hat{\xi}_{t},\hat{\xi}_{t}\big{)}\) is the gradient of \(\mathbf{w}_{t}^{(l)}\) with respect to the loss function and \(\
abla_{\mathbf{w}_{t}^{(l)}}\mathcal{L}\big{(}\hat{\xi}_{t-1},\hat{\xi}_{t-1} \big{)}\) is the gradient at the previous time instance. The justification for the selection of the QuickProp is multifaceted. Firstly, it being a second-order optimisation algorithm allows it to incorporate thorough information about the curvature of the loss function in the vicinity of the current point of the weighting space. This, in turn, expedites approaching the optimal value of the weights [72]. Secondly, QuickProp obviates the need to dictate the learning process based on predefined hyperparameters. Interestingly, most other optimisation approaches, e.g., backpropagation and stochastic gradient descent, require the specification of the step at which the learning process paces down the gradients, called the learning rate. Mis-setting this hyperparameter can result in wasting the device's resources or overshooting the optimal values. A further justification for selecting the QuickProp is its low computation budget, which results from the fact that each weight is updated independently without having to track changes in the weights using the chain rule, as is the case with backpropagation or stochastic gradient descent. In addition to the aforementioned, QuickProp updates the weights in a multiplicative manner, allows it to suit the large fluctuations in traffic that an IoT device experiences during its lifetime. On the contrary, when SEHIDS decides that it is necessary to recruit a new layer, it proceeds to determine the number of neurons in this new layer. The main goal of this determination is to extend the hypothesis space of the current SEHIDS architecture so that it can capture the intrinsic properties of the packets well without overburdening the resources of the devices. To achieve this goal, this study uses the Welch-Satterthwaite approximation [73] to calculate the freedom degree of the model (i.e., the degree of freedom is the consummate number of independent variables required to represent the dataset) and then modify the model accordingly. In mathematical parlance, let \(\|c_{i}\|\) is the number of instances of the \(i\)th class, \(\sigma(\epsilon_{t}|c_{i})\) is the standard deviation of the \(i\)th class prediction errors and \(\lfloor\cdot\rfloor\) be the floor function.