# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
## 4 Methods
### Self Evolving Host-Based Intrusion Detection System  
The proposed SEHIDS comprises two main subprocesses: firstly, initialising subprocesses, which are executed once during the lifetime of a node to set up the initial parameters of the model, and secondly, the PckRsvd subprocesses, which are executed whenever a node receives a new packet. The pseudocode of these subprocesses is shown in Algorithm 1, whereas the detailed descriptions are given below. ```
Input: Stream of packets; \(MTU\); \(C\) Output: Class of each packet Initialisation \(n_{1}^{(1)}\gets MTU\); \(n_{1}^{(L)}\gets C\); \(w_{1}^{(1)}\gets random\) endNew Packet is received \(x_{t}^{(1)}\leftarrow\mathcal{O}(Packet)\)  Generate \(y_{t}^{(L)}\)  Compute \(\epsilon_{t}\) using Equation (3) if\(\epsilon_{t}\geq\epsilon_{t-1}\)then if\(\epsilon_{t}\
otin[C_{1 min},\,C_{1 max}]\)then  Compute \(n_{t+1}^{(L-1)}\) using Equation (7) \(L_{t+1}\gets L_{t}+1\) \(x_{t+1}^{(L-1)}\gets y_{t}^{(L-1)}\) \(y_{t+1}^{(L-1)}\gets x_{t+1}^{(L)}\)  Freeze \(w_{t+1}^{(L-2)}\)  Update \(w_{t+1}^{(L-1)}\) using Equation (6)  Freeze \(w_{t+1}^{(L-1)}\)  Update \(w_{t+1}^{(L-2)}\) using Equation (6) else  Update \(w_{t}^{(L)}\); \(1\leq l\leq L_{t}\) using Equation (6)  end  end
```  
**Algorithm 1**pseudocode of SEHIDS. An IoT device upon joining the network starts to run the initialisation subprocess, which aims to construct a simple version of SEHIDS consisting of two layers, input and output, i.e., \(L_{1}=2\). The number of neurons in the input layer is set to the number of octets defined in the Maximum Transmission Unit (\(MTU\)) of the physical protocol used across the network, i.e., \(n_{1}^{(1)}=\mathcal{O}(MTU)\), where \(\mathcal{O}(\cdot)\) denotes the function used to count the number of octets. The number of neurons in the output layer is set to the number of the classes that packets are allocated to, i.e., \(n_{1}^{(L)}=\|\boldsymbol{C}\|\), and the weight of the first layer is set according to \"Xavier\" initialisation scheme [68], i.e., to random variables that are distributed according to Gaussian probability distribution with zero mean and \(\sqrt{1/\mathcal{O}(MTU)}\) standard deviation. Figure 2: High level abstraction for the evolving of SEHIDS (**a**) at initialisation phase and (**b**) after elapsing some time \(t\). This initialisation scheme was chosen because of its wide applicability in this field. The advantages of the proposed settings are twofold: firstly, it allows SEHIDS to gain insightful information about the packets by examining them deeply at the byte level, and secondly, it makes SEHIDS agnostic to higher communication protocols by operating at the physical layer. This, in turn, extends the portability of the proposed model and makes it possible to mitigate those types of attacks targeting specific types of communication layers. Once an IoT node has constructed its own SEHIDS initial model, it waits until a new packet is received and then executes the PckReved subprocesses. The first step of these subprocesses is to extract the packet contents at the octets' levels and feeds them into the input of the first layer, i.e., \(\mathbf{x}_{t}^{(1)}=\mathbf{\xi}_{t}\) and then proceeds to compute the classes corresponding to this input, \(\mathbf{y}_{t}^{(L)}\). Thereafter SEHIDS computes the error of the predicted value, which is denoted by \(e_{t}\), and defined as the differences between the ground truth of the given input and the output of the model due to that given input using the loss function. Amongst the wide variety of the loss functions that are proposed in the open literature, this study employs cross-entropy loss function, which can be defined as [19]:  
\[e_{t}=\sum_{c=1}^{c=\left\|\mathcal{C}\right\|}\mathcal{T}(\xi_{t,c})\log\left( y_{t,c}^{(L)}\right) \tag{3}\]  
where \(\mathcal{T}(\xi_{t,c})\) is the value of the \(c\)th class of the ground truth fed into the model at the time instant \(t\), and \(y_{t,c}^{(L)}\) is the corresponding values generated by SEHIDS.