# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
## 6 Conclusions and Future Works  
This paper proposed SEHIDS: Self Evolving Host-based Intrusion Detection System as a novel class of ANN lightweight IDS system for IoT networks. The underlying approach of SEHIDS is to provide each IoT device with a small version of an ANN architecture and a resource-friendly mechanism through which the architecture can be trained and evolved as its performance degrades. SEHIDS was proposed to address the desperate need to protect IoT networks from advanced cyber-attacks and was specifically designed to meet their stringent characteristics. This includes retaining the ANN architecture to its near-minimal configurations with the aim of reducing the time and resources required to run it and accelerating the approach to the optimal operation region. In addition, the SEHIDS allows each device to build up its ANN architecture to cope with the threats it faces, which allows SEHIDS to deal with discrepancies and turbulence in traffic amongst nodes. The various advanced approaches and techniques utilised to design SEHIDS facilitate decoupling the simple ANN architecture from the evolving mechanism, which in turn allows us to develop  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Dataset** & **Ref.** & **Architecture** & **Accuracy** & **Precision** & **Recall** & **F1-Score** & **Training Time (s)** & **Testing Time (s)** \\ \hline \multirow{5}{*}{[90]} & [91] & AE & 0.9520 & 0.9700 & - & - & - & - \\ \cline{2-8}  & [91] & ANN with UMF & 0.9907 & 0.9910 & 0.9980 & 0.9900 & 42.40 & - \\ \cline{2-8}  & [91] & C4.5 with UMF & 0.9991 & 0.9990 & 0.9990 & 44.18 & - \\ \cline{2-8}  & [91] & Bagging with & 0.9991 & 0.9990 & 0.9990 & 50.25 & - \\ \cline{2-8}  & [91] & Ensemble with & 0.9998 & 0.9990 & 0.9990 & 56.75 & - \\ \cline{2-8}  & [33] & SVM & 0.4000 & 0.5500 & 0.3700 & 0.1600 & - & - \\ \cline{2-8} IoTID20 & [33] & Ensemble & 0.8700 & 0.8700 & 0.8700 & 0.87 & - & - \\ \cline{2-8}  & [92] & SVM & 0.9700 & - & - & - & - & - \\ \cline{2-8}  & [92] & Ensemble & 0.9400 & - & - & - & - & - \\ \cline{2-8}  & [92] & SLFN & 0.9800 & - & - & - & & \\ \cline{2-8}  & [93] & XGBoost & 0.9979 & - & 0.98 & 1.00 & & \\ \cline{2-8}  & [93] & SVM & 0.9876 & - & 0.98 & 0.9800 & & \\ \hline \multirow{2}{*}{**This work**} & **ReNN +** & \multirow{2}{*}{**1.00**} & \multirow{2}{*}{**1.00**} & \multirow{2}{*}{**1.00**} & \multirow{2}{*}{**1.00**} & \multirow{2}{*}{**1.00**} & \multirow{2}{*}{**4.569**} & \multirow{2}{*}{**9.010**} \\  & & & & & & & & \\ \end{tabular}
\end{table}
Table 2: _Cont._two common types of IDS: the signature-based in which the super-vised architecture, i.e., MLP, is used to classify different types of attacks, and the anomaly-based IDS version, in which an unsupervised architecture, i.e., ReNN, is used to distinguish benign from malicious traffic. The comprehensive assessments demonstrate the high competence of SEHIDS to fulfil the objectives for which it was developed. Indeed, the average achieved true-positive rate is 1. Furthermore, these results show that the resources consumed by SEHIDS are in the order of small fractions of typical IoT devices' resources.  
During the development of this work, several possible future research directions have emerged. One of the most important directions is the use of protocol validation tools that can accelerate the deployment of SEHIDS in a test bed environment. Another important future direction is to extend the functionality of SEHIDS so that it can act as an autonomous host-based IPS. Funding for this study is received from Taif University Researcher Supporting Project number (TURSP-2020/239), Taif University, Taif, Saudi Arabia.