# HH-NIDS: Heterogeneous Hardware-Based Network Intrusion Detection Framework for IoT Security
## 3 Materials and Methods
### Hh-NIDS Framework  
Figure 1 illustrates the proposed HH-NIDS framework architecture. The data processing flow is described in three phases, namely _Data Pre-processing_, _Model Generation_, and _Hardware-based Inference_. Data Pre-processing is the first phase in the HH-NIDS framework to generate data for training and inference processes. HH-NIDS applies a supervised learning neural network approach for detecting network attacks; thus, the chosen dataset should contain labelled records. The raw data (network packets) can be used in the inference phase for demonstrating the real-time network classification process. Besides the Dataset block, there are five main functional blocks in this pre-processing phase:  
Figure 1: The proposed HH-NIDS framework architecture. * _The Data Filtering block:_ scans the processed dataset (labelled records) and buffers all of the IPv4 records, which make up the majority of the dataset, as input data for the next blocks. In other words, this block creates a custom filter for selecting input records based on the administrators' defined rules. * _The Classification block:_ examines the labelled data, and then collects records that have the same label to a new file. The number of new files is equal to the number of dataset labels/classes (benign and attacks). * _The Scaling block:_ reads the created data files and transforms the record's features, which are initially in alphanumeric or numeric forms, to float values (between 0 and 1) using min-max normalisation. * _The Shuffle block:_ rearranges records according to different training schemes. In addition, data balancing can be applied in this block for better data distribution. Although the network data can be provided with time-based information, this block shuffles these records for the neuron network models to learn static information in the network packets. * _The Formatted Data block:_ holds shuffled data files from the previous block; the data are ready to be used in the training and inference processes. Model generation: this phase includes training, inference and quantisation processes. In the beginning, the training process generates NN models that use GPU-based approaches; then, these models are quantised to fit in accelerator platforms in the hardware-based inference phase. The training process can be described using three blocks:  
* _The Model Configuration block:_ has two main functionalities, which are: defining training settings and selecting a custom input feature set from each processed record for training. The output data will be forwarded to the _GPU-based Trainer block_ for training. * _The GPU-based Trainer block:_ follows the ML library architectures (Keras, Tensorflow, Pytorch, etc.) to train NN models. The HH-NIDS framework proposes GPU-based approaches for better training performance compared to CPU-based approaches. * _The Trained Models block:_ stores trained models from the _GPU-based Trainer block_. These models will be used in the next inference phase. Next, the trained models will be evaluated with test data. The administrators can monitor the validation results and select dedicated models for quantisation processes. Figure 2 illustrates the HH-NIDS framework's process flow from training to hardware implementations. * _The Inference block:_ represents the software-based inference process. This block uses the trained models on the allocated data files to evaluate how well the trained models react to unseen data. The chosen models then need to be quantised and tested before being deployed into hardware accelerator platforms. * _The Parameter Quantisation block:_ transforms the model's parameters to the supported bit width to fit into the hardware accelerator platforms. * _The Models block:_ contains quantised models, which will be evaluated again by _the Inference block._  
Hardware-based inference: this phase deploys quantised NN models into hardware accelerator platforms for inference. The HH-NIDS framework proposes using two different platforms: namely, a microcontroller and an SoC FPGA.