# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
## 2 Related Works
The later CNN model consists of two convolutional layers with max-pooling, flat and dense layers. Despite the high-performance readings reported by the aforementioned works, the main shortcoming in the development of NIDS based on measuring resource misuse is that it cannot be used to detect those types of attacks that do not consume noticeable resources, such as passive attacks or those that do not take much time to compromise devices such as Botnet. To overcome this shortcoming, some work has used traffic analysis to develop NIDS. The work presented in [41] employs a deep learning approach to develop a novel online and anomaly-based NIDS that uses raw data packets as the input. The proposed system, named Kitsune, consists of the following five components: Packet Capture, Packet Parser, Feature Extraction, Feature Mapping and Anomaly Detector. The main task of Packet Capture, as its name implies, is to capture the incoming and outgoing raw packets traversing the monitored network. The output of this module is then passed to Packet Parser, whose main task is to extract the meta information such as arrival time, sequence numbers and packet sizes. Feature Extractor is the third module, which is used to extract the most relevant information from the supplied metadata and then combine it into tuples using the damped incremental statistics algorithm. The Feature Mapper then applies some dimensionality reduction algorithms to transform the supplied data into the shape that matches the dimension of the input layer of the Anomaly Detector component. Finally, the Anomaly Detector, which acts as the main component of Kitsune, consists of two other subcomponents: Ensemble and Output, each of which is defined in a group of three layers based on the MLP autoencoder architecture. During the training phase, Ensemble is used to allow Kitsune to recognise the behaviour of benign traffic, while in the testing phase, Ensemble is used to pass the prediction error to the Output subcomponent. Output is responsible for the final decision on the input packet. Kitsune uses stochastic gradient descent to facilitate online training of the model and adaptive damped windows to limit memory usage without setting a hard threshold. The performance of Kitsune was evaluated using an attack dataset generated from custom-built networks to mimic a smart home environment. The results of this evaluation show that increasing the number of layers in Ensemble reduces detection time and increases classification accuracy. However, these results also show that some types of attacks, such as DoS, cannot be detected by Kitsune at an earlier stage, as a long sequence of operations (parsing, extraction, and mapping) must be performed on numerous packets before DoS behaviour can be identified. Another serious shortcoming of Kitsune is that it must be trained with benign traffic. Failure to do so not only results in significant performance degradation but also leaves Kitsune vulnerable to adversarial machine learning attacks. Interestingly, this vulnerability limits the ability to use Kitsune to secure running networks. Realguard [42] is an ANN-based Network Intrusion Prevention System (NIPS) that follows the same approach as [41] but has been optimised to reduce computational complexity by combining some of the components of Kitsune. An active manager component has also been added as a means to specify the preventive and/or reporting actions to be taken when intrusive traffic is detected. In addition, Realguard uses the MLP architecture to develop a DNN consisting of five hidden layers with a total of 34,315 parameters without using an autoencoder architecture such as Kitsune. The results of this work show that Realguard can achieve an overall accuracy of 99.57% at a processing rate of 10,600 packets per second on the CIC-IDS2017 dataset using the Raspberry PI as an evaluation environment.