# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
## 4 Methods
### From MLP to ReNN  
In the previous two subsections, the MLP architecture was used to demonstrate the underlying concepts of the SEHIDS system and the evolving mechanism. This subsection is devoted to discussing the modifications required to be made in order to use ReNN in lieu of MLP. The first modification is related to the values of the initialisation sub-process parameters, which set the number of classes to 2, i.e., \(\|\mathcal{C}\|=2\) instead of the number of classes defined by the corresponding dataset and the number of neurons in the input layers equally to the number of neurons in the output layer, i.e., \(n_{1}^{(L)}=n_{1}^{(1)}\). This is because ReNN is used to distinguish normal traffic from anomalies, which implies that the maximum number of groups is always 2, whereas setting the number of neurons in the output layer in such a manner is to ensure that ReNN can reproduce the input at the output layer that is dimensionally identical, which in turn facilitates the comparison of the other inputs. The second modification is related to the loss function, while the MLP architecture uses cross-entropy to determine the extent to which the classes generated by the model deviate from ground truth; in the ReNN architecture, there are neither classes nor ground truth. Conversely, the ReNN uses the mean squared error as the loss function to measure the average magnitude of the errors between the reproduced and the genuine version of the given input, i.e., \(\epsilon_{t}=\|\mathbf{\xi}_{t}-\mathbf{y}_{t}^{(L)}\|_{2}\). The main reason for using this function is its ability to penalise larger errors more heavily, which in turn makes the model more sensitive in detecting anomalies.  
It is noteworthy that all the above modifications are due to the differences in the architectures between the MLP and ReNN, and that no changes need to be made for the evolving mechanism given in the pseudocode shown in Algorithm 1. This is because this mechanism does not define its own measure space to trigger the evolving process of the model. Instead, the evolving criteria are specified based on the outcomes of the loss function, which is an essential part of any learning algorithm (whether it is supervised, semi-supervised, or even unsupervised). From a deeper perspective, the evolving machine presented in this study can be viewed as a concept drift scheme that adopts the model architecture to minimise the errors of the loss function resulting from fluctuation of the learning environment. The use of this approach to devise evolving schemes for learning-based algorithms is not uncommon. The work presented in [74], for instance, uses a similar approach to evolve a simple version of Spiking Neural Networks and use it as an unsupervised anomaly detector. Another example is the unsupervised Growing Hierarchical Self-Organising Maps, which extend the fixed architecture of unsupervised self-organising maps by measuring the output error and then using it to determine the evolving orientation of the map [75].  
Table 1 summarises the main differences between the initial versions of the MLP and the ReNN.