# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
###### Abstract  
The Internet of Things (IoT) offers unprecedented opportunities to access anything from anywhere and at any time. It is, therefore, not surprising that the IoT acts as a paramount infrastructure for most modern and envisaged systems, including but not limited to smart homes, e-health, and intelligent transportation systems. However, the prevalence of IoT networks and the important role they play in various critical aspects of our lives make them a target for various types of advanced cyberattacks: Dyn attack, BrickerBot, Sonic, Smart Deadbolts, and Silex are just a few examples. Motivated by the need to protect IoT networks, this paper proposes SEHIDS: Self Evolving Host-based Intrusion Detection System. The underlying approach of SEHIDS is to equip each IoT node with a simple Artificial Neural Networks (ANN) architecture and a lightweight mechanism through which an IoT device can train this architecture online and evolves it whenever its performance prediction is degraded. By this means, SEHIDS enables each node to generate the ANN architecture required to detect the threats it faces, which makes SEHIDS suitable for the heterogeneity and turbulence of traffic amongst nodes. Moreover, the gradual evolution of the SEHIDS architecture facilitates retaining it to its near-minimal configurations, which saves the resources required to compute, store, and manipulate the model's parameters and speeds up the convergence of the model to the zero-classification regions. It is noteworthy that SEHIDS specifies the evolving criteria based on the outcomes of the built-in model's loss function, which is, in turn, facilitates using SEHIDS to develop the two common types of IDS: signature-based and anomaly-based. Where in the signature-based IDS version, a supervised architecture (i.e., multilayer perceptron architecture) is used to classify different types of attacks, while in the anomaly-based IDS version, an unsupervised architecture (i.e., replicator neuronal network) is used to distinguish benign from malicious traffic. Comprehensive assessments for SEHIDS from different perspectives were conducted with three recent datasets containing a variety of cyberattacks targeting IoT networks: BoT-IoT, TON-IOT, and IoTID20. These results of assessments demonstrate that SEHIDS is able to make accurate predictions of 1 True Positive and is suitable for IoT networks with the order of small fractions of the resources of typical IoT devices. IoT; intrusion detection systems; constructive neural networks +
Footnote †: journal: Physics Letters  
**Vol. 2020**, 2020, 10  
conscripted to execute a distributed denial of service (DDoS) attack against the Dyn domain name service. The volume of traffic generated by this attack was estimated at 1.5 terabits per second and was capable of bringing down several high-profile websites, including Twitter, The Guardian, and Netflix. (ii) Exploiting the vulnerabilities of IoT devices to destroy them, as in the case of BrickerBot.1 [7] and its successors: BrickerBot.2, BrickerBot.3, and BrickerBot.4 [8], which focus on compromising IoT devices and corrupting their storage to form what is known as a Permanent Denial of Service (PDoS) attack. (iii) The use of electromagnetic waves to attack microelectromechanical subsystems of IoT devices, as in the case of the Sonic attack [9], which uses tuned acoustic tones to deceive accelerometers of IoT devices in such a way that transfers control of the deceived devices to the intruder. In addition to the aforementioned, other attacks aiming to breach IoT privacy have also been reported in the open literature, such as Smart Deadbolts [10] and Silex [11]. Protecting IoT networks from cyberattacks is carried out conventionally by deploying a Network Intrusion Detection System (NIDS) on edge devices such as border routers or access points [12; 13]. NIDS scans incoming and outgoing traffic traversing the network with the aim of identifying suspicious actions that threaten one or more security aspects.