# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
###### Abstract
However, NIDS can provide global protection for the entire network, it has several shortcomings, such as a single point of failure and a lack of ability to detect internal malicious activities. Stimulated by these shortcomings, the host-based IDS (HIDS) was proposed [12; 13]. The key concept on which this approach is based is to equip each IoT device with an IDS mechanism so that it can autonomously detect cyberattacks. Various approaches have been used to develop HIDS: statistical analysis [14], pattern recognition [15], and rule matching [16], to name a few. However, the high proficiency of Artificial Intelligence (AI) makes it the de facto approach for the development of most contemporary IDSs [17; 18]. Therefore, this study adopts one of the widely used AI approaches: Artificial Neural Networks (ANNs) [19]. The main reason for choosing ANN over other AI approaches, e.g., Support Vector Machine [19], XGBOOST [20], or Random Forest [21], is the wide variety of architectures that can be implemented by ANN. Multilayer Perceptron (MLP), Recurrent Neuron Networks (RNN), Convolutional Neuron Networks (CNN), Graph Neural Networks, and Modular Neural Networks are some popular examples. In addition, ANN can be constructed to carry out various tasks such as regressors, classifiers, replicators (e.g., Replicator Neuron Network (ReNN) and autoencoders), and/or generators (e.g., generative adversarial networks) and can adapt various learning strategies including supervised, semi-supervised and unsupervised. Another important reason for using ANN in this study is its great scalability, which allows multiple shallow networks to be cascaded to form a deeper network. Interestingly, the great competence of ANN is justified by the universal approximation theory [22], which proves the ability of the ANN architecture to approximate an arbitrary dynamical system from a set of observations generated by that system to some degree of accuracy without having to track the internal states of the system. However, the high computational cost that ANNs require, in conjunction with the stringent characteristics of IoT networks, stands against the straightforward deployment of ANN algorithms on these networks. A typical IoT network consists of a set of scarce resource devices with an ad hoc topology and heterogeneous traffic patterns [1; 2; 3; 4; 5]. The resource scarcity of IoT devices is driven by the need to miniaturise these devices to such sizes that make it feasible to embed them into different objects. The ad hoc topology is a direct consequence of the fact that an IoT network is typically deployed to harvest information from a specific physical environment, which presumably has its own unique structure. Finally, the heterogeneity of traffic across an IoT network is due to the co-existence of different types of nodes (e.g., monitoring, alerting, and telemedicine), each of which has its own traffic characteristics. In addition, the short transmission ranges of IoT devices, combined with the fact that the batteries of some devices run out faster than others, increase the need to redistribute traffic on a regular basis. This, in turn, amplifies the heterogeneity and turbulence of traffic amongst nodes. Encouraged by the benefits of using ANN algorithms in IoT and other resource-constrained networks, several resource thinning techniques have appeared in the open literature, such as transfer learning [23], federated learning [24], and quantisation [25]. The idea of transfer knowledge is to offload the most expensive resource operations (i.e., batch training) to flagship devices thereafter to make the trained model available to run over tiny devices. Transfer learning can save the time and resources required to train the model. However, the lack of a well-representative training dataset for IoT traffic makes it challenging to ensure that the trained model is appropriate for the traffic it will face at deployment (i.e., negative transfer [26]).