# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
## 4 Methods
### Self Evolving Host-Based Intrusion Detection System
This loss function was used due to its ability to speed up the learning process and its low computational cost, since each dataset instance belongs to only one class and the vector containing \(\mathcal{T}(\xi_{t,c})\) are all zeros except one cell. SEHIDS uses the magnitude of this error to either evolve the architecture of the model or leave it in its current configuration. The core concept on which this decision is made is to conduct a two-tier test: firstly, to test whether or not the prediction error of the current input accelerates the convergence of the residual error to zero. If this convergence is achieved, it means that the architecture of the current model is able to competently process the received traffic, so no change is required. If, on the other hand, the recently added error causes the residual error to deviate from zero, this means that the model is trapped in suboptimal regions, and thereby, SEHIDS must evolve the model to leave this region. The condition that must be met to trigger evolution is that the error in time instance \(t\) is greater than or equal to the error in the previous instance \(t-1\), i.e., \(e_{t}\geq e_{t-1}\). Enforcing this condition ensures that the residual error of the SEHIDS model is strictly monotonically decreasing and bounded below for different architectures. These are the necessary and sufficient conditions to guarantee the convergence of the new and residual error according to the Cauchy criteria [69]. The second tier of testing conducted by SEHIDS is to determine whether or not the error due to the current prediction falls within a 95% confidence interval with respect to the prediction errors generated from the model hitherto. Falling outside this range implies that considerable traffic fluctuations beyond the hypothesis space of the model have occurred, i.e., the number of layers in the current architecture is not coincident with the underlying stochastic processes generating the traffic. Hence, the best remediation for this case is to recruit a new hidden layer to aid a node in distinguishing between the errors generated from the transit (i.e., random) and permanent (i.e., systemic) fluctuations. For the sake of accuracy, this study employs the standard \(Z\)-value [70] to find the minimum and maximum values of a 95% confidence interval of the residual error which denoted by \(CI_{min}\) and \(CI_{max}\) and computed as shown in Equations (4) and (5), respectively. \[CI_{min}=\mathbb{E}(\mathbf{\epsilon}_{\tau})-1.96\ \frac{\sigma(\mathbf{\epsilon}_{ \tau})}{\sqrt{\left\|\mathbf{\epsilon}_{\tau}\right\|}};1\leq\tau\leq t \tag{4}\]  
\[CI_{max}=\mathbb{E}(\mathbf{\epsilon}_{\tau})-1.96\ \frac{\sigma(\mathbf{\epsilon}_{ \tau})}{\sqrt{\left\|\mathbf{\epsilon}_{\tau}\right\|}};1\leq\tau\leq t \tag{5}\]where \(\mathbb{E}(\mathbf{e}_{\tau})\) and \(\sigma(\mathbf{e}_{\tau})\) are the arithmetic mean and standard deviation of all errors generated by SEHIDS since it is initalised at \(t=1\) and up to the time instance at which the confidence interval is computed and 1.96 is the Z-value corresponding to the 95% confidence interval. The selection of this computation method is justified by the traffic of an IoT network is resulted from the interaction of several stochastic processes that are temporally correlated; hence computing the confidence interval requires a rigorous algorithm that can consider the mutual relations between readings at different time steps. If the recent error reading is within a 95% confidence interval, then the SEHIDS realises that there is no massive fluctuation in the traffic and thereby no benefit can be gained from adding a new layer; in such a case, SEHIDS conducts comprehensive training for the current architecture of the model. The main objective of this training is to utilise the output of the loss function, i.e., error, to steer the optimisation algorithm towards the optimal value of the model's weights in the reverse direction from the output layer toward the input.