# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
## 2 Related Works
This model consists of two autoencoder architectures: the first is trained on labelled datasets; the knowledge gained is then stored and transferred to the second autoencoder architecture, whose main task is to find out the class of unlabelled attacks. The results reported in this paper show the advantages of transfer learning in detecting unlabelled attacks. However, one of the major limitations of this model is the significant latency required to train and then transfer the knowledge to each device. Ref. [47] is another transfer learning-based model developed to transfer knowledge for new devices and as well as new attacks. This model employs Genetic Programming (GP) and uses Routing Protocol for Low-power and Lossy Networks (RPL) to evaluate the prediction accuracy. However, the author of this paper cites the problem of code bloat as the major limitation of his proposal. Federated Deep Learning is another approach that has been utilised to develop IPS. DeepFed [48] is designed to detect attacks on industrial cyber-physical systems by empowering each device with a deep learning model consisting of multiple CNNs, gated recurrent units and MLPs. These models are trained locally by each node, and their weights are routed to a designated server whose main task is to aggregate these weights and then disseminate them back to each node to update its weights accordingly. In this way, each node can know about attacks detected by other nodes. In addition, DeepFed uses a cryptographic asymmetric key mechanism to ensure the confidentiality of the communication between the devices and the server. The results reported in this paper show the superiority of this model compared to some selected models using a self-generated dataset with an overall accuracy of up to 99.2%. Investigating the benefits of supervised and unsupervised federated models in detecting IoT malware has been proposed in [49] using MLP and autoencoder architectures, respectively. This paper assesses the performance of the federated learning approach by developing different test scenarios using the N-BaIoT dataset and concludes that the accuracy of the models lies mainly in the method used by the server to aggregate the weights received from nodes. It also points out the profound impact of the adversarial attacks on the federated learning-based models, especially in the unsupervised scenario. In order to overcome the main weaknesses of the federal and transfer learning approaches, the work presented in [50] combines these two approaches to develop a hybrid model. This work considers the case where two networks that use different feature sets to characterise attacks need to exchange their knowledge. The model of this work uses federated learning as an internal learning technique and transfers learning to exchange knowledge. The intensive evaluation presented in this study shows that the accuracy of the model is strongly influenced by the heterogeneity of the feature sets used by the different networks. Another design approach that has appeared in some work is to treat traffic as images and/or text and then apply the deep learning models that are typically used to classify these types of data sources to detect the attacks. Refs. [51; 52; 53; 54; 55; 56] are some examples of those models that handle traffic as images; basically, these models convert binary encoded traffic into images and then process them using an ANN model consisting of a set of convolutional and MLP layers. Although these works show that different attacks have different visual representations, the information leakage that results from converting traffic to images may affect the ability of these models to detect advanced attacks. Ref. [53] are amongst those works that use natural language processing techniques to handle traffic. This work uses the sequence of abnormal operating system calls to identify malicious behaviour. However, in the absence of a benchmarking dataset for these calls, the authors deployed several types of attacks on an IoT device and captured their corresponding system calls.