# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
## 5 Results and Discussion
### Assessment of the Evolving Process
To detect these types of latent relationships, SEHIDS needs to add more neurons in some layers, which in turn makes some layers in the IoT-BoT' SEHIDS model denser than their counterparts in the TON-IoT 'SEHIDS model. Figure 6: _Cont._  
Further support for this interpretation is provided by comparing the depth and density of the SEHIDS model processing the IoTID20 dataset with the SEHIDS model used as IPS for the BoT-IoT dataset. This comparison shows that some hidden layers in the IoTID20-based model are shallower and sparser than the corresponding layers in the IoT-BoT-based model. These differences can be attributed to the fact that the majority of the records in this dataset are of protocol-based DoS attacks. This type of attack aims to exhaust the resources of IoT devices by abusing the mechanisms of the TCP/IP protocol, e.g., by initialising huge TCP connections but not terminating them, as is the case with the SYN TCP flood attack, or by sending a sequence of HTTP GET/POST requests to reach the maximum number of concurrent connections specified by the devices. The structure of the packets belonging to these types of attacks has common characteristics, which in turn allow the SEHIDS to classify them easily. The evolving behaviour of SEHIDS, which serves as IDS for the IoTID20, shows some interesting results. For example, it can be seen that the number of layers increases rapidly within a short interval and then remains constant before increasing again. This behaviour can be attributed to the fact that this dataset contains several types of attacks, namely: host discovery, Telnet bruteforce, UDP flooding, ACK flooding, and HTTP flooding, which are devised based on the Mirai botnet infrastructure. To enable the accurate classification of these attacks, SEHIDS adds further hidden layers to its architectures to reveal the latent relationships that connect each type of these attacks to the Mirai Botnet. In particular, each of these attacks is preceded by the formulation of the Mirai botnet, which in turn takes place in several stages. In the first stage, the botmaster (the attack) launches the discovery process to find vulnerable IoT devices. Once these devices are located, the botmaster attempts to compromise their credentials and populate the Command and Communication (C2) servers with the compromised devices' information. The botmaster then uses this information to infect the devices with malware that allows the C2 server to dictate to the bots (malicious devices) to carry out certain attacks simultaneously. During these phases, some known services and ports are used: In the discovery phase, talent services are typically used across all ports, e.g., 23, 2323, 7547, 5555, 23,231, and 37,777, TCP and UDP ports 7547 and 555 are the common ports used to send the malware, and port 48,101 is used to facilitate communication between bots and botmasters. If we look at the Mirai formulation procedures and their port numbers, we can see the main reasons why some  
Figure 6: FLOPS of (**a**) BoT-IoT, (**b**) IoTID20, and (**c**) TON-IoT. layers in the SEHIDS are much denser than others. In particular, we see that the SEHIDS needs fewer neurons to classify the types of Mirai-based attacks that use the same ports for botnet formation as the other attacks.