# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
## 2 Related Works
Furthermore, a comparison between Realguard and Kitsune shows that Realguard is able to reduce CPU usage and memory occupancy by a factor of 0.91% and 0.73%, respectively, compared to Kitsune. Despite the superior performance of Realguard, the authors of this paper point out some of its major limitations, such as the lack of a barrier layer to protect Realguard from adversarial attacks, the need to use an advanced learning approach such as federated learning to enable deployment on multiple edge devices simultaneously, and the significant number of resources required to train the model. Performing all IDS activities by a network device requires equipping NIDS with several components to handle the high volume of traffic traversing the network and then making a decision about it. This sophisticated structure and the need to deploy multiple NIDS in the network to avoid a single point of failure have led some researchers to delegate some IDS activities to IoT nodes instead of performing them all on NIDS. For example, SVELTE [43] was one of the pioneer's IDS systems that was designed especially to comply with the processing capabilities of the constrained nodes by offloading the resource-intensive operations to the border router and keeping lightweight operations to be performed locally by each device. SVELTE allows border routers to draw the baselines of the networks and to detect the IDS threats using a hybrid model that comprises both signature and anomaly techniques. Thereupon, broader routers summarise their findings into a whitelist and disseminate them to the devices. Hence, a device uses this list to handle the harmless packets and forwards unlisted packets to the border router to consult it about them. The results reported by the authors demonstrate the ability of SVELTE to detect sinkhole attacks with 90% and 100% true positive rates over lossy and lossless networks, respectively. However, the requirement that sending suspicious packets over the network to broader routers constitutes the main shortcomings of SVELTE. The work presented in [44] introduces a hybrid IDS model for sinkhole attack detection that takes into account the requirements of IPv6 over Low-Power Wireless Personal Area Networks (6 LoWPAN). The proposed model, named Intrusion detection of SiNkhole attacks on 6 LoWPAN for InterneT of ThIngs (INTI), consists of two phases: cluster formation and routine monitoring. In the first phase, the network is divided into several clusters, each of which has its cluster head. Thereupon, in the routing monitoring phase, each cluster head scans the traffic generated and forwarded by its members for potential sinkhole attacks using a customised algorithm that quantifies the reputation of each node. Furthermore, this model defines a cooperative mechanism to isolate malicious nodes from the network. The performance evaluation conducted in this work shows that the proposed model can detect sinkhole attacks at 75% and 92% and achieve a false negative rate of 8% and 28% in mobile and stationary network scenarios, respectively. Nevertheless, reliance on some devices to monitor the activities of other nodes can accelerate the depletion of their batteries, which in turn leads to significant degradation of the network connectivity degree over time. The work presented in [45] adopts the same approach as [44], except that it uses a simpler algorithm based on the Dempster-Shafer theory instead of the sophisticated algorithm in INTL. The impact of this replacement is seen in the form of improvements in various performance metrics such as throughput, packet delivery ratio and normalised overhead. The success in implementing some IPS functions on IoT devices combined with the rapid development of artificial intelligence approaches paves the way for using these approaches to develop a host-based IPS. The model presented in [46] was designed to enable IoT devices to detect common attacks such as scanning, Transmission Control Protocol (TCP) flooding and User Datagram Protocol (UDP) flooding.