# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
## 4 Methods  
The main contribution of this study is to devise a lightweight yet effective scheme via which the intrusions can be detected by each IoT device autonomously. The proposed scheme is dubbed (SEHIDS) Self Evolving Host-based Intrusion Detection System as it allows each node to build up its own ANN model based on its performance concerning the characteristics of the received traffic. Interestingly, SEHIDS utilises the built-in loss function of ANN to trigger the evolving process; this, in turn, allows SEHIDS to be used  
Figure 1: Distributions of classes and subclasses of the three datasets used in this study. with different sorts of architectures. This study exploits this capability to develop the two common IDS systems: signature-based IDS using MLP architecture and anomaly-based IDS using Replicator Neural Network (ReNN) architecture. In essence, an MLP is a computational directed acyclic graph that has been developed to imitate the Biological nervous system. The building block of MLP is the artificial neuron which consists of the vector of learnable parameters and an activation function that is used to inhibit or excite these parameters with the aim of approaching the optimal mapping of the inputs to their corresponding outputs. The output is defined in accordance with the purpose for which the MLP model is created; when MLP is used as a classifier, the predefined class of the given input is used as the output, and while when MLP is used as a regressor, the successor instance of the input is used instead. By providing the ground truth to the MLP, it is commonly used as a supervised learning architecture. A typical MLP comprises an input, zero or more hidden, and an output layer where each layer comprises a set of neurons. The open literature is populated with plenty of studies that have utilised ANNs to solve sophisticated problems in vast and diverse fields [17; 18; 19]. Interestingly, the great competency exhibited by the ANN is justified by the universal approximation theory [22]. The ReNN architecture [30] is similar to MLP in that it consists of a collection of learnable artificial neurons, which are arranged in input, hidden, and output layers. However, ReNN is engineered in such a way that allows it to capture the common patterns embodied in the input and then use this captured knowledge to reproduce the input at the output layer. This requires setting the dimensionality of both input and output layers equal. Since this reproduction does not require providing ReNN with ground truth, it is naturally used as unsupervised learning architecture. Instagued by the simple architecture of ReNN, it has been used as an anomaly detector in numerous disciplines, including intrusions in communication systems [29; 57], malignant development in breast cancer, atypical particles in the ionosphere [58], unorthodox biomedical features, aberrate skin lesions, credit card fraud, and segmental speech recognition [59; 60]. Despite the differences between the various architectures, the conventional method used to design most current ANN models is to create a bunch of models with different configurations, evaluate their performance using one or more training datasets, and put the model with the best result into practice. Once deployed, this model remains fixed, regardless of its performance in response to real field data. This method is based on three assumptions: firstly, the abundance of devices'resources on which these models are deployed, so that no trade-off between accuracy and the resources required by the model is necessary. Secondly, the availability of well-representative training data against which the hypothesis space of the model can be tuned before putting it into practice. Finally, the possibility of applying one or more pruning techniques (e.g., dropping out some layers or skipping some connections of layers) when generalisation problems arise. However, these assumptions are invalid in the IoT network domain due to turbulent traffic, lack of a priori training datasets and scarcity of resources.