# HP-LSTM: Hawkes Process-LSTM-Based Detection of DDoS Attack for In-Vehicle Network
## 5 Experiments
### Experimental Results  
#### 5.2.1 Performance in Training  
In Figure 6, we illustrate the comparative training processes of four HP-LSTM models, based on Equations (13)-(16), against the original LSTM model, based on Equation (12), on our DDoS attack dataset. It is imperative to first emphasize that each training session maintained identical parameters with fixed random seeds, as detailed in Table 6. \begin{table}
\begin{tabular}{c c} \hline \hline
**Training Parameters** & **Value** \\ \hline batch size & 128 \\ \hline epochs & 200 \\ \hline learning rate & \(5\times 10^{-4}\) \\ \hline weight decay & \(5\times 10^{-4}\) \\ \hline random seed of torch & 0 \\ \hline random seed of numpy & 0 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Training parameters. From the results, it can be observed that, post the 100-epoch mark, the HP-LSTM consistently identifies the patterns of DDoS attacks effectively, ultimately achieving a similar or even superior training accuracy compared to an LSTM model. However, a closer look at the training details reveals that each HP-LSTM variant possesses unique characteristics due to its structural features, which influence the training process positively or negatively. Figure 6a showcases the training process comparison between HP-LSTM, based on Equation (13), and the original LSTM, where the deep blue and orange lines, respectively, represent the validation accuracy and training loss of the HP-LSTM and LSTM models. It is evident that the HP-LSTM, by judiciously utilizing the Hawkes parameters of various ECUs within the message flow data, accelerates model convergence. Notably, around the 50-epoch mark, the HP-LSTM exhibits a convergence acceleration phenomenon absent in the LSTM. This phenomenon is also observable in other HP-LSTM variants, offering substantial evidence that Hawkes parameters indeed contribute to the feature extraction from the message flow window. Figure 6b contrasts the HP-LSTM models based on Equations (13) and (14). It can be noted that although Equation (14) introduces an additional bias term D to compute the Hawkes coefficients, ostensibly to enhance the neural network's expressive power, the actual training process is nearly identical to that without the bias term D (as can be clearly seen by the substantial overlap of the dark and light lines). Therefore, it can be inferred that the bias D in Equation (14) has a negligible positive effect. Under equivalent conditions, the HP-LSTM described by Equation (13) is capable of operating with reduced computational power and memory consumption. Figure 6c,d display two other HP-LSTM variants, based on Equations (15) and (16), respectively. Specifically, the \"HP-LSTM ht-chm\" model based on Equation (15) eliminates the exponential operation over \(\beta T_{span}\) in the computation of Hawkes coefficients; the \"HP-LSTM hte-chp\" model based on Equation (16) opts for addition instead of multiplication when applying Hawkes coefficients to process cell values. The experimental results indicate that both of these modifications negatively affect model convergence in the initial stages of training, and only after a number of epochs does the model gradually learn the characteristics in the data. We believe that this is primarily due to the following two reasons:  
Figure 6: Train accuracy and loss of HP-LSTM and comparison models: **(a)** HP-LSTM and LSTM; **(b)** HP-LSTM and HP-LSTM hted-chm; **(c)** HP-LSTM and HP-LSTM ht-chm; **(d)** HP-LSTM and HP-LSTM hte-chp. * In the original Hawkes process, the \(\beta\) parameter represents the intensity of stimulus decay over time and is treated with an exponential function. When simulating this process within a deep learning model, the exponential operation can appropriately reproduce the dynamics originally depicted by the [PERSON] process, thus benefiting the model's learning; conversely, removing it disrupts the stimulus pattern as depicted by the [PERSON] process.