# A Comparative Analysis of the TDCGAN Model for Data Balancing and Intrusion Detection
## 2 Materials and Methods
### Machine Learning Methods  
We opted for four methods in this study based on their demonstrated effectiveness, as highlighted by several researchers [15; 16; 17; 18]. To assess their performance in data balancing and intrusion detection tasks, we compared them with our proposed model, TDCGAN, as introduced in [11]. Here is a brief overview of each model. Decision trees are a widely used supervised learning technique for both classification and regression tasks. They work by recursively dividing the feature space into distinct regions based on input feature values. Each node in the tree represents a decision criterion based on a particular feature, while the branches illustrate the potential outcomes of these decisions [19, 20]. Random Forest is an ensemble learning technique that constructs multiple decision trees during training and merges their predictions using voting or averaging. Each tree is trained on a random subset of the training data and a random subset of features, which helps mitigate overfitting and enhances the model's generalization performance [21, 22]. Multi-Layer Perception (MLP)  
MLP is a type of feedforward artificial neural network that consists of multiple layers of nodes, including an input layer, one or more hidden layers, and an output layer. Each node in the network is connected to every node in the adjacent layers, and each connection has an associated weight. MLPs are trained using backpropagation and gradient descent to learn the optimal weights that minimize a specified loss function [23, 24]. Naive Bayes is a probabilistic classifier that relies on Bayes' theorem and assumes that features are independent of each other, which is the \"naive\" part of the method. Despite this simplification, Naive Bayes often performs effectively, particularly in text classification tasks. It computes the probability of each class based on the input features and predicts the class with the highest probability [25, 26]. TDCGAN  
TDCGAN, i.e., triple discriminator conditional generative adversarial network, was initially introduced by [11], and subsequently applied for the data balancing and intrusion detection tasks. This model effectively balanced the UGR'16 dataset [27] and detected intrusions with an accuracy of 95%. The TDCGAN framework incorporates one generator and three discriminators, along with an additional selection layer at the end. The generator processes random noise from a latent space to create synthetic data that closely resembles real data, with the goal of evading detection by the discriminators. Each discriminator is a deep neural network with distinct architecture and parameter settings, tasked with extracting features from the generator's output and classifying the data with varying levels of accuracy. At the end of the TDCGAN architecture, a novel component known as the election layer is introduced. This layer aggregates the outputs from the three discriminators and uses an election process to determine the optimal result, selecting the outcome with the highest classification accuracy. As proposed in [11], the generator utilizes points from the latent space to generate data that matches the distribution of real data in the dataset. This process involves employing fully connected layers comprising of an input layer, four hidden layers, and an output layer. The generator produces the data, \(\hat{y}\), by applying the function \(f(x,w)\) to the dataset features, where \(w\) represents the optimized weights of the neural network. The output \(z_{j}^{L}\) of the \(j\)th neuron in the \(L\)th layer is calculated as:  
\[z_{j}^{L}=\sigma\bigg{(}\sum_{i}w_{ji}^{L}\,x_{i}+b_{j}^{L}\bigg{)} \tag{1}\]  
where the notation \(w_{ji}^{L}\) represents the weight of connection between the computing neuron and its \(i\)th input in the preceding layer and \(b_{j}^{L}\) is a bias parameter. The symbol \(\sigma(. )\) is the activation function in the hidden layer. On the other hand, the discriminators aim to classify the data into their respective classes, utilizing a fully connected MLP network.