## 4 The Proposed DC-CAAE Method  
In unsupervised clustering tasks, there are mainly two methods to obtain labels [27]. The first method is to embed data into low dimensional features, and then cluster the embedded features with traditional clustering methods such as k-means algorithm. The second method jointly optimizes the feature extractor and clustering results. We call these two methods _separation analysis_ and _joint analysis_, respectively. A _separation analysis_ means that learning features and clustering data are executed separately, and low dimensional features are clustered after the dimensionality reduction of data features. To solve the problem that the representation learned by the _separation analysis_ is not oriented toward clustering due to its inherent characteristics, the _joint analysis_ shows its advantages. In this paper, we propose to use a DC method of _joint analysis_, which imposes the reconstruction error as a constraint on the basis of the clustering error. These two constraints improve the clustering performance, reduce the distance within a cluster and expand the distance between clusters. The proposed model framework is shown in Figure 3. Algorithm 1 summarizes the process of the proposed method. Details of each processing stage of the method are shown below.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Benign** & **Training** & **Testing** & **Malicious** & **Training** & **Testing** \\
**Data** & **Det** & **Set** & **Data** & **Set** & **Set** \\ \hline BitTorrent & 5049 & 1716 & Cridex & 5595 & 1805 \\ \hline Facetime & 4045 & 1355 & Geodo & 4543 & 1490 \\ \hline FTP & 4660 & 1542 & Htbot & 4346 & 1384 \\ \hline Gmail & 5828 & 1938 & Miuref & 3476 & 1145 \\ \hline MyDQL & 4911 & 1606 & Neris & 5714 & 1940 \\ \hline Outlook & 5014 & 1758 & Nsis-ay & 4100 & 1362 \\ \hline Skype & 4275 & 1414 & Shifu & 6451 & 2220 \\ \hline SMB & 4248 & 1448 & Tinba & 5772 & 1882 \\ \hline Weibo & 4510 & 1496 & Virus & 4399 & 1473 \\ \hline World of Warcraft & 5313 & 1782 & Zeus & 4075 & 1353 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Data segmentation of the training set and test set.  
Figure 3: The model framework of the proposed DC-CAAE method. The model is divided into two steps, CAAE and DC. First, the CAAE network is used to preliminarily train the feature extractor, then DC constraints are added to fine-tune the feature extractor so that the extracted features are oriented toward clustering tasks.  
```
0: Samples \(X\); reconstruction samples \(X^{{}^{\prime}}\); potential representation \(Z\); random Gaussian distribution \(G\); pretraining hyperparameters \(\theta_{pre}\); retraining hyperparameters \(\theta_{re}\); maximum epochs of AAE \(E_{CAAE}\); maximum epochs of DC \(E_{DC}\); hyperparameter \(\lambda\); the number of batches in a training iteration \(B\).
0: Clustering results \(C\).
1: [Pretraining stage]: 1. for \(i=1,2,\cdots,E_{CAAE}\) do: 2. for \(t=1,2,\cdots,B\) do: Sample a batch dataset \(X_{b}\) [Forward propagation]: 3. \(Z_{pre}\), \(X^{{}^{\prime}}_{pre}\gets Net_{CAAE}(X_{b},G)\) 4. \(Loss\ 1\gets L_{BCE}(X_{b},X^{{}^{\prime}}_{pre})\) 5. \(Loss\ 2\gets L_{D}(Z_{pre},G)\) [Backward propagation]: 6. Alternately minimize \(Loss\ 1\), \(Loss\ 2\) 7. Update \(\theta_{pre}\) with \(Loss\ 1\), \(Loss\ 2\)
2: end for
3: end for
4: Save \(\theta_{pre}\).
5: [Deep clustering stage]:
6: Randomly initialize the parameters \(\theta_{re}\)
7: Load \(\theta_{pre}\) 1. for \(i=1,2,\cdots,E_{DC}\) do: 2. for \(t=1,2,\cdots,B\) do: [Forward propagation]: 3. \(Z_{re}\), \(X^{{}^{\prime}}_{re}\gets Net_{CAE}(X)\) 4. \(C\gets Net_{DC}(Z_{re})\) 5. \(Loss\leftarrow(1-\lambda)L_{BCE}(X,X^{{}^{\prime}}_{re})+\lambda L_{C}(X,C)\) [Backward propagation]: Update \(\theta_{re}\) with \(Loss\)
8: end for
9: end for
10: Save \(\theta_{re}\).
11: Test and save the performance of the DC-CAAE model
12: Return DC-CAAE model
```  
**Algorithm 1** Pseudocode of the proposed adversarial-training-based DC-CAAE method for NTC.