## 3 Proposed Methodology
### Deep Perceptron Network (DPN)  
After choosing the features, the DPN classifier model is applied to classify the malicious activities in a network according to their pertinent features. This is a deep learning model developed based on the multilayer perceptron neural network. The structure of the DPN is shown in Figure 3; it comprises more than three layers, including input and output layers. In this model, the network is first constructed with the number of hidden layers, and the output vector of the layer (i.e., feature map) is estimated, as shown in the following model  
\[\mathrm{F}_{\mathrm{m}}^{\mathrm{l}}=\mathrm{f}\Big{(}\vartheta^{\mathrm{l}} \Big{)}=\mathrm{f}\Big{(}\mathrm{W}^{\mathrm{l}}\times\mathrm{F}_{\mathrm{m} }^{\mathrm{l-1}}+\mathrm{bias}^{\mathrm{l}}\Big{)} \tag{9}\]  
where \(\vartheta^{\mathrm{l}}\in\mathbb{R}^{\mathrm{N}^{\mathrm{l}}}\) is the activation vector of the \(\mathrm{l}^{\mathrm{th}}\) layer with \(\mathrm{N}^{\mathrm{l}}\) neurons, \(\mathrm{W}^{\mathrm{l}}\,\in\mathbb{R}^{\mathrm{N}^{\mathrm{l}}\times \mathrm{N}^{\mathrm{l-1}}}\) is the weight matrix, and \(\mathrm{bias}^{\mathrm{l}}\in\mathbb{R}^{\mathrm{N}^{\mathrm{l}}}\) represents the bias vector. Consequently, the sigmoid transfer function is estimated, as shown in the following model:  
\[\mathrm{f}(\vartheta)=\frac{1}{(1+\mathrm{e}^{-\vartheta})} \tag{10}\]  
Typically, the activation function must be properly selected according to the type of prediction application. In the proposed framework, the activation function is optimally computed using the TSO algorithm. The posterior probability of class \(\mathrm{j}\,\in\,\{1,\ldots,\mathbb{C}\}\) was determined to be \(\mathrm{Pr}(\mathrm{cls}_{\mathrm{j}}|\mathrm{y})\,\). Here, the softmax function is used to satisfy the posterior probability function, as represented below:  
\[\mathrm{F}_{\mathrm{m}}^{\mathrm{L}}=\mathrm{Pr}\big{(}\mathrm{cls}_{\mathrm{ j}}|\mathrm{y}\,\big{)}=\mathrm{softmax}\Big{(}\vartheta^{\mathrm{L}}\Big{)}= \frac{\mathrm{e}^{\vartheta^{\mathrm{L}}_{\mathrm{j}}}}{\sum_{\mathrm{k=1}}^{ \mathbb{C}}\mathrm{e}^{\vartheta^{\mathrm{L}}_{\mathrm{k}}}} \tag{11}\]  
where \(\vartheta^{\mathrm{L}}_{\mathrm{j}}\) is the element with \(\mathrm{j}^{\mathrm{th}}\) index in the activation of vector \(\vartheta^{\mathrm{L}}\). Moreover, the training process is carried out with the optimized cost function, as represented in the following equation:  
\[\mathrm{Q}\Big{(}\mathrm{W}^{\mathrm{l}},\mathrm{bias}^{\mathrm{l}}\Big{)}= \frac{1}{\mathrm{S}}\sum_{\mathrm{a=1}}^{\mathrm{S}}\mathrm{Q}_{\mathrm{CE}} \Big{(}\mathrm{W}^{\mathrm{l}},\mathrm{bias}^{\mathrm{l}},\mathrm{y}_{a^{ \mathrm{L}}}\mathrm{I}_{\mathrm{l}}\Big{)}+\beta\Big{|}\mathrm{W}\Big{|}_{ \mathrm{F}}^{2} \tag{12}\]  
Figure 3: Structure of DPN. Finally, the predicted classified label can be produced, as shown in the following form:  
\[\mathrm{Q_{CE}}\left(\mathrm{W^{l}},\mathrm{bias^{l}},\mathrm{y_{a}}\right)=- \sum_{k=1}^{C}\mathrm{y_{a}}\left[\mathrm{F_{m}^{l}}\right] \tag{13}\]  
\[\mathrm{cls_{f}}=\mathrm{Q_{CE}}\left(\mathrm{W^{l}},\mathrm{bias^{l}},\mathrm{ I_{f}}\right) \tag{14}\]  
Based on this prediction operation, normal and attacking events are precisely classified in the proposed framework. Moreover, the steps to develop DPN architecture is described in Algorithm 2.