## 3 Proposed Model
### Stage 2: Using HDL in Anomaly Detection  
In order for botnets to be efficiently detected and classified, the HDL method can be used. Synthetic well log curves can be created using Bidirectional Encoder Representations from Transformers (BERT); this is the best approach, as it takes into account the value of the well logs and follows a systematic sequence along the depth. This is important as it is capable of transmitting data from nearby depths with depth-term dependence, as well as being able to obtain data from a sequence [48; 49]. Moreover, good results have been obtained from the use of the FET and attention mechanism to extract high-level features. BERT consists of two main arms, with one performing feature selection with a two-layer BERT and attention module, and the other using an FET to capture well log features.  
In terms of well log measurement, Equation (5) formulates the X sequence matrix along the depth.  
\[\begin{array}{cccc}x_{1}^{1}&x_{1}^{2}&\ldots&x_{1}^{n}\\ x_{2}^{2}&x_{2}^{2}&\ldots&x_{2}^{n}\\ \vdots&\vdots&\vdots&\vdots\\ x_{1}^{1}&x_{2}^{2}&\ldots&x_{i}^{n}\\ \vdots&\vdots&\vdots&\vdots\\ x_{d}^{1}&x_{d}^{2}&\ldots&x_{d}^{n}\end{array} \tag{5}\]  
where the attributed value of \(n\) well logging at \(d\) depth is \(\chi_{d}=\left(x_{d}^{1},x_{d}^{2},\ldots,x_{d}^{n}\right)\); the set \(\chi_{d}=\left(x_{d}^{1},x_{d}^{2},\ldots,x_{d}^{n}\right)\) denotes the value for a particular well log curve along the depth, e.g., GR, CNL, and SP; and \(y_{i},\ldots,y_{d}\) represents the predicted well log measurements. \(X\) is the output and \(Y\) is the input for the FET-RNN-AT algorithm.  
In the FET phase, X is sent along to the convolution operator. Here, a one-dimensional convolution operator uses 128 filters with a window size of 1 applied over the depth sequence to obtain lower-level features from the newly acquired well log data. Then, the size of the feature mapping is reduced through the use of max-pooling. Overfitting in the FET is mitigated by using a dropout function, and ReLu is used as a nonlinear activation function. The final step is the adoption of a dense layer consisting of 120 neurons in order to conduct the linear function, during which a fattened layer switches the dimension's path.  
The well log's context data can be obtained using the two-layer RNNs. The BERT with 60 cell units captures the data from the current log sequence and is able to learn the data from the previous log point, meaning that the feature obtained by BERT is considered as being two representations of the well log. In the attention layer process, the attention model emphasizes the log curve's key features in order to reduce the effect of non-key features in the well log. There is a softmax function included in the attention layer, along with an FC unit containing 100 neurons. The tanh function is the nonlinear activation function in the BERT layer. The extraction feature in BERT is implemented through an attention layer, which is subsequently combined with the output of the FC unit. After the attention layer comes a single dense unit, and the output from the FET and BERT-AT branches are concatenated and then passed through a final dense layer containing a single neuron. This results in the predicted output \(Y\) being created in the FET-RNN-AT model.