# An Adversarial DBN-LSTM Method for Detecting and Defending against DDoS Attacks in SDN Environments
## 3 Proposed System
### Adversarial DBN-LSTM Anomaly Detection
We use the DBN algorithm to complete the process of extracting features. In this paper, we define \(v^{(0)}\) as the visible layer. The complete set, which the Classifier model constructs, provides its data. For a neuron \(h_{j}^{(0)}\) in the hidden layer, the activation function is as follows:  
\[P\left(h_{j}^{(0)}\middle|v^{(0)}\right)=\sigma\left(W_{j}\cdot v^{(0)}+a_{j}\right)\]  
In the above function, \(\sigma\) is the activation function, \(a_{i}\) is a bias coefficient and \(W_{j}\) is the weight. For these neurons in the same layer, their activation functions are calculated independently, so they can be identified as follows:  
\[P\left(h^{(0)}\middle|v^{(0)}\right)=\Pi_{j=1}^{N}P\left(h_{j}^{(0)}\middle|v (0)\right)\]  
In the above function, \(N\) is the number of neurons in the hidden layer. Then, we need to implement one-step Gibbs sampling to obtain the value. The calculation function is as follows:  
\[h^{(0)}\sim P\left(h^{(0)}\middle|v^{(0)}\right)\]  
Then, the visible layer and \(h^{(0)}\) will reconstruct the following calculation, which is shown as follows:  
\[P\left(v_{i}^{(1)}\middle|h^{(0)}\right)=\sigma\left(W_{i}^{T}\cdot v^{(0)}+b_{ i}\right)\]\(b_{i}\) is a bias coefficient. The activation functions are also calculated independently for the visible layer's probability distribution. So, they can be calculated as follows:  
\[MaxE_{x\sim P_{data}}[logD(x)]+E_{y\sim P_{G}}[\log(1-D(y))]\]0  
In the above formula, \(M\) is the number of neurons in the visible layer. We will implement one-step Gibbs sampling to obtain the value as well as the calculation function of \(\
u^{(1)}\), as follows:  
\[MaxE_{x\sim P_{data}}[logD(x)]+E_{y\sim P_{G}}[\log(1-D(y))]\]1  
Then, we need to recalculate the activation functions of the hidden layer. The specific calculation is as follows:  
\[MaxE_{x\sim P_{data}}[logD(x)]+E_{y\sim P_{G}}[\log(1-D(y))]\]2  
Finally, we can update the \(W\), \(a\), and \(b\) according to the previously calculated functions. The calculation is as follows:  
\[MaxE_{x\sim P_{data}}[logD(x)]+E_{y\sim P_{G}}[\log(1-D(y))]\]3  
\[MaxE_{x\sim P_{data}}[logD(x)]+E_{y\sim P_{G}}[\log(1-D(y))]\]4  
\[MaxE_{x\sim P_{data}}[logD(x)]+E_{y\sim P_{G}}[\log(1-D(y))]\]5  
In the above formula, \(\lambda\) is the learning rate of the DBN algorithm. When the parameters of \(W\), \(a\), and \(b\) are not changing, the parameters will stop updating. It means these features in the hidden layer can represent the data in the visible layer. Furthermore, the dimension of the hidden layer is significantly less than the visible layer, reducing the difficulty of data processing. After the DBN algorithm steps, the complete set aggregated by the Classifier model can effectively represent the original data with fewer dimension features. Then, the extracted features and reduced dimensions will be sent to the LSTM. In the LSTM, in the training of the time sequence \(t\), the output of the forget gate \(f_{t}\) is determined by the hidden state of the previous sequence \(h_{t-1}\) and current sequence data \(x_{t}\) as follows:  
\[MaxE_{x\sim P_{data}}[logD(x)]+E_{y\sim P_{G}}[\log(1-D(y))]\]6  
\(W_{t}\) and \(U_{f}\) represent the weights of the hidden state of the previous sequence and the current sequence data, respectively, and \(b_{f}\) is the bias coefficient of the forget gate. The output \(f_{t}\) represents the probability of forgetting the previous hidden cell state. Moreover, \(\sigma\) is the sigmoid function.