## 4 The Proposed G-TIAG
### G-TIAG Architecture  
Given a set of TIAGs containing benign data and five different attack data \(\{G_{1},G_{2},\ldots,G_{n}\}\) and their labels \(\{y_{1},y_{2},\ldots,y_{n}\}\). G-TIAG aims to learn a representation vector \(f(G)\) that can predict each TIAG more accurately, i.e., \(\hat{y_{n}}=g(f(G_{n}))\).  
The most critical part of G-TIAG is the feature representation learning part, which is mainly based on the GCN with the GRU and self-attention as an aid for extracting intrinsic features from TIAGs for training, and the fully connected layer is mainly used for classification. The loss function \(\mathcal{L}\) quantifies the difference between the predicted results and the actual labels, and the value of \(\mathcal{L}\) needs to converge gradually during training. The notations used in the G-TIAG are shown in Table 4.  
Figure 6: Structure of G-TIAG.  
(1) Feature Representation Layer: In G-TIAG, the intrinsic features of each TIAG are learned by a feature learning structure based on the GCN model, aided by the GRU and self-attention. The GCN uses two convolutional layers for feature extraction for the graph constructed under a specific moment. Then, the nonlinear activation function is used to enhance the model's ability to express nonlinear features. The Dropout function is used to avoid the overfitting problem during the forward propagation. The output vector by the GCN is noted as \(X\). Next, \(X\) is further input into the GRU unit to extract the graph's change at adjacent moments. Then, we calculate the state vector \(h_{t}\) in each time step \(t\), obtain the weight vector through the self-attention, and output the final feature representation \(Z_{t}\) at the moment \(t\) according to the weights provided by self-attention. We will describe the representation layer's design in the following subsection.  
(2) Fully Connected Layer: After the feature learning, G-TIAG mainly contains three Linear layers, two activation functions (ReLu), and a Softmax function to obtain the final result. In G-TIAG, we use two ReLu functions between the three Linear functions to increase the ability to represent nonlinear features. For each \(G_{i}\), we treat the output of the Linear functions as a feature vector of \(G_{i}\), denoted as \(f(G_{i})\). Subsequently, \(f(G_{i})\) is mapped into a new hidden space \(F(G_{i})\in\mathbb{R}^{c}\), where \(c\) is the number of independent categories and \(c\) is taken as 6 in this paper. Finally, the probability of \(G_{i}\) belonging to each category is obtained using the Softmax function, which is denoted as \(\hat{y_{i}}\), i.e., \(\hat{y_{i}}=Softmax(F(G_{i}))\).  
(3) Loss Function: G-TIAG uses the cross-entropy \(\mathcal{L}\) as the loss function. \(\mathcal{L}\) is usually used in multi-classification problems to calculate the loss between the predicted and true labels, as shown below.  
\[\mathcal{L}=-\frac{1}{|N|}\sum_{i=1}^{|N|}\sum_{c=1}^{C}y_{i}log(\hat{y_{i}}) \tag{3}\]  
where \(|N|\) is the number of training instances and \(C\) is the number of categories. The experiments find that the gradient of the cross-entropy loss function at the last layer is proportional to the difference between the actual and predicted labels, implying that it converges faster than the mean square loss error function.  
(4) Optimizer: G-TIAG uses the Adam optimizer, which is an algorithm for stepwise optimization of stochastic objective functions based on adaptive moment estimation. We define the optimizer while initializing the learning rate to 0.001 and control the update step size by considering the gradient's first-order moment estimation and second-order moment estimation.