## 2 Related Deep Learning Algorithms
### Different Methods  
In addition to the challenges neural networks face in anomaly detection, it is essential to recognize the existence of alternative methods for detecting anomalies, such as Generative Adversarial Networks (GANs), sequence-to-sequence (seq2 seq) models, or Transformers [24]. These methods offer unique approaches but come with their own set of considerations and potential drawbacks. Generative Adversarial Networks [25] (GANs) are neural networks designed to learn a generative model of input data distribution. In a traditional model, they are composed of a pair of neural networks known as the G generator and the D discriminator. Both networks are trained together and play a competitive \"game\" to learn the distribution of the X input data. The G generator network learns to map from a random noise of constant dimension (Z) to X samples, which strictly resemble elements of input data distribution. The D discriminator learns to correctly differentiate true samples from source data (X) from false samples (X*), which G generates. In each era during training, the G parameters are updated to maximize their capability to generate samples that are impossible to differentiate by D. In contrast, the D parameters are updated to maximize the decoder capability to differentiate true X samples from generated X samples correctly. As the training progresses, G becomes proficient in producing samples similar to X, and D also improves its ability to differentiate true samples from false ones. However, classic GANs do not have a direct mechanism that would allow generating a sample similar to a known sample; therefore, it is impossible to use them in the analysis process to detect hidden contents. This problem can be combated by using modifications of those networks. One such modification is BiGAN [26]. In simple terms, its structure includes a third model, i.e., an encoder that learns from the reversed mapping of the generator; the encoder learns to generate a constant Z vector based on the sample. Due to this change, the input to the discriminator is also modified; the discriminator now adopts pairs of input data that include a hidden representation (Z and Z*) and the data samples (X and X*). Then, the E encoder is trained with the G generator; the G learns the distribution that derives the X samples, considering the hidden Z code, while the E learns the distribution that derives Z based on the X sample. Mappings learned by the GAN components are specific to the data used in the training. For example, the generator component in a GAN trained using cat images will always generate an image that looks like a cat, considering any hidden code. During the test, one may use this property to conclude how much a given input sample differs from the data distribution based on which the model was trained. Sequential models are a class of neural networks designed mainly to learn mappings between data that are best represented as sequences (an analysis of subsequent packets is one of the best cases of their use). Sequential models are usually composed of an E encoder, which generates a hidden representation of input data, and a D decoder, which adopts the representation of the encoder and sequentially generates a set of output data. Traditionally,the encoder and decoder are composed of long short-term memory [27] (LSTM), which is appropriate for modeling time relations within transformed input data. The LSTMs are perfect for modeling data with time dependencies but may be slow during evaluation. Each single token, a sample at the model's output, is generated sequentially in each time step, where the total number of steps is the length of the (appropriately transformed) input vector. It is possible to use the encoder-decoder structure to detect anomalies by changing the sequential model to make it work like an autoencoder, thus training the model to derive the same tokens as input data but shifted by \(1\).