## 3 Proposed Methodology
### Attack Classification  
In this section, an enhanced Deep Reinforcement Learning (DRL) based model is developed for attack classification. The enhancement of DRL is carried out based on the Deep Auto Encoder (DAE) and improved flamingo search algorithm (IFSA). This incorporation is driven by the need for effective feature extraction and robust optimization.  
Figure 1: Flow diagram of the proposed attack classification and response scheme.  
Here, the following two updates are made in the reinforcement learning (RL) model to improve the classification ability.  
* The first update to be made in DRL is the employment of a Deep Autoencoder (DAE) to approximate the Q-function effectively instead of using a Q-table, and a further SVM is used for Q-value prediction.
* The second update to be made in DRL is the integration of an improved flamingo search algorithm (IFSA) for optimal policy selection instead of employing the stochastic gradient descent method.
* Moreover, deep reinforcement learning follows a semi-supervised model that uses a small amount of labeled data and a large amount of unlabeled data to train a model.  
Basically, the RL model utilizes a Q-table to map the relationships between actions and states. However, the Q-table has a mass of states and actions, which could lead to the curse of dimensionality. Therefore, instead of using a Q-table, the DRL uses a Deep Auto Encoder (DAE) to approximate the Q-function that assists in mapping the relationships between actions and states similar to the Q-table. In RL training, the agent selects and executes actions according to the Markov Decision Process (MDP) with the \(\epsilon\) greedy policy, which means the action is randomly selected by the \(\epsilon\) probability. Instead of using random selection, the proposed method used IFSA for optimal policy selection to enhance the ability of MDP.  
The EDRL model uses both labeled and unlabeled data in the semi-supervised learning model of DRL to enhance the classification of attack and normal classes. The initial Q-function is trained by utilizing labeled data, which includes instances of recognized attacks. This permits the model to pick up specific patterns and behaviors associated with these attacks. Establishing a baseline understanding of the normal and abnormal states of the network depends on this labeled dataset. Conversely, a deep AE is employed to process unlabeled data, which can include a combination of regular traffic and unidentified attack patterns. The model can capture the underlying structure of the data without the need for explicit labels due to the deep AE's reconstruction of the traffic features. Then, the Q-function is optimized using the IFSA, which makes it easier to select the best course of action. The model can offer pseudo-labels for the unlabeled data by utilizing the learned feature representations through the incorporation of deep AE's ability with the IFSA. As the model boosts its understanding of the labeled instances and can deduce possible attack patterns from the unlabeled data, this empowers the EDRL to capably leverage the broader distribution of network traffic. Subsequently, the amalgamation of labeled and unlabeled data progresses the model's overall performance in real-world network environments by decreasing the dependence on large labeled datasets and improving its capability to generalize and adapt to new, unseen or sophisticated attack types. This combination not only improves the model performance in finding normal and attack classes but also ensures efficiency and scalability in real-time applications.