# A Novel Deep Learning Framework for Intrusion Detection Systems in Wireless Network
## 2 Materials and Methods  
### Definition of the Problem  
Our proposed strategy is based on IP data packets. Based on the idea of how reference [62] processed the sequence and time-series data, we assume that each data packet \(X\) at a specific time \(t\) has \(n\) features \(x\), indicated as the vector \(X^{(t)}=\left(x_{1}^{(t)},x_{2}^{(t)},\ldots x_{n}^{(t)}\right)\), with the label \(Y^{(t)}=\left(y^{(t)}\right)\). These features describe the IP packet information recorded by the monitor, and the label indicates the packet's behavior type. The set of data packets containing its characteristics and categories is denoted\[\begin{array}{l}\left(\left(x_{1}^{(t)},x_{2}^{(t)},\ldots x_{n}^{(t)}\right), \left(y^{(t)}\right)\right)\right)\text{. Any packet sequence (or data traffic flow) }F_{period}\text{ at the time }\\ t+u\text{ in the future, or }t-u\text{ in the past, where }u=0,1,2,\ldots,U\text{, may be expressed as:}\\ F_{period}=\left(F^{(t\pm u)}\right)=\left(X^{(t\pm u)},Y^{(t\pm u)}\right)\\ =\left\{\left[\left(x_{1}^{(t\pm u)},x_{2}^{(t\pm u)},\ldots x_{n}^{(t\pm u)} \right),\left(y^{(t\pm u)}\right)\right],\ldots,\left[\left(x_{1}^{(t\pm U)},x _{2}^{(t\pm U)},\ldots x_{n}^{(t\pm U)}\right),\left(y^{(t\pm U)}\right) \right]\right\}\text{.}\end{array} \tag{1}\]  
Following Equation (1), we denote \(B\) as the number of past packets (or received packets), where \(b=B,\ldots,3,2,1\). The past packet sequence \(F_{past}\) is:  
\[F_{past}=\left(F^{(t-b)}\right)=\left(X^{(t-b)},Y^{(t-b)}\right)=\left(F^{(t- B)},\ldots,F^{(t-3)},F^{(t-2)},\ F^{(t-1)}\right)\text{.} \tag{2}\]  
Similarly, we denote \(S\) as the number of observed packets in the future, where \(s=0,1,2,\ldots,S\). The future packet traffic flow (or the upcoming flow) is the sequence \(F_{future}\) and contains the set of future data packets:  
\[F_{future}=\left(F^{(t+s)}\right)=\left(X^{(t+s)},Y^{(t+s)}\right)=\left(F^{(t )},\ F^{(t+1)},F^{(t+2)},\ldots,F^{(t+5)}\right)\text{.} \tag{3}\]  
Our approach applies a hybrid DL model that contains a detection model and a classification model (respectively referred to as detector and classifier) to manage two different tasks; we separate \(F_{future}\) into two terms \(F_{future_{dd}}\) and \(F_{future_{clf}}\), which differ only from each other in their labels \(Y^{(t+s)}\):  
\[F_{future_{dd}}=\left(F_{det}^{(t+s)}\right)=\left(X^{(t+s)},Y_{det}^{(t+s)} \right)\text{,} \tag{4}\]  
\[F_{future_{clf}}=\left(F_{clf}^{(t+s)}\right)=\left(X^{(t+s)},Y_{clf}^{(t+s)} \right)\text{.} \tag{5}\]  
Given the input of a past IP packet sequence, we can attempt to predict the type of traffic (normal and attacks) of each future data packet through two tasks:  
* Task 1: Receive the input packets and predict the behavior of future packets as normal or abnormal: \[\widehat{F_{future_{dd}}}=\underset{F_{future_{dd}}}{\operatorname{arg\,max}}P \big{(}\big{(}F_{past}\big{)}\big{)}\text{.}\] (6)
* Task 2: Predict the types of attack for any packet detected as abnormal in Task 1: \[\widehat{Y_{clf}^{(t+s)}}=\underset{Y_{clf}^{(t+s)}}{\operatorname{arg\,max}}P \big{(}\widehat{F_{future_{dd}}}\big{)}\text{.}\] (7)