# Research on the Simulation Method of HTTP Traffic Based on GAN
## 3 Materials and Methods
### The Gaussian Mixture Model (GMM)  
Due to the discrete nature of network data itself, which poses significant challenges for downstream tasks, it is necessary to standardize network data for efficient processing. Common data standardization methods include min-max normalization, z-score normalization, etc., which are not suitable for network data. For example, while the maximum value for port numbers is 65,535, another feature such as packet count has a maximum value not exceeding 100. The significant difference in magnitudes would lead to nearly zeroing the port number data if min-max normalization were used, causing substantial difficulties for downstream tasks. Additionally, since downstream tasks require mapping the distribution patterns of real data using AE (autoencoder), traditional data standardization methods are not suitable. The main role of the Gaussian mixture model (GMM) in this paper was to model the data. The specific approach involved modeling each column of the data separately using GMM and saving the index of the selected submodel. This ensured the accuracy of data modeling. A mixture model is a probability model that includes k component distributions to represent the overall distribution. When calculating the probability of observed data in the overall distribution, a mixture model does not require information about the component distributions from the observed data. A single Gaussian model can be classified into two cases: one-dimensional and multi-dimensional data. When the sample data \(x\) is one-dimensional, the Gaussian distribution follows the probability density function can be defined as:\[P(x|\theta)=\frac{1}{\sqrt{2\pi\sigma^{2}}}\exp(-\frac{\left(x-\mu\right)^{2}}{2 \sigma^{2}}) \tag{1}\]  
where \(\mu\) represents the mean (expectation) of the data, and \(\sigma\) represents the standard deviation. When the sample data is multi-dimensional, the probability density distribution of the Gaussian distribution follows Equation (2):  
\[P(x|\theta)=\frac{1}{(2\pi)^{\frac{\theta}{2}}|\sum^{\frac{1}{2}}}\exp(-\frac{ (x-\mu)^{T}\sum^{-1}(x-\mu)}{2}) \tag{2}\]  
Similarly, where \(\mu\) represents the mean (expectation) of the data, \(\Sigma\) represents the covariance, and D represents the data dimension. A Gaussian mixture model (GMM) [20] can be understood as a model composed of multiple individual Gaussian models. The use of multiple Gaussian mixture models is motivated by their ability to better fit the specific distribution of the data. The probability distribution function of GMM is shown in Equation (3):  
\[P(x|\theta)=\sum^{K}_{k=1}\alpha_{k}\phi(x|\theta) \tag{3}\]  
The parameter \(\theta\) in the equation represents the probabilities of occurrence of multiple sub-models' expectations, variances, or covariances in the Gaussian mixture model (GMM). The specific mathematical representation is as follows. The parameter estimation method for GMM uses an iterative algorithm, with the classic algorithm being the expectation-maximization (EM) algorithm. This method involves two steps: the expectation step (E-step) and the maximization step (M-step) to compute the updated model parameters for the next iteration. The visualization of a GMM with K = 3 is shown in Figure 1.  
Figure 1 shows a graphical representation of a GMM model with K = 3. The red, green, and orange lines represent three sub-models, while the blue line represents the estimated probability density function of the GMM model. This blue curve can be used to describe the data distribution and the accuracy of the GMM's modeling. Additionally, we observe a vertical pink line in the figure, indicating the modeling situation of the three sub-models at x = \(-1.5\). Based on the illustration, we choose the model represented by the orange line to represent the data at this point, as it corresponds to the highest probability density. Figure 1: The outputs during training varied depending on different scenarios. A GMM model with K = 3 to describe the data distribution.