# Big Data-Driven Deep Learning Ensembler for DDoS Attack Detection
## 3 Proposed System Model
### Proposed EffiGRU-GhostNet Model
#### 3.7.2 MBConv Blocks  
The EfficientNet design is based on Mobile Inverted Bottleneck Convolution (MBConv) blocks. These building blocks minimize computational complexity while maximizing the network's feature capture and propagation efficiency. Essential parts of the MBConv block include the following:  
**Depthwise Convolution:** The input feature map's channels are each subjected to a spatial convolution separately via the Depthwise Convolution procedure. This procedure effectively extracts spatial information from the supplied data with little processing cost. The mathematical representation of the Depthwise Convolution operation is [35]  
\[\tilde{y}_{\text{depthwise}}=\text{DepthwiseConv}(\tilde{x}_{\text{input}}) \tag{15}\]  
\(\tilde{y}_{\text{depthwise}}\) is the feature map that is produced after Depthwise Convolution, whereas \(\tilde{x}_{\text{input}}\) is the input feature map.  
**Expansion Convolution:** The Expansion Convolution process increases the input feature map's dimensionality to get more detailed feature representations. A \(1\times 1\) convolution is used with more output channels than input channels in this process. This is the mathematical expression for the Expansion Convolution operation [35]:  
\[\tilde{y}_{\text{expanded}}=\text{Conv}(\tilde{x}_{\text{input}}) \tag{16}\]In the input feature map, \(\tilde{x}_{\text{input}}\) is used, and in the output feature map after Expansion Convolution, \(\tilde{y}_{\text{expanded}}\) is used.  
**Squeeze-and-Excitation (SE) block:** The SE block adjusts channel-wise feature responses by explicitly modeling the relationships between channels. This block has two sub-components: squeezing and excitement. The squeeze operation utilizes Global Average Pooling to aggregate global information across geographic dimensions. Mathematically, the squeeze action may be expressed as follows [35]:  
\[\tilde{z}=\text{GlobalAvgPool}(\tilde{y}_{\text{expanded}}) \tag{17}\]  
The global feature vector produced using Global Average Pooling for each channel is represented by the \(\tilde{z}\) symbol. Using channel-wise weights, the excitation operation amplifies beneficial properties while downplaying unimportant ones. The design includes a sigmoid activation function sandwiched between two densely coupled layers that use rectified linear unit (ReLU) activation functions. According to [35], the mathematical expression for the excitation operation is  
\[\tilde{s}=\sigma(\tilde{W}_{2}\cdot\text{ReLU}(\tilde{W}_{1}\cdot\tilde{z})) \tag{18}\]  
The variables \(\tilde{W}_{1}\) and \(\tilde{W}_{2}\) denote the weights of the ultimately linked layers, whereas \(\tilde{s}\) represents the vector that excites each channel individually.  
**Project Convolution:** The Project Convolution procedure restores the original feature dimensionality to the SE block's output. The channel-wise excitation vector derived from the SE block is subjected to a \(1\times 1\) convolution in this step. The mathematical representation of the Project Convolution operation is [35]  
\[\tilde{y}_{\text{projected}}=\text{Conv}(\tilde{s}) \tag{19}\]  
\(\tilde{y}_{\text{projected}}\) is the output feature map after projection convolution, and \(\tilde{s}\) is the channel-wise excitation vector.  
**Skip Connection:** To enable gradient flow and alleviate the vanishing gradient issue, the Skip Connection promotes the flow of information from the block's input to its output. Here is the mathematical representation of the Skip Connection operation [35]:  
\[\tilde{y}_{\text{output}}=\tilde{y}_{\text{input}}+\tilde{y}_{\text{projected}} \tag{20}\]  
where \(\tilde{y}_{\text{input}}\) and \(\tilde{y}_{\text{output}}\) denote the input and output feature maps, respectively, to the block and the addition operation.