## 4 Structural Models
### Inception Time Model  
This section explains the Inception Time model architecture. After data are collected and processed, we use class weights. The dataset is split into test and training sets to avoid overfitting. The Adam optimizer is used as an optimization algorithm instead of the standard stochastic gradient descent method to iteratively update the network weights based on training data. Inception Time is used with a depth of 10 layers and 32 filters, with a short layer over 3. For each inception module, three kernels are created from 40//(2'i) as I increases from 0 to 3. Figure 1: DenseNet121 architecture. In the inception network, the Inception Time model was employed in two shapes: one with a 1D input vector shape, and the other with a time-series 2D input shape utilizing the sliding window technique. Each block comprises three inception modules. A bottleneck layer is used to lower the input dimensions (i.e., the depth), reducing the number of parameters and the processing costs. A 1D convolution can be applied as a 1D sliding filter that is able to filter out its discriminate region in the time series, speeding up training and improving generalization. The output from the bottleneck feeds three one-dimensional convolution layers with kernel sizes of 10, 20, and 40. In addition, the inception module's inputs pass through the max-pooling layer of size 3 through the bottleneck layer. The outputs of the four convolution layers are sequenced along the depth dimension through the depth concatenation layer. Except for the sequence layer, all layers have the same stride and padding. However, all convolution layers come with 32 filters, and residual connections are used for every third inception module. The network consists of a series of inception modules followed by a batch normalization layer, GlobalAveragePooling1D layer, and a dense layer with a softmax activation function [31,32]. The Inception Time architecture is illustrated in Figure 2.  
As shown in Figure 3, the inception module is the most critical component of Inception Time. The first layer acts as a bottleneck, reducing the inputs' dimensionality, the number of parameters, and the computational cost, allowing for faster training and improved generalization. The inception module's second major component is a set of parallel convolutional layers of varying sizes that work on the same input feature map. Figure 3 depicts three unique convolutions with filter sizes of 10, 20, and 40. The third layer is the max-pooling layer, which gives the model the capacity to be invariant to tiny perturbations. The depth concatenation layer is the fourth and final layer; it concatenates the outputs of each independent parallel convolution and the max pooling to produce the current inception module's output multivariate time series. Figure 2: Inception Time architecture. It is critical to \"learn\" the characteristics from all prior windows, regardless of the attack occurrence, to develop a thorough model of the network patterns in the entire dataset. Using a sliding window technique, in which a single packet goes through each window to see if the previous (T \(-\) 1) packets have resulted in an attack in the current package, Figure 4 depicts this model. A single window with T packets and n features, with multiple labels for the entire window illustrating the attack in the last packet, and using the deep learning model to determine the attack in the T package, requires learning from the information of the windows' (T \(-\) 1) component packets.