# HP-LSTM: Hawkes Process-LSTM-Based Detection of DDoS Attack for In-Vehicle Network
## 4 HP-LSTM Detection Model
### Training Module  
Figure 5 illustrates our training process. Initially, we preprocess the data generated by the SOME/IP generator, primarily by performing OneHot encoding on key fields such as 'Message Type' to make it easier for the model to understand the differences between different categories. The preprocessed data are utilized as input for the neural network and also for calculating the corresponding parameters in the Hawkes process. Subsequently, the preprocessed data and computed Hawkes parameters are fed into the HP-LSTM for training. The HP-LSTM utilizes Hawkes parameters to compute Hawkes coefficients, which act on the calculation of the HP-LSTM cell by constraining the forget gate and input gate. Regarding the structure of HP-LSTM, we propose four different approaches, and in Section 5.2, we compare the original LSTM with these four variants of the HP-LSTM design, resulting in the optimal design approach for the HP-LSTM. Traditional LSTM operations involve a series of gating mechanisms, including input, output, and forget gates, which iteratively update the cell and hidden states, selectively retaining or discarding information across sequences. The following equation describe the LSTM update at time step t:  
\[ \begin{split} i^{t}&\leftarrow\sigma(W_{i}x^{(t-1 )}+U_{i}h^{(t-1)}+b_{i})\\ c^{t}&\gets f^{t}*c+i^{t}\tanh(W_{c}x^{(t-1 )}+U_{c}h^{(t-1)}+b_{c})\\ h^{t}&\leftarrow\sigma(W_{o}x^{(t-1)}+U_{o}h^{(t-1 )}+b_{o})\tanh(c^{t})\\ y^{t}&\gets W_{y}h^{(t-1)}\end{split}  \tag{12}\]  
where \(i^{t}\) represents the input gate, and \(f^{t}\) represents the forget gate. \(C^{t}\) and \(h^{t}\) are the cell state and hidden state, \(y^{t}\) represents the output at time step t, \(\sigma\) denotes the sigmoid function, tanh denotes the hyperbolic tangent function, and \(U\) and \(b\) denote the weights and bias terms, respectively. Figure 5: Training process. However, traditional LSTM structures lack the capability to recognize the precise timing of events and the subsequent impact on future events. Traditionally, time information is encoded into the input data, allowing the neural network to learn autonomously. Conversely, the HP-LSTM aims to address these shortcomings by utilizing parameters derived from the Hawkes process to quantify the influence of events in terms of both stimulation and inhibition, as detailed in Equations (13)-(16):  
* HP-LSTM (our best): \[hks^{t} \leftarrow\tanh(A\alpha^{x}-Be^{\beta^{x}T_{\text{span}}^{x}}+C \theta^{x})\] (13) \[c^{t} \gets hks^{t}*(f^{t}*c+i^{t}\tanh(W_{c}x^{(t-1)}+U_{c}h^{(t-1)}+b_{c }))\]
* HP-LSTM hted-chm: \[hks^{t} \leftarrow\tanh(A\alpha^{x}-Be^{\beta^{x}T_{\text{span}}^{x}}+C \theta^{x}+\text{D})\] (14) \[c^{t} \gets hks^{t}*(f^{t}*c+i^{t}\tanh(W_{c}x^{(t-1)}+U_{c}h^{(t-1)}+b_{c }))\]
* HP-LSTM ht-chm: \[hks^{t} \leftarrow\tanh(A\alpha^{x}-B*\beta^{x}T_{\text{span}}^{x}+C \theta^{x})\] (15) \[c^{t} \gets hks^{t}*(f^{t}*c+i^{t}\tanh(W_{c}x^{(t-1)}+U_{c}h^{(t-1)}+b_{c }))\]
* HP-LSTM hte-chp: \[hks^{t} \leftarrow\tanh(A\alpha^{x}-Be^{\beta^{x}T_{\text{span}}^{x}}+C \theta^{x})\] (16) \[c^{t} \leftarrow hks^{t}+f^{t}*c+i^{t}\tanh(W_{c}x^{(t-1)}+U_{c}h^{(t-1)}+b_{c })\]  
where \(hks^{t}\) represents the Hawkes coefficient; \(\alpha^{x}\), \(\beta^{x}\), and \(\theta^{x}\) are the Hawkes parameters; and A, B, C, and D are learnable weights. Firstly, we proposed the original HP-LSTM structure, which introduces three parameters of the Hawkes process, using \(\alpha^{x}\) to simulate the heightened mutation intensity with increasing \(\alpha\); employing \(\beta^{x}\) to model the decay of stimuli over time; and utilizing \(\theta^{x}\) to simulate the inherent properties of the baseline intensity in the Hawkes process. For HP-LSTM hted-chm, we additionally introduced a learnable parameter D to enhance the expressiveness of the neural network.