# Detecting SPIT Attacks in VoIP Networks Using Convolutional Autoencoders: A Deep Learning Approach
## 3 Proposed Approach
### D1-DCAE Model  
The proposed D1-DCAE model, illustrated in Figure 3, comprises an embedding layer, an encoder consisting of three blocks, and a decoder consisting of another three blocks. Each encoder block comprises a convolutional layer with a 1 \(\times\) 3 kernel and a stride of 1, followed by a max-pooling layer. The filter of the max-pooling layer is a 1 \(\times\) 2 and the stride is 2, resulting in a halving of the number and dimensions of feature maps after each block. The first block in the encoder contains 32 feature maps as a design choice. Thus, this structure leads to a lower-dimensional latent representation \(H\), which is 13 \(\times\) 8. The dimensions of \(H\) are 50 times lower than the dimensions of the input \(X\); consequently, the encoder learns the relevant features of the input data while eliminating noise and irrelevant features. The lower-dimensional latent representation \(H\) can be formulated as follows:  
\[H^{l}=DownSampling\Big{(}f\Big{(}H^{l-1}*W^{l}+b^{l}\Big{)}\Big{)},l\in\{1,2, \ldots,L\} \tag{4}\]  
In Equation (4), \(H^{0}\) represents the input \(X\), \(*\) donates the convolution operation, \(f\) is the RelU activation function, \(DownSampling\) is the max-pooling function, and \(L\) is the number of blocks of the encoder. As a result, the encoder outputs \(H^{L}\), which represents the lower-dimensional latent representation \(H\).  
The decoder is a mirrored version of the encoder, aiming to reconstruct the input from \(H\). Each decoder block features a deconvolutional layer with a \(1\times 3\) kernel and a stride of 1, followed by an upsampling layer with a \(1\times 2\) filter and a stride of 2, resulting in a doubling of the number and dimensions of feature maps after each block. Thus, the decoder outputs \(X^{\prime}\), which has the same dimensions as the input \(X\). The decoder learns how to output \(X^{\prime}\), a reconstructed version of the input \(X\), given the lower dimensional latent representation \(H\). That can be formulated as follows:  
\[X^{\prime l}=UpSampling\Big{(}g\Big{(}X^{\prime l-1}*W^{\prime lT}+b^{\prime l }\Big{)}\Big{)},l\in\{1,2,\ldots,L\} \tag{5}\]  
In Equation (5), \(X^{\prime 0}\) represents the latent representation. \(H\), \(g\) is the same activation function as \(f\), \(UpSampling\) is an upsampling function, and \(L\) is the number of blocks of the decoder, which is the same as the encoder. As a result, the decoder outputs \(X^{\prime L}\) (i.e., \(X^{\prime}\)), a reconstructed version of the input \(X\). After the decoder, a 1D convolution layer with one feature map is added, followed by a flattened layer, in order to reshape \(X^{\prime}\) dimensions to be exactly like the \(X\) dimensions.  
The following is the pseudocode for anomaly detection using the D1-DCAE Model:  
**Autoencoder Model--Encoder Block 1**  
conv1 = ConvolutionalLayer (input, input_channels, 32, kernel_size = 3, stride = 1)  
relu1 = ReLU (conv1)  
pool1 = MaxPooling (relu1, filter_size = 2, stride = 2)  
**Block 2**  
conv2 = ConvolutionLayer (pool1, 32, 16, kernel_size = 3, stride = 1)  
relu2 = ReLU (conv2)  
pool2 = MaxPooling (relu2, filter_size = 2, stride = 2)  
**Block 3**  
conv3 = ConvolutionLayer (pool2, 16, 8, kernel_size = 3, stride = 1)  
relu3 = ReLU (conv3)  
Figure 3: D1-DCAE Model: The encoder part consists of three blocks of convolutional layers and max-pooling layers. The decoder part consists of three blocks of transpose-convolutional layers and upsampling layers. At the end is a convolution layer with one feature map and a flattened layer.