# HP-LSTM: Hawkes Process-LSTM-Based Detection of DDoS Attack for In-Vehicle Network
## 3 Preliminary
### Hawkes Process  
The Hawkes process, proposed by [PERSON] in 1971 [PERSON] (1971); [PERSON] (1971), is a type of linear self-exciting point process that assumes past events will have a positive influence on present events. In this study, we utilized the HP-LSTM model, which incorporates Hawkes process parameters, to capture the temporal characteristics of DDoS attacks, thereby capturing the dynamic behavioral characteristics of the attackers. To elucidate the principle of the Hawkes process, we provide some fundamental background knowledge.  
**Counting process:** A counting process, typically denoted as \(N(t)\), is a type of stochastic process. The mathematical expression for the counting process \(N(t)\) is given by  
\[N(t)=\sum_{i=1}^{n}I(t_{i}) \tag{1}\]  
where \(t_{i}\) represents the time points at which events occur, and \(I(t_{i})\) is an indicator function that equals 1 if an event occurs at time \(t_{i}\) and 0 otherwise. Therefore, the counting process represents the number of events occurring within the given time interval \([0,t]\). Additionally, the counting process satisfies the following properties [PERSON] (1971):  
\[P[N(0)=0]=1,\quad P[N(0)=k]=0,\quad\sum_{k=0}^{\infty}P[N(t)=k]=1 \tag{2}\]  
where \(P[N(t)=k]\) denotes the probability of \(k>0\) events occurring within the time interval \([0,t)\).  
**Intensity function:** The intensity function is commonly denoted as \(\lambda(t)\). For instance, in the case of a homogeneous Poisson process, its intensity function is a constant ([PERSON], 2017):  
\[\lambda(t)=\mu \tag{3}\]  
where \(\mu\) belongs to \(\mathbb{R}^{+}\).  
However, for some point processes that consider additional factors affecting event occurrence rates, we introduce the conditional intensity \(\lambda(t|H)\), where \(H\) denotes additional conditional information. As a self-exciting point process, the conditional intensity function of the [PERSON] process is defined as ([PERSON], 2017; [PERSON], 2017; [PERSON], 2017)  
\[\lambda(t|H)=\lim_{h\to 0}\frac{E[N(t+h)-N(t)|\mathcal{F}_{t}]}{h} \tag{4}\]  
This represents the likelihood of events occurring in the extended region beyond the observed data \(\mathcal{F}_{t}\). Furthermore, the intensity function is defined as follows. Note that the subsequent mentions of the intensity function for the Hawkes process all refer to the conditional intensity function denoted by \(\lambda(t)\):  
Figure 2: Three communication patterns of SOME/IP.  
\[\lambda(t)=\mu+\int_{0}^{t}\alpha(t-s)dN(s) \tag{5}\]  
where \(\mu\) denotes the baseline intensity, and \(\alpha(t-s)\) is referred to as the excitation function.  
The Hawkes process posits that prior occurrences exert a positive influence on present events. In contrast to Poisson processes, which exhibit memorylessness by not considering the impact of historical events on current events, Hawkes processes often incorporate the influence of past occurrences on the present. As indicated by Equation (5), the occurrence of new events leads to an increase in the intensity function, thereby enhancing the likelihood of subsequent event occurrences. Typically, the excitation function is modeled as an exponentially decaying function, reflecting the phenomenon where the influence of events diminishes over time. The excitation function is commonly defined as \(\alpha e^{-\beta(t-t_{i})}\)[37], and the intensity function is parameterized as  
\[\lambda(t)=\mu+\sum_{t_{i}<t}\alpha e^{-\beta(t-t_{i})} \tag{6}\]  
where \(\alpha\) represents the amplitude parameter, \(\beta\) denotes the decay parameter, and \(t_{i}\) signifies the time of the \(t_{i}\) event occurrence.