## 4 Structural Models
### DenseNet Model  
This section explains the architecture of the used DenseNet. We used class weights, which helped us to optimize scores for a few categories. The dataset was split into test and training sets to avoid overfitting. As an optimization algorithm, the RMSProp optimizer was used. RMSProp's key function is to keep each moving average of the weight of squared gradients. The model is a state-of-the-art DenseNet121 model modified from working on 2D image shapes to work on 1D input vector shapes, e.g., CNN 2D to CNN 1D, or max-pooling 2D to max-pooling 1D, representing the attacks in the datasets, as described in Section 3. We used Densnet121 with depth-of-model (6, 12, 24, and 16) layers and 32 filters. The model consists of one-dimensional generic convolution layers and seven kernels with a stride of two, followed by three max-pooling kernels with a stride of two.  
Each layer delivers its feature maps to the layers below and receives new inputs from the layers above it. The dense block is made up of concatenated layers. Within each block, the dimensions of the feature maps remain constant, but the number of filters varies. A dense block is made up of several interconnected layers. A single layer appears in 1D convolution, batch normalization, and ReLU activation. The transition layer joins two neighbouring dense blocks, since the feature map sizes are the same within the dense block, and the transition layer reduces the feature map's dimensions, followed by 1D global average pooling; its purpose is to gather all of the blocks or outputs from the previous block. Finally, there are fully connected softmax and output layers [29; 30]. The DenseNet architecture is illustrated in Figure 1.  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Type of Event** & **Data Record** \\ \hline Normal & 2,218,764 \\ \hline Generic & 215,481 \\ \hline Exploits & 44,525 \\ \hline Fuzzers & 24,246 \\ \hline Reconnaissance & 13,987 \\ \hline DoS & 16,353 \\ \hline Analysis & 2677 \\ \hline Backdoor & 2329 \\ \hline Shellcode & 1511 \\ \hline Worms & 174 \\ \hline \hline \end{tabular}
\end{table}
Table 5: The total numbers of records in the UNSW-NB15 dataset.  
Each conv block consists of two convolution layers:  
1. Conv_1 consists of kernel 1, stride 1, padding same, number of filters #F;
2. Conv_2 consists of kernel 3, stride 1, padding same, number of filters #4*F.  
**DenseNet121 Model Description**  
**#Function Dense_Block**  
* Input: x = sample  
* Output: stacked layers  
1. For _ in range (block_size):  
a. layer = Conv_Block (x, 4*filters)  
b. layer = Conv_Block (layer, filters, 3)  
c. x = concatenate ([layer, x])  
**#Function Conv_Block**  
1. x = BatchNormalization (x)  
2. x = ReLU (x)  
3. x = Conv1D (input = x, filters, kernel, strides, padding ='same')  
**#Function Transition_Layer**  
1. x = Conv_Block (x, ((x) last dimensional shape)//2)  
2. x = AvgPool1D (input = x, 2, strides = 2, padding ='same')  
**#Function Desnet121**  
1. x = Conv1D (input, filters = 64, kernel = 7, strides = 2, padding ='same')  
2. x = MaxPool1D (input = x, kernel = 3, strides = 2, padding ='same')  
3. For block_size in block_shapes [6, 12, 16, 24]:  
a. s_block = Dense_Block (x, block_size, filters)  
b. x = Transition_Layer (s_block)  
4. x = GlobalAveragePooling1D (s_block)  
5. Output = Dense (input = x, number_class, activation ='softmax')