## 3 Proposed Intrusion Detection System
### Extract the Local Proximity Features by Using Packet2 vec Learning
#### 3.4.2. The traditional method uses BFS random walk to obtain network packets with high similarity to the source network packets. BFS can't limit the range of random walks, and it is easy to cause random walk to high-order proximity, as shown in Figure 1b. Therefore, a penalty-based weight update method is introduced, which is called A star. This method is equivalent to adding a penalty constraint on the BFS, so that the range of random walk is within the \(k\)-order proximity of the source network packet. The specific process of the penalty-based weight update method is as follows. First, we calculate the penalty value \(\eta\) according to the empirical formula, i.e., (the pruning threshold \(\varepsilon\approx\) the mean of weights in \(G^{\prime}-depth^{\prime}\)* penalty value \(\eta\)). In detail, we limit the random walk within the \(k\)-order proximity of the source network packet, then \(depth^{\prime}\) is equal to \(k\). This article defines the value of \(depth^{\prime}\) to be 2 in our experimentation. The mean of the edges is the sum of the weights of  
Figure 4: Algorithmic flowchart of packet2 vec learner based on graph representation with penalty. all edges in the relational graph on packets similarity \(G^{\prime}\) divided by the total number of edges; Next, we calculate the penalty term \(g_{vx}\) of the edge according to (5) at each step of the random walk; The sum of the penalty term \(g_{vx}\) and the biased weight \(h_{vx}\) of the edge is calculated according to (4), which is called the penalty-based weight \(n_{vx}\). Then updates the weight value of the edge in \(G^{\prime}\) according to the penalty-based weight \(n_{vx}\). The graph after the weight update is recorded as \(G^{\prime}\_cur\_weight\). Finally, the penalty-based weights of edge below the threshold \(\varepsilon\) are pruned. Therefore, this method has the ability to control the random walk range within the \(k\)-order proximity of the source network packet. Several key operations involved in the penalty-based weight update method are described below. **Biased weight \(h_{vx}\):**\(h_{vx}\) is a biased weight, and the calculation method is as shown in (6), where \(w_{vx}\) is the weight of the edge, and search bias \(\alpha_{pq}\left(v_{pre},x\right)\) has the ability to roughly control the direction of random walk. The calculation method of biased weight is same with that of the transition probability from the current node to the next node in the reference [10]. **Search bias \(\alpha_{pq}\left(v_{pre},x\right)\):**\(\alpha_{pq}\left(v_{pre},x\right)\) has the ability to roughly control the direction of random walks, such as: approximate DFS, approximate DFS. This does allow us to account for the network structure and guide our search procedure to explore different types of network proximities [10]. This paper mainly samples the local proximity of the source network packet, so the random walk of the approximate BFS is used in this paper. The calculation method of search bias \(\alpha_{pq}\left(v_{pre},x\right)\) is shown in (7), where \(x\) is the next network packet, \(v_{pre}\) is the previous network packet, \(d_{v_{pre},x}\) is the shortest path between the nodes \(v_{pre}\) and \(x\). Therefore, the value of \(d_{v_{pre},x}\) is a value in 0, 1, 2. Figure 5 illustrates the method of search bias \(\alpha_{pq}\left(v_{pre},x\right)\) roughly control the direction of random walks. \(\alpha_{pq}\left(v_{pre},x\right)\) defines two parameters \(p\) and \(q\) to guide the direction of random walk. Intuitively, parameters \(p\) and \(q\) control how fast the walk explores and leaves the proximity of starting network packet \(v_{i}\)[10]. **Parameter \(p\):** The parameter \(p\) controls the possibility of revisiting the previous network packet immediately during the random walk [10]. This article mainly uses random walk of approximate BFS, so the value of \(p\) is usually \(\left(p=\max(p,1)\right)\).