## 4 Methodology
### Doa-Bpnn Model  
This section presents the proposed DOA-BPNN model, in which the DOA algorithm is used to globally optimize the weights and biases of the BP neural network. Inspired by brain-like cognitive behavior, DOA improves the quality of weight initialization, thereby solving common limitations of traditional BP networks, such as vulnerability to local minima and slow convergence. The optimized weights and biases serve as the initial parameters for the network, which are further refined using the classical backpropagation algorithm to enhance convergence precision and robustness. The overall framework of the DOA-BPNN model is illustrated in Figure 4.  
Step 1: DOA-BPNN Model Initialization. The model begins by defining the topology of the BP neural network, including the number of input dimensions (corresponding to the selected features), the number of neurons in the hidden layer, and the number of output classes. The initial weights and bias vectors of the neural network are encoded as parameters in the optimization space of the DOA algorithm. Step 2: DOA Parameter Initialization. The required parameters for the DOA algorithm are set, including population size, dream dimensions, forgetting rate, and the number of iterations. All individuals in the population are randomly initialized, with each encoding a set of neural network weights and biases. The fitness evaluation criterion is defined directly using the classification accuracy, where higher accuracy reflects better fitness, aligning the optimization goal with maximizing detection performance. Step 3: Iterative Weight Optimization and Fitness Evaluation. In each iteration, DOA performs memory recall, forgetting and reconstruction, and dream-sharing strategies to generate a new population of candidate solutions. Each individual represents a combination  
Figure 4: Workflow of the DOA-BPNN model. of weights and biases, which are applied to the BP neural network for forward propagation. The classification error is then computed as the fitness score and returned to the optimizer. Step 4: DOA-Based Weight Update. The best solution is updated based on the fitness evaluations, and individual dimensions are adjusted. The optimization terminates when the maximum number of iterations is reached or if no improvement is observed over several consecutive generations. Step 5: BP Network Training and Refinement. The optimal weights and biases obtained from DOA are used in the BP neural network as initialization. The model is then trained using the standard backpropagation algorithm on the training set to further refine the parameters and improve classification accuracy. Step 6: Model Prediction and Output. Upon completion of training, the DOA-BPNN model is used to predict test data labels (attack types). The results serve as input to the subsequent risk scoring and response decision modules. Specifically, in our DOA-BPNN, the parameter optimization problem is defined as a search space optimization problem:  
\[\min_{\omega\in\Omega}F(\omega)=1-A_{cc}(\hat{g},y) \tag{7}\]  
where \(\omega\) represents the parameters of BPNN, including weights matrices \(W\), biases vectors \(b\), \(A_{cc}(\cdot,\cdot)\) is the accuracy measurement function, and \(\hat{y}\) is the output of BPNN when the input is \(X\). First, we initialize the BPNN parameters:  
\[X_{i}=W_{init}+\delta_{i},i=1,2,...,N_{pop} \tag{8}\]  
where \(W_{init}\) is the BPNN initialization parameter, \(\delta_{i}\sim\mathcal{U}(-1,1)^{D}\) is a uniformly distributed random vector, and \(N_{pop}\) is the population size. Next, we apply the DOA algorithm to optimize BPNN. After initializing the total number of iterations \(T_{max}\), with the exploration phase boundary defined as \(T_{d}=0.8\cdot T_{max}\), and the probability of random forgetting \(u=0.6\), the optimization proceeds in two phases: exploration and exploitation. During the exploration phase (\(t<T_{d}\)), varying levels of forgetting intensity are assigned to each population group, and parameters are updated according to the following steps.