# Multi-View Cluster Structure Guided One-Class BLS-Autoencoder for Intrusion Detection
## 3 Proposed Method
### Multi-View Co-Association Matrix Optimization
By setting \(\partial J/\partial W^{v}=0\), the following equation can be obtained:  
\[\min_{G}||G-Q||_{F}^{2},\ s.t.G\geq 0. \tag{7}\]2  
When the training data are sufficient (i.e., \(n\geq l\)), \(A^{v}\) is a full-rank matrix, and Equation (15) has a closed-form solution. When the training data are insufficient (i.e., \(n<l\)), Equation (15) has infinite solutions, \(W^{v}=A^{v}D(D\in\mathbb{R}^{n\times n})\) can be imposed on \(W^{v}\) and both sides of the equation multiplied by \(((A^{v})^{T}A^{v})^{-1}A^{v}\) to obtain a unique solution [32]. In general, Equation (15) can be efficiently solved as follows:  
\[W^{v}= \begin{cases}&\big{[}\lambda I+(A^{v})^{T}A^{v}+\alpha(A^{v})^{T}L_{G}A ^{v}\big{]}^{-1}(A^{v})^{T}X^{v},\ n\geq l,\\ &(A^{v})^{T}\big{[}\lambda I+A^{v}(A^{v})^{T}+\alpha L_{G}A^{v}(A^{v})^{T} \big{]}^{-1}X^{v},\ n<l.\end{cases}  \tag{16}\]  
After solving for \(W^{v}\), the reconstruction errors of all samples within the view can be obtained via Equation (17). For normal traffic data, MOCBLSAE achieves relatively small reconstruction errors by encoding and reconstructing the data while incorporating their cluster relationships. In contrast, since MOCBLSAE does not learn the reconstruction features of network intrusion data, it typically yields larger reconstruction errors. Based on this idea, the top \(n\delta\) (\(\delta\in[0,1]\)) largest training reconstruction error is selected as the  
Figure 1: The framework of MOCBLSAE. threshold \(T^{v}\). When the reconstruction error of unknown traffic data exceeds this threshold, MOCBLSAE identifies it as anomalous. The specific formula is given below:  
\[Err(x^{v})=||x^{v}-A^{v}(x^{v})W^{v}||_{2}^{2}, \tag{17}\]  
\[L^{v}(x_{t}^{v})=\left\{ \begin{array}{c}1\ (\text{normal}),\ \text{if}\ Err(x^{v})\leq T^{v},\\ -1\ (\text{intrusion}),\ \text{otherwise},\end{array} \right. \tag{18}\]  
where \(Err(x^{v})\) is the reconstruction error of \(x^{v}\), \(A^{v}(x^{v})\) is the output of the hidden layer, and \(L^{v}(x_{t}^{v})\) is the view-specific predicted label of testing data \(x_{t}^{v}\). Finally, the intrusion detection framework based on the multi-view cluster structure guided one-class BLS-autoencoder (IDF-MOCBLSAE) is constructed as shown in Figure 2. In the training stage, IDF-MOCBLSAE captures the cross-view cluster structure by applying the ensemble clustering and the multi-view co-association matrix optimization. Then, MOCBLSAE is trained in each view to learn the discriminative patterns of normal traffic data by preserving the cross-view clustering structure while minimizing the intra-view sample reconstruction errors. After training, an ensemble decision pool consisting of multiple MOCBLSAE models is obtained. In the testing stage, for multi-view traffic data, IDF-MOCBLSAE can operate independently within individual views or perform cross-view ensemble decision-making (e.g., majority voting or one-vote veto strategies), enabling efficient and flexible identification of unknown network intrusion. The overall pseudo-code of the intrusion detection framework based on MOCBLSAE is demonstrated in Algorithm 2. ```
0:
0:# Training stage
1: Compute the multi-view co-association matrix \(G\) according to Algorithm 1;
2:for each view \(v=1\) to \(V\)do
3: Construct the hidden layer \(A^{v}\) according to Equations (10)-(12);
4: Compute the connecting matrix \(W^{v}\) according to Equation (16);
5: Compute the reconstruction error of all training samples according to Equation (17), and set the threshold \(T^{v}\) by the top \(n\delta\ (\delta\in[0,1])\) largest error;
6:endfor
7:# Testing stage
8:for each view \(v=1\) to \(V\)do
9: Compute the reconstruction error of \(x_{t}^{v}\) according to Equation (17);
10: Compute the view-specific predicted label \(L^{v}(x_{t}^{v})\) according to Equation (18);
11:endfor
12:Obtain the prediction result of \(L(x_{t})\) based on the one-vote veto strategie. Output: The prediction result of \(x_{t}\).