# Detection Model for 5G Core PFCP DDoS Attacks Based on Sin-Cos-bIAVOa
## 3 Method
### Sin-Cos-bIAVOA  
AVOA suffers from the drawbacks of slow convergence speed and local optimum stagnation. In response to various complex optimization tasks and different application scenarios, researchers have proposed several enhanced optimization methods based on AVOA, tailored to the specific requirements [42; 43; 44]. [PERSON] et al. [45] introduced an enhanced binary version of AVOA termed Sin-Cos-bIAVOA, designed for selecting effective features pertinent to DDoS attacks. This approach incorporates an innovative compound sin-cos transfer function to boost exploratory capabilities while employing the Gravitational Fixed Radius Nearest Neighbor (GFRNN) classifier for identifying the optimal feature subset.  
Figure 5: Flowchart of AVOA.  
Sin-Cos-bIAVOA operates through three distinct phases. Initially, the algorithm probes new and promising regions to prevent premature convergence and avoid local optima. In the subsequent phase, it gradually transitions from exploration to exploitation. Finally, the algorithm focuses on fine-tuning around the highest-quality solutions to identify the optimal outcome. Figure 6 illustrates the detailed steps and overall workflow of the algorithm. After the population is initialized, the sin-cos transfer function is employed to generate binary positions. In this algorithm, the input parameters include the population (N), dimension (D), and maximum number of iterations. The number of cultures in an environment is simulated as the population (N), while D is the dimension of the problem. The output parameters are the optimal and suboptimal results.  
A new compound transfer function, termed sin-cos, is introduced to convert continuous representations into binary ones. This function enhances the exploration capabilities of bIAVOA by generating a highly diverse population. It operates by applying a specific set of functions and rules [45] to map the continuous search space into its binary equivalent:  
\[S_{1}(x_{ij})=Cos(x_{ij})/2+0.5 \tag{1}\]  
Figure 6: Workflow of Sin-Cos-bIAVOA.  
\[x^{\prime}_{ij}=\left\{\begin{array}{ll}1&\text{if }rand_{1}()<S_{1}(x_{ij})\\ 0&\text{if }rand_{1}()\geq S_{1}(x_{ij})\end{array}\right. \tag{2}\]  
\[S_{2}(x_{ij})=Sin(x_{ij})/2+0.5 \tag{3}\]  
\[x^{\prime\prime}_{ij}=\left\{\begin{array}{ll}1&\text{if }rand_{2}()<S_{2}(x_{ij})\\ 0&\text{if }rand_{2}()\geq S_{2}(x_{ij})\end{array}\right. \tag{4}\]  
\[x_{i}=\left\{\begin{array}{ll}x^{\prime}_{j}&\text{if }f(x^{\prime}_{i})\text{ is better than}f(x^{\prime\prime}_{i})\\ x^{\prime}_{i}&\text{if }f(x^{\prime}_{i})\text{ is better than}f(x^{\prime}_{i})\end{array}\right. \tag{5}\]  
where xij is the current continuous position of the ith vulture in the jth dimension and f(.) is the fitness function. Sin(.) and Cos(.) are sine and cosine functions, respectively; the functions Sin(.) and Cos(.) generate two values in the range of [0, 1], and two new binary positions are created according to Equations (1) and (3). The position with the highest fitness value is chosen and labeled as xij, representing its new location in the binary search space. The two functions Sin(.) and Cos(.) along with these rules generate a diverse range of solutions and enhance the algorithm's ability to explore new possibilities. The pseudocode for the sin-cos transfer function is provided in Figure 7.