## 3 Proposed Methodology
### Attack Classification
#### 3.2.3 Attack Classification Using SVM  
After the approximation of the Q-function, the proposed EDRL model has employed the SVM [36] classification model to classify the attack owing to its efficiency in managing high-dimensional data and its capability to recognize the best hyperplanes for classifying distinct classes. SVM is an effective supervised machine learning model designed for binary classification. SVMs are predominantly robust against overfitting, particularly in cases where the number of features exceeds the number of samples, which is common in network traffic data. In addition, SVMs can proficiently manage non-linear boundaries with the usage of kernel functions, making them adaptable for complex classification tasks. The existing models in intrusion detection systems for attack classification include random forests (RFs), decision trees (DTs), artificial neural networks (ANNs), k-nearest neighbors (KNNs), etc. ANNs necessitate large datasets and careful tuning. RF is more robust but can be harder to interpret, while DT is prone to overfitting and instability. KNN is sensitive to unimportant features and computationally costly. Owing to their greater vulnerability to instability, overfitting, and challenges handling high-dimensional or unbalanced data, other algorithms commonly perform inferior to SVMs, while SVMs excel in generalization and robustness in these situations. The proposed EDRL identifies the discrimination between the feature spaces, which are labeled as normal or attacked accordingly. SVM tries to identify the optimal decision boundary where the margin between the nearest data instances and a boundary is maximized. The data instances that define the maximum margin are known as support vectors. The SVM model is displayed in Figure 5.  
Consider the input training instances of a model as \((p_{1},q_{1})\dots(p_{n},q_{n})\), where \(q_{i}\) is the true class of input, then the decision boundary for the given data can be represented as follows:  
\[f(p_{i})=w^{T}p_{i}+b=0 \tag{24}\]  
where \(w\) is the weight value and \(b\) is the bias. Constraints are also considered in the model to prevent data instances from falling on the incorrect side, and these can be expressed as follows:  
\[if\ \ q_{i}=1;w^{T}p_{i}+b>=1 \tag{25}\]  
\[if\ \ q_{i}=-1;w^{T}p_{i}+b<=-1 \tag{26}\]  
These two constraints can be combined into a single constraint as follows;  
\[q_{i}(w^{T}p_{i}+b)>=1\ \ for\ all\ \ 1<=i<=n \tag{27}\]  
Figure 5: Model of SVM used for attack classification. A well-known limitation of an SVM model is that the model's training time is high when the input size is large. This limitation is reduced in the proposed work by administering a linear form of SVM that uses hinge loss as its loss function. This function can be defined as follows:  
\[max(0,1-q_{i}f(p_{i})) \tag{28}\]  
where the output value for this loss value is considered to be \(\pm 1\). When the prediction made by \(f(p_{i})\) is true, then \(q_{i}f(p_{i})>=1\). Also, \(q_{i}\) and \(f(p_{i})\) will have the same sign, and the loss value is 0. Also, there will be a linear increase in the loss value when \(q_{i}f(p_{i})<1\) and \(q_{i}\) and \(f(p_{i})\) have opposite signs. Incorrect classifications made by the model are penalized by the hinge loss function within \(q_{i}f(p_{i})\) corresponding to a margin. \[c(p,q,f(p_{i}))=1-q_{i}f(p_{i}) \tag{29}\]  
\[c(p,q,f(p_{i}))= \begin{cases}0,\ \ ifq_{i}f(p_{i})>=1\\ 1-q_{i}f(p_{i}),\ \ otherwise\end{cases}  \tag{30}\]  
The objective function for minimization can be formed using the loss function and regularization term. Since the considered loss function is convex, convex optimizers can be adopted to minimize this function. The objective function can be mathematically expressed as follows. \[J(\omega)=\frac{\lambda}{2}||\omega||^{2}+\frac{1}{n}\sum_{i=1}^{n}max(0,1-q_ {i}f(p_{i})) \tag{31}\]  
The loss mentioned above function is minimized iteratively using the gradient descent, and the overall classification accuracy is maximized.