## 3 Proposed Intrusion Detection System
### Unsupervised Preprocessing Based on Packet2 vec Learning with Graph Representation  
As a preparation step for preprocessing of network packets, we convert the original network traffic into network packet features. Network packets are the basic unit used to determine whether network traffic flow is intrusive. Therefore, we use SplitCap [6] to group interacting source IPs and destination IPs in network traffic into the same network packet [6]. The preprocessing steps for network packets are as follows. Constructing a relational graph on packets similarity \(G^{\prime}(V,E,W)\). The local proximity features in \(G^{\prime}\) obtained by packet2 vec is called \(v_{i\_packet2 vec}\). This step will be detailed in Section 3.4. In addition, we also need to extract the original features \(v_{i\_original}\) in the network packet. Finally, the feature \(I\) describing the network packet is obtained in combination with \(v_{i\_original}\) and \(v_{i\_packet2 vec}\). For example, if the original features of the network packet are \(v_{i\_original}=[0a\ 5c]\), the local proximity features of the network packet obtained by packet2 vec are \(v_{i\_packet2 vec}=[de\ 87]\). Then the features of the network packet obtained after preprocessing are \(I=v_{i\_original}+v_{i\_packet2 vec}=[0a\ 5c\ de\ 87]\). The original features extraction algorithm of the network packet refers to intercepting the first \(r\) bytes of the network packet, and then each byte within [0, 255] in the \(r\) bytes obtained from the network packet corresponds to a feature [6]. As shown in Figure 3, the originally traffic is split into packets to be truncated into fixed \(r\) bytes. This algorithm of extracting the original features in the network packet is the same as the algorithm of extracting the features of the network packet in [6,27]. The original features extracted by this algorithm have the ability to characterize network packets. Experiments have proved that the algorithm in [6,27], as the original features extraction of this paper, has achieved better results than most of existing algorithms. Algorithm 1 describes the flow of unsupervised preprocessing based on packet2 vec learning with graph representation  
Figure 2: Flowchart of intrusion detection system. Especially, the packet2 vec is added to extract low-order proximity feature of network packets in the step of preprocessing to enhance the performance of IDS. ```
0: network traffic flow \((f_{i})\). 0:\(\textit{Vec}\) consists of \(q\) packets of network traffic, each packet vector \((\textit{vec}_{i1}\),\(\textit{vec}_{2}\),\(\cdots\),\(\textit{vec}_{ir})\). 1:Step 1:Split network traffic flow
2: Using splitcap to split the network traffic flow into \(q\) packets \((p_{1}\),\(p_{2}\),\(\cdots\),\(p_{q})\). 3:Step 2:Construct relational graph on packets similarity \(G^{\prime}\)
4: Each network packet is treated as a node \(v_{i}\). Each byte in the \(r\) bytes obtained from the network packet \(v_{i}\) corresponding to a feature, then we get vector \(v_{i}=v_{i\_original}=(\textit{vec}_{\textit{original}}|_{i1},\textit{vec}_{ \textit{original}}|_{i2},...,\textit{vec}_{\textit{original}}|_{ir})\). 5: Calculating the cosine similarity between any two packets \((v_{i},v_{j})\) as the weight \(w_{ij}\) between the two packets. Constructing an undirected complete graph \(G\). 6: Pruning the edges with similarities below the threshold \(\varepsilon\). The graph \(G\) after pruning is called relational graph on packets similarity, which is denoted as \(G^{\prime}(V,E,W)\). 7:Step 3:Extract the local proximity features by using packet2 vec learning
8: Using packet2 vec preprocessing to obtain the local proximity feature of each network packet in \(G^{\prime}\), called \(v_{i\_packet2 vec}\). This part will be described in detail in Algorithm 2. 9:Step 4:Construct vector as the input of deep auto-encoder
10:while the information of \(q\) packets is not extracted do
11: Combining \(v_{i\_original}\) and \(v_{i\_packet2 vec}\) to get \(I\).