# Optimizing BiLSTM Network Attack Prediction Based on Improved Gray Wolf Algorithm
## 3 BiLSTM Attack Prediction Model Based on Improved Gray Wolf Algorithm  
### Model  
Due to the good performance of deep learning in all aspects, literature [20; 21; 22] proposes a network attack prediction method based on deep learning. Literature [20] uses GRU to learn the data of past network attacks to predict future networks to achieve the purpose of network attack prediction. In this paper, the prediction model is named IGWO-BiLSTM, and the structure of the prediction model is shown in Figure 3. Each component is a refinement of the structure of the model. The input module processes the raw data; The data preprocessing module performs feature extraction and normalization; The IGWO-BiLSTM hidden layer consists of two layers of IGWO-BiLSTM and one Dropout layer, and the hidden layer trains network traffic data; Attack data training IGWO-BiLSTM to obtain an attack prediction model. The IGWO-BiLSTM attack prediction model process is as follows:  
1. The characteristics of normal network traffic have a certain regularity. When the change range of normal network traffic is abnormal, it can be judged that a network attack has occurred at this time. Literature [23] proposed the IPDCF, sampling the  
Figure 3: IGWO-BiLSTM model structure. Figure 2: BiLSTM network structure. network at a time interval of \(\Delta t=1\)min, using Equation (6) for data statistics, using Equation (7) for normalization and other data preprocessing operations:  
\[IPDCF_{i}=\sum_{T_{i}<t<T_{i+1}}P_{t}. \tag{6}\]  
Among them, \(IPDCF_{i}\) is the \(i\)-th value in the time series and \(P\) is the data packet. \[\hat{x}=\frac{x-x_{\min}}{x_{\max}-x_{\min}}. \tag{7}\]  
Among them, \(\hat{x}\) is the normalized value, \(x\) is the original value, \(x_{\min}\) is the minimum value and \(x_{\max}\) is the maximum value;
2. Sampling the data set at a time interval of \(\Delta t=1\)min and calculating the IPDCF value of each sampling. After \(m\) times of sampling, time series \(T\) is obtained and Equation (8) is used for time series modeling:  
\[T=\{IPDCF_{i},i=1,2,\ldots,M\}, \tag{8}\]  
Among them, \(M\) is the length of the data set, \(\Delta t=1\)min;
3. The raw data set is divided into a normal traffic data set and attack traffic data set. The normal traffic data set is used for prediction model training and prediction performance testing and the attack data set is used for attack experiments. Using sliding window technology, a window with a length of 60 and a width of 1 is selected, set the step size to 10 and perform sliding interception on the original network traffic data to obtain the network traffic training set and test set;
4. Initialize the parameters of the improved gray wolf algorithm. Randomly generate wolves, the total number \(N=50\), the maximum number of iterations \(Maxiter=10\), the dimension \(D\) of the problem is the number of BiLSTM optimization parameters \(D=4\), the number of hidden layer units of BiLSTM \((neurons1,neurons2)\), the forgetting rate \((dropout)\) and batch size \((batch\_size)\) correspond to the parameter coordinates of the individual positions of wolves, set the upper and lower limits \(ub=[200,200,0.9,10]\), \(lb=[32,32,0.1,1]\);
5. Initialize BiLSTM parameters and select a two-layer BiLSTM network. The number of hidden layer units \((neurons1,neurons2)\), dropout rate \((dropout)\) and batch size \((batch\_size)\) of BiLSTM are initialized to \(neurons1=128\), \(neurons2=64\), \(dropout=0.4\), \(batch\_size=5\), the maximum number of iterations is 500 and the fitness function is the mean squared error \((MSE)\) between the predicted value and the real value. Equation (9) was used to calculate the individual fitness of wolves and the fitness was returned to IGWO, \[MSE=\frac{1}{n}\sum_{i=1}^{n}{(Y_{i}-\hat{Y}_{i})}^{2}.\] (9) Among them, \(Y_{i}\) is the real value and \(\hat{Y}_{i}\) is the predicted value;
6. Normal network traffic time series input the model according to the window set in step (3) and train the model;
7. Use Equation (9) to calculate the fitness of each gray wolf.