## 3 Proposed Model
### Model Structure and Algorithm Flow  
In this paper, we propose an ETM-TBD intrusion detection model, shown in Figure 2. The model mainly consists of four parts: an Ensemble Tree Models module, a Transformer module, a BiGRU module and a DNN module. The Ensemble Tree Models module adopts the integrated learning model that stacks four basic machine learning trees. In this paper, four tree-based machine learners, namely SVM, RF, ET and XGBoost, are first trained and the individual machine learners are optimized with the BO-GP method. Then, the outputs of four basic machine learning trees for learning are integrated using a stacked integration model, and the results are then optimized by the BO-GP method, and the stacked integrated model is used as the first layer of the ETM-TBD model. We then input the results of the integrated machine learning tree as new features into the processed data. The Transformer module is trained on the newly constructed data to establish relationships between the different features. Afterward, the BiGRU neural network is used in conjunction with the Transformer model to obtain the connection between the front and rear features. The proposed DNN model further extracts the features, and the last layer of the model uses a SoftMax classifier to identify and classify the features to obtain the results. The overall framework of the proposed ETM-TBD model is shown in Figure 3, and the algorithm flow is as follows. The first step is the data preprocessing work, where the partitioning of the training and test sets is performed. Next comes the training module, which is in the lower left position in the figure. The detailed steps of the ETM module and TBD module are shown in the upper right and lower right corners of the figure. The results of the ETM model will be parameter optimized using the BO algorithm, and in the next step, it will be trained with a mixture of TBD models. And the BO module in the top-right corner of the figure is used to interpret the Bayesian Optimization model (BO) in the ETM module. The modules in the flowchart will be described in detail next. Figure 3: Algorithm flowchart. Figure 2: ETM-TBD model. (1) Z-score normalization: The range of values of the raw data collected through the industrial control system is very large. We cannot directly process the raw data directly because it may trigger the problem of gradient explosion. Therefore, we will use normalization to scale each feature dimension of the raw data to between \(-1\) and \(1\). (2) K-means: The K-means clustering algorithm is used for data sampling. In order to improve the efficiency of model training, data sampling is a commonly used technique, which can generate a subset of the original data. It will randomly select a portion of the data in each category labeled data and then uniformly integrate it into a new subdataset. The k-means algorithm can well reduce the time complexity of training. (3) Feature selection: Obtaining an optimal feature list through proper feature engineering can also improve the quality of the dataset. Then, we can remove some redundant features from the dataset by appropriate feature engineering, which can make the model training more accurate and efficient. In this paper, we propose the method based on IG-FCBF to extract effective features. (4) ETM module: After the data preprocessing work and feature engineering work, we can obtain a highly representative subdataset. An integrated machine learning tree model proposed in this paper will train the obtained dataset to train a signature-based intrusion detection model which is called ETM model. Using the output labels of four basic learners (SVM, RF, ET and XGBoost) as input features, a powerful metalearner is trained for further prediction. Using stacking, the information of four base learners can be learned simultaneously, thereby reducing the error of a single learner and obtaining a more reliable and robust metaclassifier.