## 3 Methodology
### Focal Loss Function  
Despite the CNN-BiLSTM architecture's outstanding capability in extracting spatiotemporal features, the common issue of class imbalance in network traffic data might still potentially have a detrimental impact on model performance. Therefore, to effectively mitigate this challenge, we introduce the focal loss function [36]. Focal loss is an improvement upon the cross entropy (CE) loss. During the training phase, the model computes the loss by comparing the predicted probability distribution with the actual probability distribution. By using the loss value, the model employs the backpropagation algorithm to update the parameters of each layer in the network, thereby minimizing the loss and enhancing prediction accuracy. The CE loss function is shown in Equation (11). \[CE(p,y)=\left\{ \begin{array}{ll}-log(p)&if~{}y=1\\ -log(1-p)&otherwise\end{array} \right. \tag{11}\]  
where \(y\in\{\pm 1\}\) denotes the ground truth. \(p\in[0,1]\) represents the predicted probability of the model for class \(y=1\). In order to simplify Equation (11), a function defined in terms of \(p\) is as follows:  
\[p_{t}=\left\{ \begin{array}{ll}p&if~{}y=1\\ 1-p&otherwise\end{array} \right. \tag{12}\]  
where \(p_{t}\) represents the predicted probability of the t-th sample belonging to a certain class. By combining Equation (12), we can simplify Equation (11) to obtain Equation (13):  
\[CE(p,y)=CE(p_{t})=-log(p_{t}) \tag{13}\]  
Figure 6: BiLSTM architecture. \begin{table}
\begin{tabular}{c c} \hline \hline
**Layer** & **Configuration** \\ \hline Input & The input features consist of a two-dimensional matrix transformed in Section 3.2.4 \\ Conv2D & Filter = 64, Kernel Size = 2 \(\times\) 2 \\ Conv2D & Filter = 128, Kernel Size = 2 \(\times\) 2 \\ Conv2D & Filter = 256, Kernel Size = 2 \(\times\) 2 \\ MaxPooling2D & Pool Size= 2 \(\times\) 2 \\ Batch Normalization & Default \\ Reshape & Adjustment based on input data \\ BiLSTM & Units = 64 \\ Dropout & Dropout Rate = 0.5 \\ Dense & The number of neurons is equal to the number of classes in the dataset. \\ Output & Activation = SoftMax \\ \hline \hline \end{tabular}
\end{table} 
Table 5: CNN-BiLSTM architecture and key parameters. When handling imbalanced datasets with the CE loss function, models have a tendency to prioritize training samples from the majority class, leading to lower performance on minority classes. Therefore, it becomes necessary to introduce a weighting factor \(\alpha\in[0,1]\) to adjust the weights of positive and negative samples. When \(y=1\), the weight factor is \(\alpha\), and when \(y=-1\), the weight factor is \(1-\alpha\). Equation (15) represents the \(\alpha\)-balanced CE loss function:  
\[\alpha_{t}=\left\{ \begin{array}{ll}\alpha&if~{}~{}y=1\\ 1-\alpha&otherwise\end{array} \right. \tag{14}\]  
\[CE(p_{t})=-\alpha_{t}log(p_{t}) \tag{15}\]  
where \(\alpha_{t}\) denotes the weight of the class for the \(t\)-th sample. The utilization of a weighting factor helps alleviate the issue of imbalanced distribution between positive and negative samples. However, it does not mitigate the impact of easy samples on the model's performance. Despite assigning a lower weighting factor to easy samples, their loss still contributes significantly to the overall loss when their numbers are high. In order to address this issue, focal loss introduces a modulating factor that diminishes the influence of easy samples in the overall loss function, allowing the model to focus more on hard samples. Focal loss is shown in Equation (16). \[FL(p_{t})=-\alpha_{t}(1-p_{t})^{\gamma}log(p_{t}) \tag{16}\]  
\((1-p_{t})^{\gamma}\) is the modulating factor, where \(\gamma\) represents the focusing parameter. As \(p_{t}\) approaches 1, it indicates that the sample is easy to classify. Consequently, the modulating factor tends towards 0, diminishing the impact of easy samples on the overall loss. As the value of \(\gamma\) increases, the loss contributed by easy samples decreases.