## 2 Materials and Methods
### BiLSTM Network
#### 2.4.2 BiLSTM Hyperparameter Optimization Process  
The coefficient of the fitness of this model to the experimental data (R\({}^{2}\)) was used as the objective function, and R\({}^{2}\) was calculated as:  
\[\text{R}^{2}=1-\frac{\sum_{i=1}^{\text{n}}\left(y_{i}-\hat{y}_{i}\right)^{2}}{ \sum_{i=1}^{\text{n}}\left(y_{i}-\overline{y}\right)^{2}} \tag{8}\]  
The number of neurons per layer (node) and the time step (look_back) of the BiLSTM model are optimized by improving the particle swarm algorithm, so that it can make the model fit the current data more closely, and achieve good fitting results. Firstly, the IPSO parameters are set, including the particle swarm size (i.e., the number of hyper-parameter combinations), each particle is randomly set as the initial value and speed of each set of hyper-parameters, within the allowed range, and the maximum number of iterations and prediction errors are also set, and the R\({}^{2}\) is used as the fitness function, through which the evolution direction of the particle swarm is controlled. After setting the basic parameters, the hyperparameters of BiLSTM are trained and learned through steps 1 to 6 in 2.4, and finally the hyperparameter combination of the BiLSTM model, adapted to the current data, is obtained.  
Compared with the method of setting BiLSTM parameters based on experience, the R\({}^{2}\) of BiLSTM parameters set by IPSO improves by 16.4%, which indicates that the IPSO algorithm can reduce the prediction error, and improve the prediction performance of the model. When predicting the network security data, different parameter combinations of BiLSTM models predict different results, and adding hidden layers and changing the time step have a greater impact on the fitting effect of BiLSTM, while the optimized parameter combinations of IPSO can make the model achieve better results in network security prediction.  
In order to better sense the security posture of the target network, this paper proposes a network security situational awareness method based on IPSO-BiLSTM, as can be seen from the Figure 3, this model consists of three parts: data preprocessing, model training and situational awareness.  
Data preprocessing: the collected traffic data related to the secure operation of the target network, after data cleaning and random sampling as well as numerical standardisation and normalisation, is divided into a training set and a test set in the ratio of 8:2.  
Model training: the preprocessed data is input into the IPSO-BiLSTM model for the training, and the IPSO algorithm is used to improve the weights in the BiLSTM neural network, which makes the model perceptual accuracy increase.  
Situational awareness: using the already trained IPSO-BiLSTM model to recognize the data in the test set, and judging the model's learning results and the degree of adaptability, based on the recognition results, to verify the effectiveness of the model. In order to make the model more accurate and efficient for network posture recognition, this paper sets the optimal solution of IPSO as the number of model neurons and time steps, sets these two variables as two-dimensional vectors (the positions of individual particles in the particle swarm algorithm), and sets the fitting coefficients in the BiLSTM neural network as the value of the fitness function in the particle swarm optimization algorithm. The number of neurons and the learning rate are calculated by IPSO as the initial setting of the BiLSTM neural network, before proceeding to the next step of the network situational awareness.