## 3 Materials and Method
### Experimental Design
#### 3.4.2 Training Strategies  
In this study, to ensure optimal training efficiency and effectiveness of the model for cyberattack behavior detection, a series of training strategies were employed encompassing aspects such as hyperparameter settings and model evaluation methods. Through systematic experimental design and parameter optimization, the aim was to explore the model's full potential, thereby enhancing its accuracy in detecting cyberattack behaviors. Regarding hyperparameter settings, the complexity of model training and the characteristics of the data were fully considered, employing various methods including grid search and cross-validation to find the optimal hyperparameter configuration. Tuning hyperparameters is crucial for the speed of model training, and directly impacts the model's generalization ability and final performance; hence, detailed research and experimentation were conducted on key hyperparameters of the model, including but not limited to the learning rate, batch size, and the number of units in the hidden layers, to ensure that the most suitable model configuration for this research task was found. The learning rate, a critical parameter controlling the speed of model weight updates, directly affects the stability and convergence speed of model training. Preliminary experiments were conducted around several candidate values, including 0.001, 0.01, and 0.1. By observing the change in the model's loss function during training and its performance on the validation set, it was found that a learning rate of 0.001 allowed the model to converge more smoothly while avoiding the risk of overfitting. The choice of batch size is equally crucial, as it impacts both the training speed and the final performance of the model. After several rounds of experiments, it was determined that a batch size of 64 achieved a good balance between training efficiency and model performance with the current hardware configuration and data scale. For the number of units in the hidden layers, another important parameter determining model complexity, we experimented with configurations including 256, 512, and 1024. By comparing the performance of the model under different configurations, 512 units were ultimately chosen for the hidden layers, providing sufficient learning capacity for the model while avoiding overfitting caused by excessive complexity. For model evaluation, cross-validation was utilized to comprehensively assess the model's performance. Specifically, five-fold cross-validation was employed, meaning that the dataset was divided into five subsets, with each subset being used once as the test set while the remaining four subsets were used for training. This process was rotated five times, yielding five performance evaluation results. By calculating the average of these five evaluations, the final performance metric of the model was obtained. This evaluation method makes full use of limited data resources while effectively reducing the randomness of the model evaluation results, increasing the accuracy and reliability of the assessment. Through the implementation of the aforementioned training strategies, the scientific and systematic nature of the model training process was ensured, laying a solid foundation for the effective detection of cyberattack behaviors. In subsequent experiments, we will continue with further exploration into additional parameter optimization techniques and evaluation methods to enhance model performance. Additionally, close attention will be paid to various indicators during the model training process, such as the trend of the loss function and performance on the validation set, to ensure that the model completes training in the best possible state. For issues that may arise during model training, such as overfitting or underfitting, effective solutions will be sought through adjusting the model structure, introducing regularization techniques, and adjusting the learning rate. The generalization ability of the model was emphasized during the experimental process.