## 3 Methodology
### Model Architecture
#### 3.3.2 Bidirectional Long Short-Term Memory  
After extracting spatial features through the CNN component, the model will subsequently shift its focus towards extracting temporal features. RNN is commonly used to process time series features. However, they face challenges such as gradient vanishing or exploding when dealing with long sequences. These challenges result in a limited memory span and the loss of early input information [45]. In order to address these challenges, long short-term memory (LSTM) is specifically designed to handle long-term dependencies in time series data by three gates and a cell state [46]. Figure 5 illustrates the structure of LSTM. The input gate selectively incorporates information into the cell state. The forget gate selectively determines the retention or loss of information by considering both the current input and the hidden state from the previous time step. Furthermore, the output gate selectively determines which parts of the cell state and hidden state should be passed on to the next time step. In the training phase, LSTM modifies the cell state by selectively adding or removing information by using these gate structures. This process is mathematically described by Equations (2)-(7). \[i_{t}=\sigma(W_{i}\cdot[h_{t-1},x_{t}]+b_{i}) \tag{2}\]  
\[f_{t}=\sigma\Big{(}W_{f}\cdot[h_{t-1},x_{t}]+b_{f}\Big{)} \tag{3}\]  
\[\bar{C}_{t}=tanh(W_{C}\cdot[h_{t-1},x_{t}]+b_{C}) \tag{4}\]  
\[C_{t}=f_{t}*C_{t-1}+i_{t}*\bar{C}_{t} \tag{5}\]  
\[o_{t}=\sigma(W_{o}[h_{t-1},x_{t}]+b_{o}) \tag{6}\]  
\[h_{t}=o_{t}*\tanh(C_{t}) \tag{7}\]  
where \(i_{t}\) denotes the input gate, \(f_{t}\) represents the forget gate, and \(o_{t}\) signifies the output gate. \(\sigma\) denotes the sigmoid activation function, and \(tanh\) represents the hyperbolic tangent activation function. \(\bar{C}_{t}\) is the candidate cell state, and \(C_{t}\) is the cell state. \(h_{t-1}\) represents the hidden state at the previous time step, \(h_{t}\) signifies the hidden state, and \(x_{t}\) denotes the current time step's input. \(W\) represents the weight, and \(b\) signifies the bias parameters. \"\(*\)\" denotes element-wise multiplication, equivalent to \(\otimes\) in Figure 5, and \"\(+\)\" signifies element-wise addition, equivalent to \(\oplus\) in Figure 5.  
However, LSTM can only capture unidirectional dependencies in time series data. In the field of network intrusion detection, temporal dependencies hold significant importance. This is because the features of network activities and attack behaviors evolve over time, leading to the manifestation of temporal dependencies in network traffic data. Figure 5: LSTM architecture. Additionally, attackers employ various strategies to evade detection, resulting in diverse patterns and temporal distributions in terms of their attack behavior. For instance, some attacks may occur during nonworking hours, or attackers might intentionally carry out attacks during holidays when network traffic is typically more congested, making it easier to conceal their malicious activities [47; 48]. Therefore, network intrusion detection needs to consider the temporal dependencies before and after attack events to gain a comprehensive understanding of intrusion behavior patterns. Nevertheless, traditional models and methods often consider only unidirectional temporal dependencies, making it challenging to effectively capture diverse temporal patterns and intrusion behaviors. Hence, in this study, we employed BiLSTM to extract temporal features from network traffic data. BiLSTM possesses the capability to consider both forward and backward dependencies in the data, effectively capturing patterns and behaviors in different time periods and directions, thus enhancing the detection capacity for various intrusion behaviors [49]. Furthermore, through integration with CNN, BiLSTM becomes a powerful hybrid model capable of comprehensively extracting spatiotemporal features from network traffic, thereby enhancing the model's capability to handle complex intrusion behaviors.