# Optimizing BiLSTM Network Attack Prediction Based on Improved Gray Wolf Algorithm
## 2 Background  
### Improved Gray Wolf Optimization Algorithm  
Gray wolf optimizer (GWO) simulates the predation behavior of gray wolf groups. Gray wolf groups have a strict hierarchy and a small number of gray wolves with the absolute right to speak lead a group of gray wolves toward their prey. GWO divides wolves into four levels based on fitness: \(\alpha,\ \beta,\ \delta\) and \(\omega\). \(\alpha\) is the optimal solution, \(\beta\) is the suboptimal solution, \(\delta\) is the best solution and \(\omega\) is the candidate solution. The hunting process is guided by \(\alpha,\ \beta,\ \delta\) and \(\omega\) follows \(\alpha,\ \beta,\ \delta\) to the prey. The position of the prey corresponds to the solution of the problem. GWO is superior to intelligent optimization algorithms such as particle swarm optimization algorithms and genetic algorithms in finding the global optimal solution. However, it is easy to fall into the local optimal solution, resulting in low convergence accuracy. To overcome these problems, this paper adopts the IGWO [18]. IGWO proposed a DLH to modify the search strategy associated with the selection and update steps. DLH constructs a neighborhood for each wolf, and wolves can share neighboring information with each other. IGWO can alleviate the lack of population diversity, the imbalance between development and exploration and the premature convergence of GWO algorithms. The IGWO algorithm process is shown in Figure 1. Inside the dotted box are improvements.  
Figure 1: IGWO flowchart.  
First, the parameters are initialized. \(N\) wolves are randomly distributed in the search space. The entire population of wolves is stored in a matrix \(Pop\) that has \(N\) rows and \(D\) columns, where \(D\) is the dimension of the problem. The position of the \(i\)-th wolf in the \(t\)-th iteration is expressed as:  
\[X_{i}(t)=\{x_{i1},x_{i2},\ldots,x_{iD}\},0\leq i\leq N. \tag{1}\]  
Then, in the GWO search strategy, the top three wolves of \(Pop\) are considered to be \(\alpha\), \(\beta\) and \(\delta\). When \(0\leq i\leq N\), not all wolves in the wolf pack have been searched, the GWO search is still carried out; when \(i>N\), complete the GWO search to obtain the positions \(X_{\alpha}\), \(X_{\beta}\) and \(X_{\delta}\) of \(\alpha\), \(\beta\) and \(\delta\) wolves. The first candidate \(X_{IGWO}(t+1)\) for the new position of wolf obtained by determining the prey encircle with \(X_{\alpha}\), \(X_{\beta}\) and \(X_{\delta}\). The DLH search strategy generates another candidate \(X_{IDLH}(t+1)\) for the new position of the wolf \(X_{i}(t)\) is calculated by Equation (2).  
\[X_{IDLH,d}(t+1)=X_{i,d}(t)+rand\times(X_{n,d}(t)-X_{r,d}(t)). \tag{2}\]  
Among them, \(X_{n,d}(t)\) is a random neighbor selected from the neighborhood \(N_{i}(t)\) constructed by Equation (3), and \(X_{r,d}(t)\) is a random wolf selected from \(Pop\).  
\[N_{i}(t)=\big{\{}X_{i,d}(t)\big{|}D_{i}(X_{i}(t),X_{j}(t))\leq R_{i}(t),X_{j}( t)\in Pop\big{\}}, \tag{3}\]  
\[R_{i}(t)= ||X_{i}(t)-X_{IGWO}(t+1)||, \tag{4}\]  
where \(D_{i}\) is the Euclidean distance between \(X_{i}(t)\) and \(X_{j}(t)\), and \(R_{i}(t)\) is the radius of the neighborhood. DLH uses the Euclidean distance between the current position of \(X_{i}(t)\) and the candidate position \(X_{IGWO}(t+1)\) to calculate the radius of the neighborhood by Equation (4).  
\[X_{i}(t+1)=\left\{\begin{array}{l}X_{IGWO}(t+1),if\;f(X_{IGWO})<f(X_{IDLH}) \\ X_{IDLH}(t+1),if\;f(X_{IGWO})\geq f(X_{IDLH})\end{array}\right.. \tag{5}\]  
Finally, compare the fitness of \(X_{IGWO}(t+1)\) and \(X_{IDLH}(t+1)\) through Equation (5) and select a better candidate. If the fitness of the selected candidate is less than \(X_{i}(t)\), then update \(X_{i}(t)\) with the selected candidate, otherwise \(X_{i}(t)\) remains unchanged in \(Pop\). After performing this process for all wolves, the iteration counter (\(iter\)) adds 1, and the search can be iterated until a predefined number of iterations (\(Maxiter\)) is reached.