## 3 Research Methodology
### Proposed OGBDTs Cyber-Attack Detection  
In this study, the combination of the gradient-boosting technique with EABOs is investigated in order to find the best set of hyperparameters to maximize the predictive performance of the cybersecurity model. Gradient-Boosted Decision Trees (GBDTS) trees are binary trees used in assigning label predictions to instances by performing thresholding on feature values. A decision tree t is initially specified as either a leaf that has a label prediction \(\hat{y}\) or a non-leaf node \(\left(f,th,t_{left},t_{right}\right)\), where \(f\) detects a feature, \(th\) refers to the respective threshold, and \(t_{left}\), \(t_{right}\) specify the decision trees. During the time of testing, the instance \(\overset{\rightarrow}{x}\) performs tree \(t\) traversal until it reaches the leaf, setting its prediction. Particularly, for every visited non-leaf node \(\left(f\,,th,t_{left}\,,t_{right}\right)\), \(\overset{\rightarrow}{x}\) is sorted into the left tree \(t_{left}\) if \(x_{f}\leq th\); otherwise, it is sorted into the right tree \(t_{right}\). With a training set \(trainingset=\left\{\overset{\rightarrow}{x}_{i},y_{i}\right\}_{i}^{n}\), the conventional algorithms for decision tree learning initially predict the best label on _the training_ set for a decision tree consisting of one individual leaf, and later evaluate whether the loss can be reduced by substituting this leaf with a non-leaf node, resulting in two new leaves with predictions \(\hat{y}_{left}\), \(\hat{y}_{right}\), correspondingly. The best substitute is achieved through an elaborate search of all the probable features \(f\) and thresholds which are frequent in _the training set_. The predictions \(\hat{y}_{left}\), \(\hat{y}_{right}\) are calculated, which reduces the loss over \(trainingset_{left}=\left\{\overset{\rightarrow}{\left(\overset{ \rightarrow}{x}_{i},y_{i}\right)\in trainingset}\middle|x_{f}\leq th\right\}\) and \(trainingset_{right}=trainingset\backslash trainingset_{left}\), correspondingly. The building recursively continues on the new leaves and terminates if the loss cannot be reduced further or if a certain stop condition is satisfied, e.g., the depth of the decision tree goes beyond a particular limit. After the GA model has generated the optimum feature subset, data classification was carried out with the help of GBT. GBT was a boosting model, aiding in deriving an exact model with the baseline models included sequentially. The baseline models were trained at each stage of training to minimize the loss function. [PERSON] [37] developed the GBT model and fine-tuned generalized boosting models, employing DTs in both baseline models. Formally, given a loss function \(Loss\) and a dataset with \(n\) instances and \(f\) features (\(trainingset=\left\{(x_{i},y_{i})\right\}\left(\left|trainingset=n,x_{i}\in l ^{d},\,y_{i}\in l\right|\right)\)), GBDT minimizes the following objective function. Loss can be calculated using Equation (3). \[\widetilde{Loss}=\sum_{i}Loss(\hat{y}_{i},y_{i})+\sum_{k}\text{Reg}(f_{k}) \tag{3}\]where \(Reg(f)=\gamma T_{loss}+\frac{1}{2}\lambda w^{2}\) refers to a regularization term to penalize the model complexity. Here, \(\gamma\) and \(\lambda\) are hyper-parameters, \(T_{loss}\) indicates the number of leaves, and \(w\) stands for the leaf weight. Each \(f_{k}\) corresponds to a decision tree. Training the model in an additive manner, GBDT minimizes the following objective function at the \(m\)-th iteration. The GBT is initialized with a value \(a_{0}\). A gradient descent process was used for every training process \(m\) to minimize the loss function. \(Loss_{min}\) can be calculated using Equation (4). \[Loss_{min}=\sum_{i=1}^{n}Loss(y_{i},f_{m-1}(x_{i})+a_{m}base_{m}(x_{i})) \tag{4}\]  
DTs are built from the ground up until they hit certain constraints, such as the maximum depth. The 1 st-order Taylor loss function's expansions were calculated in training phases, and \(\tilde{\pi}_{im}\) was calculated for finding the diminishing direction \(a_{m}base_{m}(x_{i})\).