# Optimizing BiLSTM Network Attack Prediction Based on Improved Gray Wolf Algorithm
## 1 Introduction
### Related Studies  
Existing studies have established the time series of normal network traffic [6] and used the time series to train the prediction model. Researchers' prediction of time series [7] can be divided into linear and nonlinear forecasts. Autoregressive (AR) is the simplest linear time series prediction model, which is suitable for predicting traffic data related to its previous period. The prediction result of AR is extremely inaccurate for traffic data greatly affected by external factors. In literature [8], AR is introduced to predict the shear stress of the fault zone. The method uses past data to predict future data to predict when an earthquake will start and end. Moving average (MA) is one of the most common ways to process time series. Autoregressive moving average (ARMA) is a combination of AR and MA used to process stationary non-white noise time series flow data. Literature [9] used a linear model to predict the monthly discharge of hydropower stations in Brazil and found that ARMA had the best performance through experiments. Autoregressive integrated moving average (ARIMA) is a combination of the ARMA model and difference operation, which can model fit stationary and non-stationary data. Literature [10], the ARIMA model was used to predict the daily number of COVID-19 cases in Saudi Arabia in the next four weeks. The linear prediction model is simple and intuitive, which is suitable for stationary time series modeling. However, most network traffic is characterized by uncertainty and abruptness, which makes it difficult for linear prediction models to predict accurately. Nonlinear prediction is mainly based on machine learning and deep learning. Literature [11] constructed a combined model of convolutional neural network (CNN) and recurrent neural network (RNN) and applied it to network traffic prediction. RNN is used to solve the problem of low accuracy of CNN prediction. Although the prediction accuracy of this model has been improved, it still cannot meet the needs of real life. Literature [12] proposes a time series prediction model that predicts elements separately and then combines them. The gated recurrent unit (GRU) was used to predict the decomposed components separately and then combined. Hybrid models reduce the effects of noise and outliers in time series data and improve prediction accuracy. However, due to the complex structure of the mixed model, the predicted reaction time is long. Literature [13; 14; 15] chooses to use long and short-term memory (LSTM) to predict network traffic. LSTM has a new memory module over RNN, which stores previously appeared data. Experimental results show that the prediction accuracy of network traffic is better than that of the RNN model. However, because the proportion of early data stored in the memory module is small, that is, the early data has little impact on the final result. Additionally, the network traffic has unstable characteristics and strong nonlinear characteristics. LSTM cannot capture nonlinear characteristics of large-scale network traffic effectively. Literature [16] used RNN and its variant LSTM and GRU structures to analyze and predict network traffic. This model can capture the nonlinear relationship and long-term dependence of complex network traffic but still does not solve the problems existing in LSTM. BiLSTM introduces the idea of two-way learning to solve the problem that the proportion of early data in LSTM is small, and also inherits the advantage of LSTM's ability to remember data features. Literature [17] compared the prediction effect of BiLSTM and LSTM in time series and proved that BiLSTM can provide better prediction than LSTM. Compared with traditional machine learning methods, deep learning has a great improvement in detection performance, but it still has some shortcomings such as slow convergence speed and poor optimization effect.