# One-Class LSTM Network for Anomalous Network Traffic Detection
## 3 Materials and Methods
### OC-LSTM Objective and Optimization Process  
The OC-LSTM is a simple feed-forward network, which can be regarded as a neural architectural design with an OC-SVM-equivalent loss function. The optimization problem of the OC-SVM is shown in Equation (1), and it can be written as follows:  
\[\underset{\boldsymbol{\omega},\,\rho}{\text{min}}\,\frac{1}{2}\|\boldsymbol{ \omega}\|^{2}+\frac{1}{vN}\underset{i=1}{\overset{N}{\sum}}\text{max}(0,\, \rho-\boldsymbol{\omega}\cdot\boldsymbol{\phi}(\boldsymbol{x}_{i}))-\rho \tag{5}\]  
Assuming that a simple network consists of a hidden LSTM layer with a linear activation function \(g(\cdot)\) and an output node, the scalar output from the hidden layer to the output node is \(W\), and the weight matrix from the input to the hidden layer is \(V\). The objective function of the network can be formulated as:  
\[\underset{\boldsymbol{W},\,\boldsymbol{V},\rho}{\text{min}}\,\frac{1}{2}\| \boldsymbol{W}\|^{2}+\frac{1}{2}\|\boldsymbol{V}\|^{2}+\frac{1}{vN}\underset{ i=1}{\overset{N}{\sum}}\text{max}(0,\,\rho-\boldsymbol{W}\cdot g(\boldsymbol{V} \boldsymbol{x}_{i}))-\rho \tag{6}\]  
Thus, it is possible to leverage the transfer learning features obtained using an LSTM layer by replacing \(\boldsymbol{\omega}\boldsymbol{\phi}(\boldsymbol{x}_{i})\) with \(\boldsymbol{W}_{g}(\boldsymbol{V}\boldsymbol{x}_{i})\)[21].  
However, the cost of this change is that the objective function becomes nonconvex and therefore the global optimal solution cannot be obtained. Fortunately, the alternating  
neural network in the sixth line. The seventh line updates the parameter \(\rho\) with the value of the \(v^{th}\) aliquot of \(\{\hat{y}_{i}\}_{i=1}^{N}\). Equivalent to Equation (6), the cost function of the network is  
\[C=\ \frac{1}{2}\|\mathbf{W}\|^{2}+\frac{1}{2}\|\mathbf{V}\|^{2}+\frac{1}{vN}\sum_{i=1}^{ N}\max(0,\ \rho-\hat{y}_{i})-\rho \tag{13}\]  
where \(\hat{y}\) is the network output value. Then, the value of \(\rho\) is a network parameter, which can be understood as the radius of the hypersphere. It is updated according to the solution of Equation (8). In the experimental section, the original data are used as the network input instead of the features extracted from the autoencoder. This indicates that the proposed OC-LSTM is an end-to-end one-class classification method, which is different from other deep-learning-based anomaly detection methods. When the network parameters converge, the classification results of the original data can be obtained through the decision function.  
```
1:Input: Set of training data \(\mathbf{x}_{i},\ i=1,\ldots,N\)
2:Output: Set of decision scores \(f(\mathbf{x}_{i}),\ i=1,\ldots,N\)
3: Initialize=1.0
4:\(t\gets 0\)
5:While (convergence not achieved) do
6: Optimize Equation (7) using BP, and find \((\mathbf{W}^{+1},\ \mathbf{V}^{+1})\)
7:\(\rho^{t+1}\)\(\leftarrow\) the \(v^{th}\) quantile of \(\left\{\hat{y}_{i}^{t+1}\right\}_{i=1}^{N}\)
8:\(t\gets t+1\)
9:Endwhile
10: Compute decision scores \(S_{i}=\hat{y}_{i}-\rho\) for each \(\mathbf{x}_{i}\)
11:If\((S_{i}\geq 0)\)then
12:\(\mathbf{x}_{i}\) is the normal data
13:else
14:\(\mathbf{x}_{i}\) is the anomalous data
15:Return\(f(\mathbf{x}_{i})=sign(\hat{y}_{i}-\rho),\ i=1,\ \ldots,\ N\)
```  
**Algorithm 1** OC-LSTM algorithm