## 4 Proposed Model
### Proposed Hybrid Model
#### 4.1.2 Adversarial Training Methods  
Adversarial training is a method developed to detect and prevent malicious attacks on neural networks. It is based on creating malicious samples that target the classifier in the learning process and training the classifier with these samples. Thus, the classifier becomes more resistant to cyberattacks and produces more reliable predictions [11, 29]. Adversarial training was employed to increase the model's resilience and generalization ability. In this process, adversarial samples were created and included in the training dataset. Fast Gradient Sign Method (FGSM) Training Method  
The fast gradient sign method (FGSM) is a method employed to generate adversarial samples in machine learning. Adversarial samples render the original data samples misleading with minor but deliberate modifications. The FGSM generates adversarial samples by computing the gradient of a data sample and checking the sign of the gradient (i.e., whether it is positive or negative). The FGSM is popular because of its low computational cost and is mainly used to test classification models' vulnerabilities. It minimally alters an input image using the model's gradient, thereby misleading the model. These changes are usually invisible to the human eye but can considerably impact the model's classification accuracy. Adversarial samples were created using the fast gradient sign method (FGSM). The FGSM minimally alters an input image using the model's gradient, thereby misleading the model. These changes are usually invisible to the human eye but can considerably impact the model's classification accuracy. The mathematical model of the FGSM attack is specified in Equation (11):  
\[X^{\prime}=X+\varepsilon\text{ sign}(\
abla\times J(X,Y_{\text{true}})) \tag{11}\]  
Here, \(X^{\prime}\) refers to the adversarial sample, \(X\) denotes the original input, \(\varepsilon\) represents a small step size, and \(\
abla\times J(X,Y_{\text{true}})\) refers to the gradient of the loss function concerning \(X\). The sign function takes the sign of the gradient and thus takes a step in the direction that will make the most significant change. The adversarial samples created are added to the standard training dataset, and the model is trained on this extended dataset. This approach makes the model more resilient to adversarial attacks because the model encounters adversarial samples during the training process and learns to classify them correctly. Projected Gradient Descent (PGD) Training Method  
PGD, namely the projected gradient descent attack, involves adversarial sample generation against deep learning models. These samples are added to the standard training dataset, and the model is trained on this new dataset. The above-mentioned method can help to make the model more resilient to adversarial attacks. The PGD attack formulates the adversarial sampling process as an optimization problem. This iteratively updates the input to maximize the output of a target model along one aspect of the input sample. This process keeps the input within a specific area, so that it only moves slightly through a step. This process is applied by adding a series of PGD attacks to the model's training dataset, which helps the model to learn to recognize and correctly classify adversarial samples. Hence, the model's overall resilience to adversarial attacks increases. The PGD method ensures an iterative solution to an optimization problem. While aiming to find the minimum or maximum of a function, the PGD moves in the negative direction of the gradient at each step. However, it also applies a projection operation to keep the solution within a specific area at each step. This ensures that the solution remains within a particular set of constraints. In adversarial attacks, PGD is generally employed to make minor changes to the model's input, which can cause the model to make an error. In this case, the optimization goal is to maximize the model's probability of making an error.