## 3 Experiment and Result
### Analysis of Experimental Results

Table 2: Network Security Threat Behavior Code Correspondence Table. It is recommended to set the particle swarm size according to the complexity of the problem and the computational resources, generally at between 20-100 attempts. The model demonstrates a high degree of accuracy in identifying the cybersecurity threat behaviors of Generic, Exploits, and Fuzzers, with recognition rates of 95.32%, 94.96%, and 93.86%, respectively. This may be attributed to the commonality of these threat behaviors and their distinctive features, which facilitate learning and recognition. Additionally, the dataset contains a rich and detailed representation of these three threat behaviors, providing more accurate reference samples for the model to learn and understand the threat behaviors. It is evident that data is the foundation of all things, and a comprehensive and detailed dataset is essential for the model to master and perceive network security postures. The recognition accuracy for Backdoor, Analysis, and Worms is lower, at only 81.23%, 80.4%, and 75.32%, respectively. The analysis suggests that Backdoor, which is a covert entry left in the target system after a successful intrusion for subsequent operations, may not exhibit pronounced anomalies in network traffic, making it similar to normal network traffic data. Consequently, the model may be prone to classifying it as Normal. An analysis, as a category of cybersecurity threat behaviors, primarily involves analyzing the acquired data and target system states to assess the attack efficacy, seek additional exploitable information, or cover attack traces, and may also modify logs. This could lead to its activities being obscured within a large volume of normal network traffic data, making detection difficult. Worms, as a direct network attack, transmit abnormal data and propagate it automatically across the network, making them relatively easy to detect in traffic data. However, due to the limited number of samples, the model's recognition effectiveness is compromised. Nevertheless, given the severe impact Worms attacks have caused in the past, the toolkit for countering Worms attacks is comprehensive, including antiviral software, vulnerability monitoring, and Intrusion Detection Systems (IDS) from major vendors, all of which have conducted targeted research. Consequently, the cybersecurity risk threat level of Worms has relatively decreased. Due to insufficient sample data, the lower recognition accuracy of the model is, therefore, within an acceptable range. In summary, the recognition accuracy for the nine network security threat behaviors and normal traffic is shown in Figure 4.  
Figure 4: Comparison of the recognition rate of network security threat categories by this model. Generic and Exploits attacks have certain commonalities and distinctive features. Generic attacks refer to common general attacks, which appear frequently in the network environment, with relatively fixed attack patterns and regular behavioral characteristics. The dataset is rich in detailed samples of such attacks, which provide a large number of typical samples for the model to learn, making it easy for it to identify their characteristic patterns. Exploits attacks are attacks that take advantage of system vulnerabilities, and the attacks generate unique traces on network traffic and system state, such as specific port accesses, data transmission patterns, etc. These distinctive features are easily captured and learnt by the model. The IPSO-BiLSTM model combines both forward and inverse LSTM networks, and is able to make use of both the past and the future information to perform predictive analyses. When identifying these two types of attacks, the current and future state feature parameters of the network can be compared to find out the difference in the data and accurately identify the attack behavior. Its internal gating mechanisms, such as oblivion gates, input gates, and output gates, can efficiently process and deliver information at each time step.