## 5 Discussion  
In this paper, the packet2 vec leaning algorithm is used to obtain the local proximity features that accurately describe the similarity relationship of network packets. Next, the features extracted by the packet2 vec leaning algorithm are combined with the original features of the network packet to be used as input of the deep auto-encoder for intrusion detection. This article focuses on the impact of similarity relationships between network packets on intrusion detection performance. Future work will further explore the features of network packets obtained by preprocessing. Network packets will be analyzed from multiple dimensions such as timing [40; 41; 42] and protocol type [43; 44; 45]. This paper only uses the network packet in the train set to construct a relational graph on packet similarity \(G^{\prime}\). When extracting local proximity features of the network packet in the test set, it is not necessary to add the network packet in the test set as a node to \(G^{\prime}\). It is only necessary to calculate the similarity between the current network packet and each network packet in \(G^{\prime}\). Then the proposed packet2 vec leaning algorithm is used to extract the local proximity features of the current network packet. When this algorithm is used to detect a new network packet, there is no need to update \(G^{\prime}\) or re-train. In other words, network packets in the test set do not have to be added to \(G^{\prime}\). Therefore, the algorithm can save time and memory. In addition, our proposed algorithm has generalization effectiveness for network packets outside the train set, increasing the scalability of the proposed model to the number of test set samples. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **Algorithm** & **Accuracy** & **DR** & **Precision** & \(\mathbf{F_{1}}\) \\ \hline \multirow{4}{*}{Supervised algorithms} & SVM-IDS 2017 [37] & NA & 60 & 59.2 & 59.28 \\  & J48-IDS 2017 [38] & NA & 90.64 & 86.4 & 88.14 \\  & C4.5-IDS 2016 [38] & NA & 76.4 & 78.1 & NA \\ \hline \multirow{4}{*}{Unsupervised algorithms} & PCA-IDS 2007 [8] & 81.1 & 78.7 & 78.9 & 78.8 \\  & RBM-IDS 2017 [7] & 78.6 & **96.0** & 70.9 & 81.6 \\ \cline{1-1}  & Deep AE-IDS 2018 [9] & 83.1 & 85.4 & 82.4 & 83.9 \\ \cline{1-1}  & Node2 vec -AE (proposal) & **87.4** & 81.1 & **87.3** & **84.1** \\ \cline{1-1}  & Packet2 vec -AE (proposal) & **94.7** & **90.9** & **94.3** & **92.6** \\ \hline \hline \end{tabular}
\end{table} 
Table 14: Comparison with Other Published Algorithms (%). In this paper, we use penalty terms to limit the range of random walks, which causes random walks to sample only network packets in the \(k\)-order proximity of the source network packet. The advantage of the above method is that we can customize the value of \(k\) according to the needs.The empirical formula, i.e., the pruning threshold \(\varepsilon\approx\) the mean of weights in \(G^{\prime}-depth^{\prime}\)* penalty value \(\eta\), is designed to calculate the approximately optimal penalty value. The maximum value that \(depth^{\prime}\) can be taken in this empirical formula is \(k\). In addition, we use (_depth_' * penalty value \(\eta\)) for weight penalty in the empirical formula. In the weight penalty, the closer the source network packet is, the smaller the penalty for the network packet. That is to say, the method has a high probability of preferentially sampling network packets with high similarity to the source network packet. In addition, the local proximity sample list of the source network packets obtained by random walk has the ability to capture the structural relationship and distance relationship between network packets. The source network packet local proximity sample list can measure the distance between network packet pairs based on the frequency of network packet pairs [10].