## 3 Proposed Intrusion Detection System
### Extract the Local Proximity Features by Using Packet2 vec Learning
#### 3.4.2.
**Parameter \(q\):** The parameter \(q\) controls that random walks tend to access network packets farther away from the network packet \(v_{pre}\). This article mainly uses random walk of approximate BFS, so the value of \(q\) is usually \(\left(q=\min(q,1)\right)\). If the \(p\) value is too large, the random walk may often return to the previous network packet, and it is easy to fall into the local loop search; When the \(p\) value is too small or the \(q\) value is too large, the random walk is easy to sample to the high-order proximity of the source network packet. From the above analysis, it can be concluded that the random walk with only the biased weight \(h_{vx}\) has no ability to accurately characterize the local proximity features of the source network packet. Therefore,  
Figure 5: Searching bias \(\alpha_{pq}\left(v_{pre},x\right)\). The walk just transitioned from \(v_{pre}\) to \(v\) is now evaluating its next step out of node \(v\). And \(v_{pre}\),\(v_{1}\),\(v_{2}\),\(v_{3}\) are the nodes that may be reached from node \(v\) in the next step. Edge labels indicate searching biases \(\alpha\). It is worth noting that \(v\) is the current network packet. \(v_{pre}\) is the previous network packet, so searching bias \(\alpha_{1}=1/p\). \(v_{1}\) is connected to \(v\) and connected to \(v_{pre}\), so searching bias \(\alpha_{1}=1\). \(v_{2}\) and \(v_{3}\) are connected to \(v\), while \(v_{2}\) and \(v_{3}\) are not connected to \(v_{pre}\), so searching bias \(\alpha_{3}=1/q\). we use the penalty \(g_{vx}\) to constrain the range of random walks to obtain local proximity features that have the ability to accurately characterize the similarity of network packets. **Penalty \(g_{vx}\):**\(g_{vx}\) is the penalty for the next network packet, and the calculation method is as shown in (5), where \(depth^{\prime}\) is the shortest path length from the source network packet to the next network packet. \(\eta\) is the penalty value, so \(\eta<=0\). The role of \(g_{vx}\) is to increase the penalty if the next network packet is far away from the source network packet during random walk. The farther the next network packet is from the source network packet, the larger the penalty \(g_{vx}\). The penalty \(g_{vx}\) has the ability to control the range of random walk;  
**Penalty-based weight \(n_{vx}\):**\(n_{vx}\) is a penalty based weight, also known as the transition probability from the current network packet to the next network packet. The penalty based weight \(n_{vx}\) is calculated as shown in (4). Considering a random walk that just traversed edge \(\left(v_{pre},v\right)\) and now resides at network packet \(v\)[10]. When a random walk requires the selection of a network packet for the next step, the penalty-based weight \(n_{vx}\) on the edge \(\left(v,x\right)\) needs to be evaluated. The penalty based weight \(n_{vx}\) is the sum of the penalty \(g_{vx}\) and the biased weight \(h_{vx}\), where \(v\) is the current network packet. If the penalty term \(g_{vx}\) is 0, the packet2 vec leaning algorithm is the node2 vec [10] leaning algorithm. \[n_{vx}=g_{vx}+h_{vx}, \tag{4}\]  
\[g_{vx}=depth^{\prime}*\eta, \tag{5}\]  
\[h_{vx}=\alpha_{pq}\left(v_{pre},x\right)\cdot w_{vx}, \tag{6}\]  
\[\alpha_{pq}\left(v_{pre},x\right)=\left\{ \begin{array}{ll}\frac{1}{p}& \text{if }d_{v_{\text{p}ex}}=0,\\ 1&\text{if }d_{v_{\text{p}ex}}=1,\\ \frac{1}{q}&\text{if }d_{v_{\text{p}ex}}=2.\end{array} \right. \tag{7}\]  
Node2 vec based on penalty constraints has the ability to obtain local proximity features of each network packet more accurately. In the local proximity representation of each network packet, a random walk is used to capture the relationship between network packets. The relational graph on packets similarity \(G^{\prime}\) is transformed into a set of network packet lists by random walk. The frequency of occurrence of the network packet pairs in the set measures the structural distance between the network packet pairs [10].