## 2 Materials and Methods
### BiLSTM Network  
In traditional neural networks, the model does not preserve the information from the processing of the previous moment, resulting in a certain degree of disconnection between the consecutive time steps. This prevents the already processed information from being utilized in the subsequent classification tasks. To address this issue, researchers have proposed Recurrent Neural Networks (RNNs) [10]. The innovation of RNNs, compared to ordinary neural networks, lies in the incorporation of recurrent logic, which allows the current moment's processing information to be saved and carried over to be used in the next moment. However, during the backpropagation, RNNs have a high probability of experiencing the gradient disappearance or gradient explosion problem. The gradient gradually decreases over time, or its value surges, resulting in the weight changes either stopping or being too drastic, making the neural network unable to learn. Moreover, when dealing with a long input sequence, the effective updating of parameters becomes more difficult to realize. RNNs also have a limited capacity for the maintenance of long-term dependencies, which can lead to a decline in performance using long sequence data. Additionally, RNNs compute sequentially over time, and cannot be calculated in parallel [10], resulting in suboptimal training performance on large-scale data. To address the issues of vanishing and explosion gradients in RNNs, enabling the network to learn long-term dependencies, Long Short-Term Memory (LSTM) [11] introduces a gating mechanism to solve these problems. It primarily incorporates three gates for control: the forget gate, the input gate, and the output gate. Bidirectional long short-term memory network (BiLSTM) combines forward and reverse BiLSTM networks [12], allowing the model to use both past and future information for prediction or analysis. When sensing network threat behaviors, it is able to find the discrepancy data by comparing the characteristic parameters of the current state and the future state of the network to more accurately and purposefully sense and identify whether there are network threat behaviors in the current state. The specific calculation process mainly includes a forward LSTM calculation, a reverse LSTM calculation, BiLSTM hidden state merging, and an output layer calculation [13; 14; 15]. Figure 1: Network characteristics data collection process. Among them, the steps of forward BiLSTM computation mainly involve the forgetting gate, the input gate, a cell state update and the output gate [17], and the specific formulas are described below. For the forget gate:  
\[f_{t}^{f}=\sigma\Big{(}w_{xf}^{f}\cdot x_{t}+w_{hf}^{f}\cdot h_{t-1}^{f}+w_{cf}^ {f}\cdot c_{t-1}^{f}+b_{f}^{f}\Big{)} \tag{1}\]  
where \(\sigma\) is the sigmoid activation function, \(c_{t-1}^{f}\) is used to control the forgetting degree of the information in the cell state in the previous moment [17], \(w_{xf}^{f}w_{hf}^{f}\) and \(w_{cf}^{f}\) are the weight matrices between the input \(x_{t}\), the previous moment forward hidden state \(h_{t-1}^{f}\), the previous moment forward cell state \(c_{t-1}^{f}\), and the forgetting gate, respectively, and \(b_{f}^{f}\) is the forward bias term of the forgetting gate [13]. For the input gate:  
\[i_{t}^{f}=\sigma\Big{(}w_{xi}^{f}\cdot x_{t}+w_{hi}^{f}\cdot h_{t-1}^{f}+w_{ci }^{f}\cdot c_{t-1}^{f}+b_{i}^{f}\Big{)} \tag{2}\]  
where \(\sigma\) is the sigmoid activation function, \(x_{t}\) determines which parts of the input information will be updated to the cell state at the current moment, and \(w_{xi}^{f}w_{hi}^{f}\), \(w_{ci}^{f}\), and \(b_{i}^{f}\) are the corresponding forward weight matrix and bias terms, respectively [14].