## 4 Network Anomaly Forecasting
### The Algorithm of Network Anomaly Forecasting  
Utilizing the historical data, the data prediction model updates the cell state and hidden state, and forecasts the future network data. The cell state at the current moment determines which features are retained for transmission to the next memory block for prediction based on the input and hidden state at the current moment, while the hidden state decides which features of input data are not required for prediction and can be discarded. Obtaining the future network data as the input of anomaly detection model introduced in Section 3, we obtain the anomaly scores of future networks and achieve the function of anomaly warning. The anomaly warning algorithm is summarized in Algorithm 2 and the specific procedure of anomaly forecasting is as follows. ```
0: Historical window data \(\mathcal{W}=\{\mathbf{w}_{t}\}_{t=1}^{T}\), threshold \(\eta\), weight parameter \(\alpha\)
0: anomaly labels of predicted data \(\left\{\hat{l}_{1},\ldots,\hat{l}_{T_{0}}\right\}\)
1: Initialize \(C_{0}\) and \(h_{0}\)
2:for\(t=1\to T\)do
3:\(Z_{f}=f_{sig}(w_{f}*f_{\hat{l}}(X^{t},h^{t-1}))\)
4:\(Z=f_{tanh}(w*f_{\hat{l}}(X^{t},h^{t-1}))\)
5:\(Z_{i}=f_{sig}(w_{i}*f_{\hat{l}}(X^{t},h^{t-1}))\)
6:\(C^{t}\gets Z_{f}\odot C^{t-1}+Z_{i}\odot Z\)
7:\(Z_{o}=f_{sig}(w_{o}*f_{\hat{l}}(X^{t},h^{t-1}))\)
8:\(h_{t}\gets Z_{o}\odot f_{tanh}(C^{t})\)
9:\(\hat{Y}_{t}=f_{sig}(w^{\prime}*h^{t})\)
10:endfor
11:for\(t=1\to T_{0}\)do
12:\(S(\hat{Y}_{t})=a\big{\|}\hat{Y}_{t}-AE_{1}(\hat{Y}_{t})\big{\|}_{2}+(1-\alpha )\big{\|}\hat{Y}_{t}-AE_{2}\big{(}AE_{1}(\hat{Y}_{t})\big{)}\big{\|}_{2}\)
13:if\(S(\hat{Y}_{t})>\eta\)then
14:\(\hat{y}_{t}=1\)
15:else
16:\(\hat{y}_{t}=0\)
17:endif
18:endfor
19:return\(\left\{\hat{l}_{1},\ldots,\hat{l}_{T_{0}}\right\}\)
```  
**Algorithm 2** Anomaly forecasting algorithm. **Data Input**: Utilizing the historical data in the past time as the input, the input gate of a memory block in LSTM can make full use of temporal information in all time pointsto identify changes in features and provide a basis for subsequent feature screening by updating the cell state. In other words, input gates \(Z_{i}\) determine what feature from the network input \(X_{t}\) at the current moment is saved to the cell state \(C_{t}\). How it updates is shown as follows:  
\[Z=f_{tanth}(w*f_{jt}(X^{t},h^{t-1})) \tag{15}\]  
\[Z_{i}=f_{sig}(w_{i}*f_{jt}(X^{t},h^{t-1})) \tag{16}\]  
\[C^{t}=Z_{f}\odot C^{t-1}+Z_{i}\odot Z \tag{17}\]  
where Z represents the current information of input and \(\odot\) represents the Hadamard product. \(f_{tanth}\) represents the activation function called the hyperbolic tangent function, while \(w\) and \(w_{i}\) are the weight matrix for current information \(Z\) and input information \(Z_{i}\)
* **Feature screening**: In the time windows of input, there are some KPI features that contribute little to prediction because they are correlated to other features, which can be inferred by other important features. Thus, a forgetting gate can filter out the features that contribute more to prediction, where the weight matrix \(w_{f}\) is used to achieve this function, and then combine these features and input information at the current moment to complete the prediction. The forgetting gate \(Z_{f}\) determines how much of the unit state \(C_{t-1}\) at the previous moment is retained to the current state \(C_{t}\). The definition of a forgetting gate is: \[Z_{f}=f_{sig}(w_{f}*f_{jt}(X^{t},h^{t-1}))\] (18) where \(w_{f}\) is the weight matrix for forgetting information \(Z_{f}\), and \(f_{sig}\) means that \(X^{t}\) and \(h^{t-1}\) are concatenated together in a column and \(f_{sig}\) is the activation function sigmoid. * **Predicted results output**: Combining the filtered features and current input, the memory block output the predicted data at current time and hidden state through output gate. The hidden state is transmitted to the next memory block to predict the data of the next time point.