## 3 Experiment and Result
### Analysis of Experimental Results  
After the preprocessing in Section 3.2, the data were subjected to cleaning, null filling, normalization, encoding, and feature extraction. Since this paper relies on pytorch to build the BiLSTM neural network model, after reading the data, the npz array needs to be converted to a float type torch tensor before inputting it into the model for calculation. In order to facilitate the model's ability to learn and comprehend network security postures more effectively, this paper encodes the nine types of network security threat behaviors, along with normal traffic, for a total of ten categories as the subjects of the experiment. The data encoding is performed in the order of their appearance in the database, and the corresponding relationship is as shown in Table 2.  
Considering the UNSW-NB15 dataset used in the paper, which contains 49 features, an attempt at adjusting the number of neurons in the range of 36 to 650 can be made during the optimization to balance the model performance and computational efficiency. The time step, in the experiments specifically, can be adjusted in the range of around 10 ms-100 ms, in order for the model to better utilize the information from the before and after moments to identify network attacks. We present the following detailed training information about this model: the number of iterations refers to the number of rounds after which the model is fully trained on the entire training dataset; the IPSO-BiLSTM model in this paper has a rapid decrease in sMAPE value after about 12 iterations, and stays at a low level afterwards; it is recommended to set a large range of the number of iterations, such as 50-100, during the initial training, and then determine the optimal number of iterations by observing the model's performance (e.g., metrics such as loss values, accuracy, etc.) on the validation set. Larger batch sizes can make the gradient update more stable and reduce the stochasticity of the training, but they will take up more memory, and the computational efficiency may be reduced, while smaller batch sizes will increase the stochasticity of training and help to jump out of the local optimal solution, but they may lead to the instability of the gradient update. For the UNSW-NB15 dataset used in this paper, considering its data size and model complexity, it is recommended that the batch size during the initial attempt is 16, 32, 64, and other common values. The learning rate determines the step size of the parameter update during the training process of the model. If the learning rate is too large, the model may skip the optimal solution during the training process, leading to non-convergence or even divergence; however, if the learning rate is too small, the training speed of the model will be very slow, requiring more training time and iterations. In the paper, the IPSO algorithm is used to optimize the parameters of the BiLSTM model, which helps find a suitable learning rate. In practice, a learning rate decay strategy can be used, i.e., initially setting a large learning rate (e.g., 0.001), and then gradually reduce it with an increase in the number of iterations (e.g., halving the learning rate every 10 iterations) during the training process. This can accelerate the convergence speed of the model at the beginning of training, avoid skipping the optimal solution when close to it, and improve the training effects of the model. In the IPSO algorithm, the size of the particle swarm (i.e., the number of hyperparameter combinations) affects the coverage of the search space. A larger particle swarm can search the hyperparameter space more comprehensively, but the computational cost will increase. \begin{table}
\begin{tabular}{c c c c} \hline
**Network Security Threat** & **Encodings** & **Network Security Threat** & **Encodings** \\ \hline Analysis & 0 & Generic & 5 \\ Backdoor & 1 & Normal & 6 \\ DoS & 2 & Reconnaissance & 7 \\ Exploits & 3 & Shellcode & 8 \\ Fuzzers & 4 & Worms & 9 \\ \hline \end{tabular}
\end{table}