## 3 Proposed Intrusion Detection System  
### Definition  
**IDS multi-classification:** It refers to the problem of determining that the current network packet belongs to one of multiple types including normal, DDoS, Http DoS, brute force SSH, and infiltrating attacks [23]. **Undirected complete graph \(G(V,E,W)\):** It refers to a collection of vertices (or nodes) \(V=\left\{v_{1},\ldots,v_{n}\right\}\), edges \(E=\left\{e_{ij}\right\}^{n}\) and weights \(W=\left\{w_{ij}\right\}^{n}\)[24; 25; 26]. **Relational graph on packets similarity:** It refers to treating each packet as a node \(v_{i}\in V\). Calculating the cosine similarity between network packets \(\left(v_{i},v_{j}\right)\) as the weight \(w_{ij}\in W\). The vector of the network packet used to calculate the cosine similarity is the original features of the network packet. The detailed description of the original features of the network packet is in Section 3.3. An undirected complete graph \(G\) is constructed using the above method. In order to reduce the use of memory, the edges whose weights are lower than the threshold \(\varepsilon\) are pruned. \(G\) after pruning is called relational graph on packets similarity, expressed as \(G^{\prime}(V,E,W)\). **Pruning threshold:** It refers to a value for pruning the edges whose weights are lower than the threshold \(\varepsilon\) in the graph \(G^{\prime}\). **Source network packet(alias name: Source node):** It refers to the starting network packet for random walk. **Packet embedding:** Given a relational graph on packets similarity \(G^{\prime}(V,E,W)\), it refers to a mapping \(f:V\to R^{d}\). In details, \(f\) is the mapping function from node to feature representation. **Automatic preprocessing:** It refers to the automatic extraction of features from the original packet and eliminates manual intervention [6]. **K-order proximity:** It refers to a kind of feature that captures the \(k\)-hop relationship between each pair of vertices. **First-order proximity:** It refers to the local pairwise proximity between two connected vertices, which captures the direct neighbor relationship between the vertices. For each vertex pair (\(v_{i}\), \(v_{j}\)), if \(\left(v_{i},v_{j}\right)\in E\), the first-order proximity between \(v_{i}\) and \(v_{j}\) is \(w_{ij}\); otherwise, the first-order proximity between \(v_{i}\) and \(v_{j}\) is 0 [4]. First-order proximity is equivalent to \(k\) in the \(k\)-order proximity equal to 1. In \(a)\) of Figure 1, nodes \(v_{1},v_{2},v_{3},v_{4},v_{5}\) are the first-order proximity of \(v_{i}\). **Second-order proximity:** It refers to capturing a two-hop relationship between each pair of vertices, which describes the proximity of the pair's neighbor structure [5]. Second-order proximity is equivalent to \(k\) in \(k\)-order proximity equal to 2. In Figure 1a, nodes \(v_{6},v_{7},v_{8},v_{9},v_{10},v_{11},v_{12}\) are the second-order proximity of \(v_{i}\). **Low-order proximity:** It refers to a kind of feature that captures the \(k\)-hop relationship between each pair of vertices, where \(k\) is lower than 3. It contains first-order proximity and second-order proximity. **High-order proximity:** It refers to capturing the \(k\)-hop relationship between each pair of vertices, which captures a more global structure [5]. \(k\) is greater than or equal to 3. In Figure 1a, nodes \(v_{13},v_{14},v_{15},v_{16},v_{17}\) are high-order proximity of \(v_{i}\). **Proximity sampling strategy:** It refers to sampling the network packets in the neighbor of the source network packet \(v_{i}\) by random walk [10], expressed as \(S\). In Figure 1b, the proximity sampling strategy of the existing algorithm [10] is used for sampling to obtain a proximity sampling list of the source network packet. In Figure 1c, the proximity sampling strategy of the proposed algorithm is used for sampling to obtain a local proximity sample list of source network packets.