Algorithm 1 Network security situation awareness algorithm based on LSTM-DT model.

Input: D, m,$S_{state}$, seed, steps, $\eta$, attribute A Output: Prediction value, loss value and sort results corresponding to test set 1. get $D_{tr}$, $D_{te}$ from D by m 2. $S_t$ = SSAE ($D_{tr}$) 3. $D_{tr}$’ = zscore ($S_{t-m}$) 4. create $LST{M}_{cell}$ by $S_{state}$ 5. connect $LST{M}_{net}$ by $LST{M}_{cell}$ 6. initialize $LST{M}_{net}$ by seed 7. for each step in 1:steps 8. P = $LST{M}_{forward}$($D_{tr}$’) 9. $Loss={\sum }_{i=1}^m{\left(p_i-y_i\right)}^2/m^2$ 10. update $LST{M}_{net}$ by Loss and $\eta$ 11. get $LST{M}_{net}$* 12. for each j in 0:(n − m − 1) $P_{f+i}$ = $LST{M}_{net}$*(P) append $P_O$ with $P_{f+i}$[−1] 13. $P_{te}$ = de_zscore ($P_O$) 14. update $D_{te}$ by $P_{te}$ 15. get $D_{te}$’ 16. Tree = Create root node n 17. for all attribute A∈$D_{te}$’ do Use compute information-theoretic criteria get $a_{best}$ 18. end for 19. Tree = Create node that tests $a_{best}$ in the root 20. get $D_v$ from $D_{te}$’ based on $a_{best}$ 21. for all $D_v$ do $Tre{e}_v$ = C4.5($D_v$) Attach $Tre{e}_v$ to the corresponding branch of Tree 22. end for 23. return sort results(attack type)