## 3 A Network Intrusion Detection Method Incorporating a Bayesian Attack Graph and IL
### The Generation of Bayesian Attack Graphs
The AND relationship indicates that the node can be attacked only if all the preconditions of the node are satisfied, while the OR relationship indicates that the node can be attacked as long as any one of the preconditions is satisfied. In the attack graph, \(P\) is the weight on the directed edge that represents the probability of launching an attack on a successor node if the predecessor node has been compromised. \(P_{a}\) denotes the probability of successful exploitation of the node vulnerability in the Bayesian attack graph and thus gaining privileges. \(P_{b}\) denotes the static reachability probability of the node in the representation of the Bayesian attack graph. Its calculation is expressed as Equation (1). \[P_{b}(S_{i})=\left\{ \begin{array}{l}P_{a}(S_{i})\cdot\prod\limits_{j=1}^{n} P_{b}(S_{i})\cdot P(S_{i}|S_{j}),S_{i}ANDS_{j}\\ P_{a}(S_{i})\cdot[1-\prod\limits_{j=1}^{n}(1-P_{b}(S_{i}))\cdot P(S_{i}|S_{j}) ],S_{i}ORS_{j}\end{array} \right., \tag{1}\]  
In Equation (1), \(S_{j}\) is the parent node. \(S_{i}\) is the child node. \(n\) is the number of node setsand \(P(S_{i}|S_{j})\) represents the probability of attacking a child node among the parent nodes. The first row represents the static reachability probability when the node is an AND relationship, and the second row represents the static reachability probability when the node is an OR relationship. The dynamic reachability probability of the node \(P_{b}S_{i}\) indicates that the reachability probability of its predecessor \(S_{j}\) and successor \(S_{k}\) changes when the node is attacked. Firstly, the dynamic reachability probability of the node \(S_{i}\) is set to one. The calculation for the dynamic reachability probability of the predecessor node is expressed as Equation (2). \[P_{c}(S_{j}|S_{i})=\frac{P(S_{i}|S_{j})\cdot P_{b}(S_{j})}{P_{b}(S_{i})}, \tag{2}\]  
In addition, the dynamic reachability probability of \(S_{k}\) is expressed as Equation (3) depending on the relationship between the node \(S_{i}\) and the successor node \(S_{k}\)[20]. Figure 1: Attribute Attack Graph. \[P_{c}(S_{k}|S_{i})=\left\{ \begin{array}{l}P_{a}(S_{k})\cdot\prod\limits_{j=1}^{n} P_{b}(S_{j})\cdot P(S_{k}|S_{j}),S_{i}ANDS_{k}\\ P_{a}(S_{k})\cdot[1-\prod\limits_{j=1}^{n}\left(1-P_{c}(S_{i})\cdot P(S_{k}|S_{j })\right)],S_{i}ORS_{k}\end{array} \right., \tag{3}\]  
In Equation (3), the first row represents the dynamic reachability probability when the nodes are AND relations, and the second row represents the dynamic reachability probability when the nodes are OR relations. Meanwhile, this study relies on CVSS3.0 for the calculation of the vulnerability exploitation success rate of the nodes in the Bayesian attack graph. The score of the base dimension of the vulnerability mainly measures the danger of the inherent characteristics of a vulnerability. It is determined by the exploitability indicator of the vulnerability, the impact generated by exploiting the vulnerability, and the impact range of exploiting the vulnerability. Therefore, the calculation for the score of the base dimension of a vulnerability can be expressed as Equation (4). \[Score=\left\{ \begin{array}{l}MIN(\alpha(EXP+imp),10),Scope=changed\\ MIN(EXP+imp,10),Scope=unchanged\end{array} \right., \tag{4}\]  
In Equation (4), \(EXP\) represents the exploitability indicator of the vulnerability, and \(imp\) is the impact indicator of the vulnerability. \(Scope=changed\) indicates that if the attacker exploits the vulnerability and requires the participation of other users, then \(\alpha\) is the scope change weight. \(Scope=unchanged\) indicates that the exploited vulnerability only affects the resources in the same environment. Combining the static and dynamic reachability probability in the Bayesian attack graph, the reachability probability of all nodes in the network path can be multiplied cumulatively, and the formula is shown in (5).