## 3 A Network Intrusion Detection Method Incorporating a Bayesian Attack Graph and IL
### IL Intrusion Detection Method Based on XGBoost
\[L^{(t)}=\sum_{i=1}^{n}l(y_{i},y_{i}^{t-1}+f_{t}(x_{i}))+\sum_{k}\Omega(f_{k}), \tag{8}\]  
Therefore, the task at hand is to find the point \(f_{t}(x_{i})\) that minimizes the value of the objective function, and XGBoost obtains an approximation by performing a second-order [PERSON] expansion of the objective function at the point \(f_{t}(x_{i})=0\), i.e.,  
\[L^{(t)}\cong\sum_{i=1}^{n}\left[l(y_{i},y_{i}^{(t-1)})+g_{i}f_{t}(x_{i})+\frac {1}{2}h_{i}f_{t}^{2}(x_{i})\right]+\sum_{k}\Omega(f_{k}), \tag{9}\]  
In Equation (9), \(g_{i}=l^{\prime}(y_{i},\hat{y}_{i}^{(t-1)})\), \(h_{i}=l^{\prime\prime}(y_{i},\hat{y}_{i}^{(t-1)})\), while the regularization is calculated by \(\Omega(f)=\gamma T+\frac{1}{2}\lambda\|\omega\|^{2}\). It is known that \(l(y_{i},\hat{y}_{i}^{(t-1)})\) is a constant term, so the problem of solving the minimum of the objective function is not related to it. At the same time, since the structure of the previous \(t-1\) tree has been determined, the regularization  
Figure 2: A Framework for the Combination of Bayesian Attack Graph and IL Intrusion Detection Method. term of the previous \(t-1\) tree is a constant, so here the regularization term can be split into a variable and a constant term in the following way. The constant term, which is related to solving the minimum of the objective function, can be deleted. So the objective function expression can be optimized as Equation (10). \[L^{(t)}=\sum\limits_{i=1}^{n}\left[g_{i}f_{i}(x_{i})+\frac{1}{2}h_{i}f_{t}^{2}( x_{i})\right]+\Omega(f_{t}), \tag{10}\]  
All samples are grouped by leaf nodes. \[L^{(t)}=\sum\limits_{j=1}^{T}\left[(\sum\limits_{i\in I_{j}}g_{i})w_{j}+\frac{ 1}{2}(\sum\limits_{i\in I_{j}}h_{i}+\lambda)w_{j}^{2}\right]+\gamma T, \tag{11}\]  
In Equation (11), \(I_{j}\) denotes the set of training samples under the \(j\)th leaf node. \(G_{j}=\sum\limits_{i\in I_{j}}g_{i}\), \(H_{j}=\sum\limits_{i\in I_{j}}h_{i}\), where \(G_{j}\) denotes the cumulative sum of the first-order partial derivatives of all samples in the leaf node \(j\), and \(H_{j}\) denotes the cumulative sum of the second-order partial derivatives of all samples in the leaf node \(j\). Both of theseare constants, so the expression of the objective function is optimized as Equation (12). \[L^{(t)}=\sum\limits_{j=1}^{T}\left[G_{j}w_{j}+\frac{1}{2}(H_{j}+\lambda)w_{j}^ {2}\right]+\gamma T, \tag{12}\]  
At this point, the only variable left in the expression is the weight vector of the \(t\)th tree \(w\), and finding the min of the objective function is transformed into finding the cumulative sum. In addition, for the leaf node \(j\), its objective function expression is a quadratic equation, as shown in Equation (13). \[f(w_{j})=G_{j}w_{j}+\frac{1}{2}(H_{j}+\lambda)w_{j}^{2}, \tag{13}\]  
Therefore, the minvalue point of the leaf node \(j\) is expressed as \(w^{\prime}_{j}=-G_{j}/H_{j}+\lambda\). When the objective functions of the leaf nodes are taken to the min value, the objective function is taken to the min value expressed as Equation (14). \[L(\Theta)=\sum_{i}l(y_{i},\hat{y}_{i})+\sum_{k}\Omega(f_{k})k, \tag{6}\]0  
In practical application scenarios, intrusion detection data are constantly being added and the distribution of data is likely to be changing constantly. The most direct way of IL is to train a model with new intrusion detection data and a base model with historical intrusion detection data to identify the base features of the intrusion detection data. Then, it needs to learn the latest data features with recently collected intrusion detection data. XGBoost model is an additive model, which trains \(t\) trees from historical data, then the classification result of the model on samples is \(t\) trees A weighted fusion of the classification results. When the new historical data are collected, the new intrusion detection data are used to train \(m\) trees to learn the features of the new data based on the original \(t\) trees.