## 3 A Network Intrusion Detection Method Incorporating a Bayesian Attack Graph and IL
### IL for Intrusion Detection Performance Verification Analysis  
To verify that the XGBoost IL algorithm utilized in this study can be effectively applied to network sensor intrusion detection with Bayesian attack graphs, this study was tested by training and simulation with the CSE-CIC-IDS-2018 dataset created jointly by the G Canadian Institute for Cyber Security Research. This dataset contained much information on the network flow duration, the total number of forward-backward packets, and the total number of forward packets. At the same time, the dataset incorporated more advanced and recent attacks. With the change innetwork behavior and mode and the development of intrusion, it is very necessary to change from static and one-time datasets to more dynamic datasets. These datasets not only reflect the traffic combination and intrusion at that time but are also modifiable, scalable, and reproducible. To overcome these shortcomings, the dataset designed a systematic method to generate the dataset to analyze, test, and evaluate the intrusion detection system, focusing on the network-based anomaly detector. The main goal of this project is to develop a systematic method to generate a diversified and comprehensive benchmark dataset for intrusion detection based on the creation of user profiles that contain the abstract representation of events and behaviors seen on the network. These profiles will be combined to generate a different set of datasets. Each dataset has a unique set of characteristics that cover a part of the evaluation domain. In this experiment, since the XGBoost model is a tree model, there is no need to normalize the data. In addition, the XGBoost model itself can handle missing values, so there is no need to fill or remove missing values. For the outliers, statistical analysis was performed and found to be too small, so they were deleted here. For recurring data records, only their first occurrence was retained, and the rest of the redundant data records were deleted. After preprocessing, the information of the sample dataset is shown in Table 4.  
To conduct experiments on IL, the data from 14 February 2018 to 23 February 2018 in the dataset were used here as the training set for the base model, and the data from 28 February 2018 were used as the incoming training set data to continue training the incremental model on the base model. For comparison with incremental training, the data from 14 February 2018 to 23 February 2018 were used as the training set for full training, and the data from 1 March 2018 and 2 March 2018 were used as the test set data for these three training methods. In this experiment, the conventional confusion matrix values were \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Date** & **Number of Samples** & **Date** & **Number of Samples** \\ \hline
14 February 2018 & 392,909 & 22 February 2018 & 443,070 \\
15 February 2018 & 426,094 & 23 February 2018 & 445,761 \\
16 February 2018 & 470,336 & 28 February 2018 & 470,336 \\
20 February 2018 & 3,447,677 & 1 March 2018 & 128,073 \\
21 February 2018 & 522,559 & 2 March 2018 & 517,200 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Effective Sample Quantity Information After Data Preprocessing.