## 3 A Network Intrusion Detection Method Incorporating a Bayesian Attack Graph and IL
### IL Intrusion Detection Method Based on XGBoost  
Although Bayesian attack graphs have been able to perform complete attack prediction, the attack characteristics for intrusions still rely on the professional experience of network security experts and the historical data of the attacked [21]. Therefore, pure Bayesian attack graphs are weak for detecting unknown security events, and it is necessary to combine attack graph techniques with intrusion detection techniques to adapt to the network. When an intrusion detection system detects an attack in the network, the system can perform an active update of the attack graph. Therefore, the study proposes an IL-based intrusion detection method that enables the model to learn the features of new data quickly and ensures the predictive capability of the model for new data. The method is then combined with a Bayesian attack graph to achieve real-time prediction of attacker attacks. The network attack methods targeted by this model mainly include seven types: brute force, Heartbleed, Botnet, Denial of Service (DoS), Distributed Denial of Service (DDoS), Web attacks, and Infiltration of the network from inside. The framework for combining Bayesian attack graphs and IL intrusion detection methods is shown in Figure 2.  
As shown in Figure 2, when using the IL approach for intrusion detection with new data to continue training the base model, the amount of new training data is not large and again allows the model to learn the feature distribution of the new data, improving the prediction accuracy of the model. In the intrusion detection method based on IL built in this study, firstly, a Bayesian attack graph is generated through the scoring and correlation of the vulnerability database, and the attack graph is quantified. After the IL is trained with history and new data, the quantitative attack is expressed as the node reachability probability to observe the attack behavior. Finally, the prediction network is analyzed in the section on dynamic reachability probability. In this study, XGBoost is used as the base model. Firstly, assuming that the loss function of the dataset \(T=\{(x_{1},y_{1}),(x_{2},y_{2}),\ldots,(x_{n},y_{n})\}\) is \(\sum_{i}l(y_{i},\hat{y}_{i})\) and the regularization term is \(\Omega(f)\). The overall objective function is expressed as Equation (6). \[L(\Theta)=\sum_{i}l(y_{i},\hat{y}_{i})+\sum_{k}\Omega(f_{k})k, \tag{6}\]  
In Equation (6), \(i\) denotes the \(i\)th sample. \(k\) denotes the \(k\)rd tree. \(\hat{y}_{i}\) is the predicted value of the \(i\)th sample. Formula (6) serves as the base model for XGBoost incremental learning, and its application conditions lie in the training process of intrusion detection methods. In the training, the new data and the old data will train the intrusion detection model together, and after the feature extraction of the new data, the introduction Formula (6) can be used to build a new incremental learning model. Since XGBoost uses the gradient boosting method, the new tree is fitted with the residuals of the previous tree. The predicted value of the \(i\)th sample of the \(t\)th tree is represented by \(x_{i}\). Then, the predicted value of the model is expressed as Equation (7). \[\hat{y}_{i}=\sum_{k=1}^{t}f_{k}(x_{i})= \hat{y}_{i}^{t-1}+f_{t}(x_{i}), \tag{7}\]  
Therefore, the objective function is rewritten as Equation (8).