## 3 A Network Intrusion Detection Method Incorporating a Bayesian Attack Graph and IL
### Path Prediction Experiments with Bayesian Attack Graphs  
To verify the performance of the proposed Bayesian attack graph-based network attack prediction method in this paper, the study built a network system through a mail server, Apache server, DNS server, personal PC, MySQL server, and FTP server. In addition, an IL-based intrusion detection system was installed on each host to identify attacker attack behavior. Among them, the vulnerability information on each host is shown in Table 1. For the node vulnerability utilization success rate, this paper used CVSS3.0 general vulnerability scoring system to quantify it here. CVSS3.0 was released by the National Vulnerability Database (NVD) of the United States and kept the vulnerability data updated. CVSS3.0 comprehensively measured the harmfulness of vulnerabilities from three dimensions: the basic dimension of vulnerabilities, the time dimension, and the environment dimension. CVSS3.0 combined these three dimensions to give a specific score for vulnerabilities. The range of the score was [0, 10], where the vulnerability with a score between 0 and 3.9 was a low-risk vulnerability; the vulnerability with a score of 4 to 6.9 was a medium-risk vulnerability; the vulnerability with a score of 7 to 8.9 was a high-risk vulnerability; and the vulnerability with a score of 9 to 10 was a super-risk vulnerability. The Bayesian attack graph is an attack graph model that combines the Bayesiannetwork and attack graph  
Figure 3: Network Intrusion Detection Process Based on Bayesian Attack Graph and IL. technology. It uses Bayesian networks to represent the correlation between attack behaviors among host nodes in a network system, thereby establishing an attack graph structure. Its core lies in the modeling, generation, and quantification of attack graphs. Research on uncertainty handling during both qualitative and quantitative risk assessment procedures is a growing field. Theoretical contributions, explanatory uncertainty, cognitive uncertainty, and integration of cognitive and interpretative uncertainty processing in scientific and technological literature [22]. At the same time, this experiment needs to quantify the node and edge weight of the Bayesian attack graph, where the node weight represents the current node vulnerability utilization success rate. In addition, the hosts and vulnerabilities are numbered here for the convenience of subsequent presentations. In Table 2, the vulnerabilities in V1-V9 are, in order, malicious requests to execute arbitrary code through the server, vulnerabilities that can execute illegal commands, attacks against authentication, code executed in an application context, code that bypasses authentication to execute code with local SYSTEM account privileges, remote code execution vulnerability in Remote Desktop Services, seizing control on a domain controller with SYSTEM privileges code, code that bypasses permission to copy FTP server files, and code that injects malicious environment configuration into My SQL configuration files. The scores of the above nine vulnerabilities are represented by the vulnerability CVSS scores shown in Figure 4.  
In Figure 4, AV denotes the attack path score of the vulnerability. AC denotes the attack complexity score of the vulnerability. PR denotes the required privilege score of the vulnerability, and UI denotes the user interaction score of the vulnerability. Exp denotes the exploitable index of the vulnerability, and Score is the composite score calculated by Equation (4) in this paper. Figure 4 shows that V1, V4, V5, V6, V8, and V9 are ultra-dangerous vulnerabilities, and the rest are high-order vulnerabilities. As shown in Figure 4, the vulnerability with the highest comprehensive score was V5. As shown in Figure 4,