## 3 A Network Intrusion Detection Method Incorporating a Bayesian Attack Graph and IL  
### The Generation of Bayesian Attack Graphs  
The computer network system is a complex system composed of a variety of hardware, software, protocols, interfaces, and other components. The software, the hardware system designed for it, and the communication protocols become complex, which resultsin more and more security vulnerabilities. Therefore, attackers often use computer vulnerabilities to carry out attacks. Compared with the past, attacks are not single-step attacks, but multi-step, multi-stage, and multi-target complex attacks. Attackers use the correlation between vulnerabilities to improve their permissions in the system until theyreach their attack goal. The attack graph to be built in this study is the path probability prediction for this vulnerability attack. An attack graph is a kind of directed graph that can show the node's security and the attacker's attack path. The state attack diagram contains all possible states of the network system that can be attacked and the transfer relationship among all possible states. The state attack diagram obviously lacks specific state transfer conditions and clear attack paths, which arevery unintuitive. Moreover, with the expansion of the network scale, the global state of the network exponentially expands, and the state attack graph then risks state explosion and is difficult to apply to large-scale networks [18]. The attribute attack graph generally has two types of nodes and edges. The two types of nodes are the conditional node and the vulnerability node. The former indicates the current authority obtained by the attacker and the latter indicates the authority that the attacker can obtain after exploiting the vulnerability of the node. The two types of edges are the edges pointed from the conditional node to the vulnerability node and the edges pointed from the vulnerability node to the conditional node. The former indicates the preconditions required to attack the vulnerability node, and the latter indicates the privileges that can be obtained after attacking the vulnerability. The attribute attack graph is shown in Figure 1.  
The rectangular nodes in Figure 1 represent the conditional nodes and the elliptical nodes represent the vulnerability nodes. User (0) and User (1) indicate that the attacker has user access to host 0 and host 1; ftp (0,1) indicates that host 0 can access the ftpd service of host 1; trust (0,1) indicates that host 0 trusts host 1; and Sshd (0,1) indicates that host 0 can access the sshd service of host 1. Bayesian attack graph technology relies on the Bayesian network to show the association relationship between the host nodes of the network system where the attack occurs and is established, and its core lies in the modeling representation, generation, and quantification of the attack graph. To portray the association relationship between vulnerabilities and discover the attacker's attack intention, a Bayesian attack graph model is proposed in this chapter [19]. The model contains vulnerability exploitation nodes and their weights, directed edges and their weights, relationships of nodes, static reachability probabilities of nodes, and dynamic reachability probabilities of nodes. The above network elements are defined sequentially as \(S,E,R,P,P_{a},P_{b},P_{c}\). \(S=\left\{S_{begin}\cup S_{other}\right\}\) is the set of attribute nodes of the network, where \(S_{begin}\) denotes the set of starting nodes of the attack graph and \(S_{other}\) is the set of nodes other than the starting nodes. \(E\) denotes the set of directed edges in the Bayesian attack graph, and \(E_{S1:S2}:S1\to S2\) denotes the precondition that the authority of the current attacker at the \(S1\) node satisfies the motivating node \(S2\). \(R=<S_{i},R_{i}>\) denotes the relationship between the antecedent node and the successor node. \(R_{i}\in\{AND,OR\}\) indicates the AND and OR relationships between the antecedent node and the successor node.