## 3 Model Analysis
### Build Intrusion Detection Model Using FSM  
In this study, a system model is constructed using FSM. As shown in Figure 3, there are three kinds of states, which are initial, possible attacks, and attack states. Lines in the graph represent state transitions. The red lines denote the attacks can be simply determined by a single packet. The black lines denote that a malicious attack cannot be determined by a single packet, and will be decided only after sufficient information is arrived. Therefore, we use intermediate states (M1-M5) to denote the status that the next states will be determined by other packets. The automata start from an initial state S0, transits to a suspected state M1-M5 (The number of states depends on the system resources), and finally reaches attack states (A1: normal, A2: attack). S0 can reach any suspected and attack state (antibodies 1-7), whereas each suspected state can conclude an attack state, for a total of 17 antibodies (Table 2). \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline
**Current State** & & & & & & & & & \\ \hline Next state & M1 & M2 & M3 & M4 & M5 & A1 & A2 & & \\ Antibody\# & 1 & 2 & 3 & 4 & 5 & 6 & 7 & & \\ \hline Current State & & M1 & & & M2 & & M3 & & M4 & & M5 \\ Next state & A1 & A2 & A1 & A2 & A1 & A2 & A1 & A2 & A1 & A2 \\ Antibody\# & 8 & 9 & 10 & 11 & 12 & 13 & 14 & 15 & 16 & 17 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Assignment of state transition to antibodies. Figure 3: State and state transitions for the FSM of intrusion detection. Some attacks are easy to be captured, and, therefore, the red lines represent direct transitions to final results. Some attacks are elaborate. We have to wait for subsequent information to make the final decision. Each internal state M1–M5 corresponds to one suspicious attack. The number of states depends on the system resources. The detection of suspicious attacks over an intermediate state is shown in Figure 4. The dash lines in the FSMs present possible future actions, which are not a part of standard notation and are only for explanatory purpose. When one possible attack state is detected, the system will request to start another state machine to detect multiple attacks simultaneously. When the state machine detects suspicious packets compliant with M2, the system goes to a suspicious attack state and continues subsequent detection while verifying whether an attack is occurring. When the state machine is in a suspicious attack state, it will count its life time t (number of packets) simultaneously. In this manner, system load can be reduced, and actuating excessive or overdue state machines can be avoided. If no associated packets in time t can prove the occurrence of an attack, then this state machine is abandoned to secure system resource operation. The process is as follows. 1. Start detection. 2. When a suspicious attack is detected, a state machine tracking M2 will be spawned to detect the potential attacks by keeping monitoring the possibility of consecutive anomaly. 3. Upon detecting of another potential attack, a new state machine M3 will be spawned to keep tracking the consecutive suspicious pattern. 4. M2 will be abandoned after examining t packets to avoid system overload. The study extracts 41 features from the provided packets information, including categorical and quantity values. We code the categorical features into antibody with Arabic numbers (Table 3), whereas the quantity values are converted to fuzzy numbers [20] (Figure 5). Figure 4: (**a**) An FSM tracking M1–M3 is initialized; (**b**), (**c**) new FSMs spawned when other intermediate attack types are encountered; (**d**) the FSM tracking M2 is abandoned after packet count \(t\). Figure 5: Quantity features need to be quantized before coded to AIS antibodies. We use histogram to help fuzzy quantizing the quantity values to four categories. Assume that the content of a certain packet is V1 = 1, V2 = H, V3 = http, and V4 = icmp.