## 3 A Network Intrusion Detection Method Incorporating a Bayesian Attack Graph and IL
### IL for Intrusion Detection Performance Verification Analysis
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Node**} & \multirow{2}{*}{
\begin{tabular}{c} **Node Reachability** \\ **Probability** \\ \end{tabular} } & \multirow{2}{*}{**Path Number**} & \multirow{2}{*}{**Route**} & **Path Reachability** \\ \cline{1-1}  & & & & **Probability** \\ \hline H1-V1 & 0.46 & Path-A & H0\(\rightarrow\)H1-V1\(\rightarrow\)H2-V3\(\rightarrow\)H5-V8\(\rightarrow\)H6-V9 & 0.0036 \\ H1-V2 & 0.1 & Path-B & H0\(\rightarrow\)H1-V1\(\rightarrow\)H2-V4\(\rightarrow\)H5-V8\(\rightarrow\)H6-V9 & 0.0116 \\ H2-V3 & 0.13 & Path-C & H0\(\rightarrow\)H1-V2\(\rightarrow\)H2-V3\(\rightarrow\)H5-V8\(\rightarrow\)H6-V9 & 0.0008 \\ H2-V4 & 0.41 & Path-D & H0\(\rightarrow\)H1-V2-V2-V4\(\rightarrow\)H5-V8\(\rightarrow\)H6-V9 & 0.0032 \\ H3-V5 & 0.47 & Path-E & H0\(\rightarrow\)H3-V5\(\rightarrow\)H2-V3\(\rightarrow\)H5-V8\(\rightarrow\)H6-V9 & 0.0037 \\ H4-V6 & 0.22 & Path-F & H0\(\rightarrow\)H3-V5\(\rightarrow\)H2-V4\(\rightarrow\)H5-V8\(\rightarrow\)H6-V9 & 0.0116 \\ H4-V7 & 0.14 & Path-G & H0\(\rightarrow\)H3-V5\(\rightarrow\)H4-V6\(\rightarrow\)H6-V9 & 0.0259 \\ H5-V8 & 0.24 & Path-H & H0\(\rightarrow\)H3-V5\(\rightarrow\)H4-V7\(\rightarrow\)H6-V9 & 0.0165 \\ H6-V9 & 0.25 & / & / & / \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Bayesian Attack Graph Node Reachability Probability and Path Reachability Probability. chosen as the experimental evaluation metrics to evaluate the performance of the IL-based intrusion detection method. The specific results are listed in Table 5.  
In Table 5, the accuracy rate, precision rate, and recall rate were used in this study to evaluate the prediction performance of the model, where AUC represented the area under the ROC and the area surrounding the coordinate axis. In Table 5, the performance of the base model in the test set was very poor, with an accuracy of 0.734 and an accuracy of 0.602 lower than the IL model and the full learning model. In the test set, the proposed IL model had a high accuracy of 0.951, a precision of 0.999, a recall of 0.815, an f1 value of 0.898, and an AUC value of 0.907. These evaluation metrics were not only much higher than the base model, but they were also slightly higher than the full learning model. The main reason for the low recallof the base model in the confusion matrix data was the lower predictive power of the base model for malicious traffic, which was due to the change in the data distribution of malicious traffic in the test set. The training dataset of the base model contained only a small amount of this type of data, so the amount of malicious traffic data of this type was poorly learned, which resulted in little ability to discernnew malicious traffic data in the base model. The f1 and AUC values of the base model indicated that the base model was very poor in the test set. The predictive power of the IL model was slightly higher than that of the full training due to the fact that the distribution of data features in the IL training set was closer to the distribution of data features in the test set. Finally, this study compared different intrusion detection algorithms with the same environment and test data. Fifty samples were randomly selected from the test dataset to compare the intrusion detection performance of Convolutional Neural Networks (CNN), the Fuzzy C-Means (FCM) algorithm, and the XGBoost IL algorithm used in the study, and the specific experimental results are listed in Figure 6.  
In Figure 6, among the 50 random samples, the most stable accuracy performance was the XGBoost IL algorithm proposed in the study, followed by the CNN algorithm. In the same data samples, the highest accuracy of CNN network intrusion detection was 0.961, the lowest accuracy was 0.349, and the average accuracy was 0.764. Meanwhile, the highest precision was 0.959, the lowest precision was 0.261, and the average precision was 0.655. Figure 6: Testing of Different Intrusion Detection Methods in the Dataset.