# A Novel Method for Detecting Advanced Persistent Threat Attack Based on Belief Rule Base
## 3 The BRB-Based APT Detection Model  
### Basic Principles of BRB  
The BRB model consists of a number of rules established by experts. The decision conditions of rules consist of several antecedent attributes chosen by experts, and each attribute has some reference values. The consequents of rules are assigned to some belief degrees. It can be described as follows:  
\[\begin{array}{l}R_{k}:\text{If }\Big{(}x_{1}\text{ is }A_{1}^{k}\Big{)} \wedge\Big{(}x_{2}\text{ is }A_{2}^{k}\Big{)}\wedge,\cdots,\wedge\Big{(}x_{M}\text{ is }A_{M}^{k}\Big{)}\\ \text{Then }\big{\{}(D_{1},\beta_{1k}),(D_{2},\beta_{2,k}),\cdots,(D_{N},\beta_{N,k} )\big{\}}\\ \text{with rule weight }\theta_{k}(k=1,2,\cdots,L)\text{ and attribute weight }\delta_{i}(i=1,2,\cdots,M)\end{array} \tag{1}\]  
where \(R_{k}\) denotes the \(k\)th rule of the belief rule base. \(x_{i}(i=1,\cdots,M)\) denotes the input attributes, and \(A_{i}^{k}(i=1,\cdots,M)\) denotes the reference value of attributes in the \(k\)th rule, where \(M\) denotes the number of attributes. \(D_{j}(j=1,\cdots,M)\) denotes the output of belief rule base, where \(N\) denotes the number of results. \(\beta_{j,k}\) denotes the belief degree corresponding to each \(D_{j}\).  
When one input activates multiple rules, there will be several different results at the same time. Hence, simply using rules to represent expert knowledge is not enough, the results of every activated rule is used to reason the final result by the evidential reasoning (ER) rule. The ER rule is a multi-source information fusion method based on the theory of evidence and has been successfully applied on multiple attribute decision making [27; 28]. The reasoning process of BRB by using the analytical ER approach is shown as follows:  
\[\hat{\beta}_{j}=\frac{\mu\times\left[\prod\limits_{k=1}^{L}\left(\omega_{k} \beta_{j,k}+1-\omega_{k}\underset{i=1}{\overset{N}{\sum}}\beta_{i,k}\right)- \underset{k=1}{\overset{L}{\prod}}\left(1-\omega_{k}\underset{i=1}{\overset{N }{\sum}}\beta_{i,k}\right)\right]}{1-\mu\times\left[\prod\limits_{k=1}^{L}(1- \omega_{k})\right]} \tag{2}\]  
\[\mu=\left[\underset{j=1}{\overset{N}{\sum}}\underset{k=1}{\overset{L}{\prod}} \Bigg{(}\omega_{k}\beta_{j,k}+1-\omega_{k}\underset{i=1}{\overset{N}{\sum}} \beta_{i,k}\Bigg{)}-(N-1)\underset{k=1}{\overset{L}{\prod}}\Bigg{(}1-\omega_ {k}\underset{i=1}{\overset{N}{\sum}}\beta_{i,k}\Bigg{)}\right]^{-1} \tag{3}\]  
where \(L\) denotes the total number of rules, and \(\omega_{k}\) is the activate weight of the \(k\)th rule. \(\hat{\beta}_{j}(j=1,\cdots,N)\) is the final belief degree. \(\omega_{k}\) can be calculated by the following formula.  
\[\omega_{k}=\frac{\theta_{k}\underset{i=1}{\overset{M}{\prod}}(\alpha_{kj})^{ \delta_{i}}}{\underset{k=1}{\overset{L}{\prod}}\theta_{k}\underset{i=1}{ \overset{M}{\prod}}(\alpha_{kj})^{\delta_{i}}} \tag{4}\]  
where \(\alpha_{kj}(i=1,\cdots,M)\) denotes the degree to which the reference value is matched by the \(i\)th attribute of the \(k\)th rule. For qualitative information, match degrees can be given directly using expert knowledge, and for quantitative information, match degrees can be calculated using membership functions or expert rules.  
Expert knowledge can be used to set rule weights, attribute weights, and result belief degrees, but expert knowledge is sketchy and cannot set the accurate parameters enough. Therefore, the P-CMA-ES algorithm can be utilized to optimize the parameters of the BRB detection model [29; 30; 31].