# A Novel Method for Detecting Advanced Persistent Threat Attack Based on Belief Rule Base
## 4 Case Study
The paths of APT and normal attacks are partially overlapped. It is known from expert knowledge that the normal path should have an overlapping part with the attack path, but Figure 7 does not contain it. Figure 8 shows that No Attack has the highest rate and APT is the lowest. The rate of normal attacks is centered. As shown in Figure 9, the time interval of APT is random, while the time interval of normal data is regular. The time interval of Normal Attack is somewhere in between. In Figure 10, the transferred bytes of APT is very small and the transferred bytes of No Attack is large. The transferred bytes of Normal Attack are slightly higher than those of an APT. value of \"Medium\" is set to 200 \(\times\) 1024 according to the value of Normal Attack in Figure 10 and expert knowledge. Semantic results are replaced with numbers to facilitate program processing as shown in Table 7. The reference values in Table 7 are used only as a distinction of the results and have no other meaning. So, the rules can be described as follows:  
\[ \begin{split}& R_{k}:\text{If }\left(area_{1}\text{ is }A_{1}^{k}\right)\wedge\left(area_{2}\text{ is }A_{2}^{k}\right)\wedge\left(area_{3}\text{ is }A_{3}^{k}\right)\wedge\left( frequency\text{ is }A_{4}^{k}\right)\\ &\wedge\left(time\_interval\text{ is }A_{5}^{k}\right)\wedge\left( transmit\_bytes\text{ is }A_{6}^{k}\right)\\ &\text{Then Attack is }\left\{(No\_Attack,\beta_{1K}),(Normal\_ Attack,\beta_{2K}),( APT,\beta_{3K})\right\}\\ &\text{with rule weight }\theta_{k}(k=1,2,\cdots,L)\text{ and attribute weight }\delta_{i}(i=1,2,\cdots,M)\end{split}  \tag{6}\]  
The BRB detection model has 1728 rules combined by the above six attributes. Expert knowledge is used to set initial weights and belief degrees for each rule. Some of rules are shown in Table 8. Expert knowledge only gives approximate values, which are imprecise. For rule 1 in Table 8, when the area-1, area-2, area-3, etc., are determined, the expert is uncertain about whether an apt attack actually occurred. However, it is certain that it is not an normal attack. So, the belief degree is set to 0.5, 0, and 0.5. The data are randomly sorted as the input data. The top 25 of the input data are taken as the testing set and the remaining part as the training set. The P-CMA-ES algorithm is utilized to optimize the parameters to get the better results. The model is optimized for 80 rounds. Then, the 2 nd to 26 th samples of the input data are used as the testing set and the rest as the training set. It continues until, finally, the last 25 samples of the input data are used as the test set and the rest as the training set. A total of 65 rounds of training and testing are completed, and the average of the results is shown in Table 9. According to Table 9, the No Attack samples are all detected, but some other attacks are incorrectly detected as No Attack. The Normal Attack samples are detected in 77.88% of \begin{table}
\begin{tabular}{c c c c} \hline
**Linguistic Terms** & **Low** & **Medium** & **High** \\ \hline Values & 1024 & 204,800 & 2,621,440 \\ \hline \end{tabular}
\end{table} 
Table 6: Reference values of the transferred bytes difference. \begin{table}
\begin{tabular}{c c c c} \hline
**Linguistic Terms** & **Important Area** & **Secondary Area** & **Server** & **Public Network** \\ \hline Values & 1 & 2 & 3 & 4 \\ \hline \end{tabular}
\end{table} 
Table 3: Reference values of the area. \begin{table}
\begin{tabular}{c c c} \hline
**Linguistic Terms** & **Low** & **Medium** & **High** \\ \hline Values & 0.1 & 10 & 38 \\ \hline \end{tabular}
\end{table} 
Table 5: Reference values of the time interval difference. \begin{table}
\begin{tabular}{c c c} \hline
**Linguistic Terms** & **Low** & **Medium** & **High** \\ \hline Values & 1024 & 204,800 & 2,621,440 \\ \hline \end{tabular}
\end{table} 
Table 7: Reference values of the attack. From the numerical value of the results, BRB does not dominate. In Table 12, the prediction precision of BRB for No Attack is only 93.06%, which is smaller than the 100% of SVM and MLP.