## 3 Materials and Methods
### Two-Level Decision Fusion System
#### 3.3.2 Decision Fusion  
According to the D-S theory of evidence, we develop a fusion framework for detecting abnormal behavior, which could also be an indicator of the presence of an APT. Accordingto D-S, we use \(\Theta\) to denote the set of all possible states upon which detectors have the ability to express certain evidence. We presume that each detector can express its belief in each of the system states. For simplicity and clarity of presentation, we presume that for each observable variable, there is a detector in place. The frame of discernment \(\Theta\) is assumed to include three states, namely, ANOMALY, NORMAL, and \(\Theta\). Consequently, each detector needs to express its belief on a particular hypothesis \(H\subseteq 2^{\Theta}\), and on \(\Theta\). We use \(m(\Theta)\) to express the degree of uncertainty associated with a particular detector. A significant aspect of the D-S framework is the definition of the mass function. For this purpose, expert knowledge can be included in order to model the output of the mass function. However, to aid the procedure, we develop an approach that uses the \(k\) Nearest Neighbours (kNN) for regression computation, and embrace expert knowledge for parameter estimation. In the following, the steps for the definition of mass functions are detailed. _Step 1._ For a new behaviour \(b^{\prime}\) that is to be attested, let \(M(b^{\prime})\) denote the magnitude of the intervention, and \(C(y^{s},b^{\prime})\) the computed impact. The value of \(M(b^{\prime})\) can be computed in various ways, a straightforward approach would be the sum of deviations of control variable values from their mean values. In other cases (e.g., where timing is relevant for instance), a combination of the timing of applying interventions on control variables, and their deviation, could also be used for this purpose. Next, to establish the value of \(k\), we first assume that the magnitude of the attested intervention is comparable with apriorily learned neighbouring interventions. Accordingly, and, by leveraging expert knowledge on the attested infrastructure, the lower \(M^{-}(b^{\prime})\) and upper \(M^{+}(b^{\prime})\) bounds of \(M(b^{\prime})\) (\(M^{-}(b^{\prime})<M^{+}(b^{\prime})\)) are determined (see Figure 2). Then, the set of relevant points, that is, the set of values to be used in the attestation of this new intervention, is determined according to Equation (8):  
\[R_{y^{s}b^{\prime}}=\big{\{}C(y^{s},b)|M^{-}(b^{\prime})\leq M(b)\leq M^{+}(b ^{\prime}),\forall b\in\mathcal{B}^{s}\big{\}}. \tag{8}\]  
According to the equation above, \(k\) equals the number of elements in \(R_{y^{s}b^{\prime}}\). _Step 2._ In the next phase, the coordinates of the centroid \(\mathbf{C}\) given by the values in \(R_{y^{s}b^{\prime}}\) are determined:  
\[\mathbf{C}_{x}=\frac{1}{k}\sum_{b\in\mathcal{B}^{s}}M(b),\text{ where }C(y^{s},b)\in R_{y^{s}b^{\prime}},\] \[\mathbf{C}_{y}=\frac{1}{k}\sum_{b\in\mathcal{B}^{s}}C(y^{s},b). \tag{9}\]  
_Step 3._ This last step determines the values for the mass functions for each hypothesis \(H\). Unfortunately, various types of processes exhibit different behaviour. Some processes exhibit an approximately linear behaviour (considering possible measurement inaccuracies, and random noise), while others have a nonlinear behaviour. For each case, the estimate of the mass function should be particularly adapted. In order to ease the design of the mass function, we illustrate two cases that could be applicable. For example, in the case of a linear process, the coordinates of the centroid \(\mathbf{C}\) computed in the previous step represent the center of several rectangles. As shown in Figure 2(a), the white rectangle is the minimal bounding box that encapsulates all the \(k\) selected values. Accordingly, a new value that fits within the area of this rectangle is associated with normal behaviour. A second rectangle with the same center as the previous one, but with larger sides, yields the uncertainty area.