The Application of Baum-Welch Algorithm in Multistep Attack

Algorithm 1

Input: alert sequence.

    𝑂={𝑜₁,𝑜₂,…,𝑜_𝑇};

Output: the parameters of hidden Markov model.

   𝜆^(𝑛+1)=(𝐴^(𝑛+1),𝐵^(𝑛+1),𝜋^(𝑛+1)).

Step  1. Initialization.

    for 𝑛=0, select 𝑎⁽⁰⁾_𝑖𝑗,𝑏_𝑗(𝑘)⁽⁰⁾,𝜋_𝑖⁽⁰⁾, we can obtain the initial model 𝜆⁽⁰⁾=(𝐴⁽⁰⁾,𝐵⁽⁰⁾,𝜋⁽⁰⁾).

Step  2. Iterative calculation.

for 𝑛=1,2,…,

𝑎^(𝑛+1)_𝑖𝑗=∑^𝑇−1_𝑡=1𝜉_𝑡(𝑖,𝑗)∑^𝑇−1_𝑡=1𝛾_𝑡(𝑖);

𝑏_𝑗(𝑘)^(𝑛+1)=∑^𝑇_{𝑡=1,𝑜𝑡=𝑣𝑘}𝛾_𝑡(𝑗)∑^𝑇_𝑡=1𝛾_𝑡(𝑗);

𝜋_𝑖^(𝑛+1)=𝛾₁(𝑖).

where 𝛾_𝑡𝛼(𝑖)=^𝑡(𝑖)𝛽_𝑡(𝑖)=𝛼𝑝(𝑂∣𝜆)^𝑡(𝑖)𝛽_𝑡(𝑖)∑^𝑁_𝑗=1𝛼_𝑡(𝑗)𝛽_𝑡(𝑗)∑;

    𝜉_𝑡𝛼(𝑖,𝑗)=^𝑡(𝑖)𝑎_𝑖𝑗𝑏_𝑗(𝑜_𝑡+1)𝛽_𝑡+1(𝑗)=𝛼𝑝(𝑂∣𝜆)^𝑡(𝑖)𝑎_𝑖𝑗𝑏_𝑗(𝑜_𝑡+1)𝛽_𝑡+1(𝑗)∑^𝑁_𝑖=1∑^𝑁_𝑗=1𝛼_𝑡(𝑖)𝑎_𝑖𝑗𝑏_𝑗(𝑜_𝑡+1)𝛽_𝑡+1(𝑗).

Step  3. Termination. We can obtain the parameters of hidden Markov model.

𝜆^(𝑛+1)=(𝐴^(𝑛+1),𝐵^(𝑛+1),𝜋^(𝑛+1)).