The Application of Baum-Welch Algorithm in Multistep Attack

Algorithm 2

Forward_Algorithm (𝜆,𝑂):

Input: (1) alert sequence 𝑂={alert₁,alert₂,…,alert_𝑇};

    (2) hidden Markov model (HMM) 𝜆.

Output: the probability 𝑝(𝑂∣𝜆) generated by alert sequence 𝑂={alert₁,alert₂,…,alert_𝑇} of hidden Markov model.

Begin:

  (1) ∀int𝑒𝑛𝑡_𝑖∈𝜆,1≤𝑖≤𝑁.

   // 𝑁 is the number of attack intentions.

   calculate the probability of alert₁ generated by int𝑒𝑛𝑡_𝑖: 𝛼₁(𝑖)=𝜋_𝑖𝑏_𝑖(alert₁)

  (2) calculate the probability of alert sequence {alert₁,alert₂,…,alert_𝑇} and 𝑞_𝑡+1=int𝑒𝑛𝑡_𝑗.

   (a) at time 𝑡, calculate the probability of alert sequence {alert₁,alert₂,…,alert_𝑇} and 𝑞_𝑡=int𝑒𝑛𝑡_𝑗: 𝛼_𝑡(𝑗).

   (b) at time 𝑡+1, calculate the probability of intent sequence {alert₁,alert₂,…,alert_𝑇} generated by hidden Markov

   model (HMM): 𝜆 and

   𝑞_𝑡=int𝑒𝑛𝑡_𝑗: 𝛼_𝑡+1(𝑗)=∑^𝑁_𝑖=1𝛼_𝑡(𝑖)𝑎_𝑖𝑗𝑏_𝑗alert_𝑡+1 where 1≤𝑡≤𝑇−1;1≤𝑗≤𝑁.

  (3) calculate the probability of the intent sequence 𝑂={alert₁,alert₂,…,alert_𝑇} generated by hidden Markov

   model (HMM): 𝜆.

   𝑝(𝑂∣𝜆)=∑^𝑁_𝑖=1𝛼_𝑇(𝑖).

  (4) Return 𝑝(𝑂∣𝜆).

End;