The Application of Baum-Welch Algorithm in Multistep Attack

Algorithm 3

   Viterbi_Algorithm(𝜆,𝑂):

   Input: alert sequence 𝑂={alert₁,alert₂,…,alert_𝑇};

   Output: (1) intent sequence: 𝑄={int𝑒𝑛𝑡₁,int𝑒𝑛𝑡₂,…,int𝑒𝑛𝑡_𝑇}.

      (2) the completed intent sequence and the next likely intent.

Begin:

  for 𝑖=1 to HMM_𝑚

  // HMM_𝑚 is the number of hidden Markov model(s)

  {

     Prob = Forward_Algorithm(hmm_𝑖, 𝑂);

     // calculate the probability of alert sequence generated by each hidden Markov

     // model(s)

  }

  Most_likely_multi-step_attack_intention = maximum(Prob);

  𝑄 = Viterbi_Algorithm(hmm_𝑖^′, 𝑂);

  // 𝑄 is the completed intent sequence

  // hmm_𝑖^′ is the maximum(Prob) of hmm_𝑖

  𝑄^′=𝑆−𝑄 // the next likely intent

  // 𝑆 is the intent sequence of hmm_𝑖^′

End;