Multi-stage attack detection algorithm based on gaussian mixture hidden markov and transfer learning

Abstract

The application discloses a multi-stage attack detection algorithm based on Gaussian mixture hidden Markov and transfer learning, and belongs to the technical field of network security. Firstly, GMM is used to cluster alarm data in a high-dimensional space, and true threat alarms are clustered from mixed alarms; combined with HMM, the continuity of MSA, unique alarm features of each stage and conversion information between stages are fully considered, and the problem that the learning of the model on alarm features is not comprehensive due to complex MSA is solved; secondly, the optimization Baum-Welch algorithm and the optimization Viterbi algorithm of the training model parameters are used to solve the recognition and prediction problems of the traditional HMM when facing complex multi-stage attacks and improve the performance of the model; finally, the improved TL method is used to fine-tune the GMM-HMM model parameters, and the KL divergence is added as a penalty term in the training algorithm to reduce the distribution difference between the source domain and the target domain, so that the deviation problem in the TL process is better solved.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically a multi-stage network attack detection algorithm based on Gaussian mixture hidden Markov and transfer learning. Background Technology

[0002] Multi-Stage Cyber ​​Attacks (MSAs) are a set of attack steps taken by one or more attackers within a network with a specific objective. Each attack typically involves at least two distinct actions. For single-step attacks, all relevant information is usually included in event logs and analysis, and can be linked to vulnerabilities in the system, allowing the attack to be isolated. However, for multi-step attacks, it is not only necessary to identify all single-step attacks but also to infer the relationships between each step, making the study and description of similarities between attacks much more difficult. MSA network traffic data often exhibits a complex continuous distribution, generating a large number of mixed alerts through Intrusion Detection Systems (IDS). These alerts are a mixture of genuine threat alerts from different attack stages, false positives, and interleaved alerts from different MSAs. Furthermore, the high-dimensional features of the alert data contain a large number of irrelevant and redundant features, making MSA detection a challenging task. Rovatsos et al. proposed a hybrid cumulative sum algorithm to solve the problem of detecting the fastest moving anomaly in a network. Jerez et al. proposed the Gaussian equivalence criterion as an equivalence standard for anomaly detection algorithms. Considering that different algorithms can detect different types of anomalies, these anomaly detection algorithms use predefined thresholds and statistical features to detect anomalous behavior.

[0003] Currently, Hidden Markov Models (HMMs) are commonly used in the field of multi-step attack detection to model the high-dimensional alert data generated by Intrusion Detection Systems (IDS) for Multi-Step Attacks (MSAs). For HMMs, each attack step is treated as a hidden state, and the observations are the alert data generated by the MSAs. HMMs model the transition probabilities between attack steps to predict the attack's progress. Therefore, HMMs are generally more suitable for situations where MSAs occur in a specific order over consecutive time intervals. However, MSAs typically occur in indefinite time intervals without a specific order, making it difficult for HMMs to accurately model them. Furthermore, when attackers perform interleaved attacks to conceal their attacks, IDS rapidly generate a large number of interleaved alerts, resulting in significant differences in alert characteristics across different stages. Furthermore, alerts containing genuine threats, false positives, and irrelevant alerts are mixed together. This complexity in distribution makes the model's learning of alert features incomplete, affecting the model's detection performance. Furthermore, traditional transfer learning (TL) methods address the issues of limited multi-step attack label datasets and difficulty in optimizing model parameters by transferring HMM parameters from the source domain to the target domain. However, traditional TL does not consider the differences between the source and target domain datasets and does not resolve the deviation between the source model and the target task during the transfer process, resulting in low performance in MSA detection. Summary of the Invention

[0004] This invention is a sequence modeling framework based on Gaussian Mixture Hidden Markov Model (GMM-HMM). It uses an optimized Baum-Welch algorithm and an optimized Viterbi algorithm for model training, optimizes model parameters based on an improved TL method, and uses KL (Kullback-Leibler) divergence as a penalty term to reduce the distribution difference between the source and target domains during the TL process. First, GMM is used to cluster alarm data in a high-dimensional space, efficiently clustering true threat alarms belonging to each stage from mixed alarms and separating false alarms from irrelevant alarms. Then, HMM is combined to fully consider the temporal structure between consecutive stages of MSA, the different alarm characteristics of each stage, and the transition between stages, solving the problem that the model's learning of alarm features is not comprehensive enough due to complex MSA. Second, the optimized Baum-Welch algorithm and the optimized Viterbi algorithm are used to train the model parameters to solve the identification and prediction problems of traditional HMM when facing complex MSA. The optimized Baum-Welch algorithm can estimate the model parameters more accurately to adapt to the complexity and uncertainty of MSA behavior, while the optimized Viterbi algorithm can more effectively identify and predict attack sequences, improving the model's detection performance. Finally, an improved TL method is used to fine-tune the GMM-HMM model parameters. At the same time, a KL divergence is added as a penalty term to the objective function of the model training algorithm to reduce the distribution difference between the source and target domains, thereby better solving the bias problem in the TL process.

[0005] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0006] A multi-stage attack detection algorithm based on Gaussian mixture hidden Markov and transfer learning includes the following steps:

[0007] Step 1: Preprocess the alarm data, extract features and reduce dimensionality to extract basic fields and assign observation and status symbols;

[0008] Step 2: The processed sequence data is fed into GMM-HMM for model training. The observation probability distribution of HMM is represented by GMM, which can effectively extract real threat alarms from complex alarm mixtures, while eliminating false alarms and irrelevant alarms. In the presence of multiple MSAs, the mixed alarm data is clustered into multiple GMMs. Each Gaussian component in these GMMs corresponds to each stage of the MSA. GMM-HMM comprehensively learns and processes a large number of complex and intertwined high-dimensional alarm features.

[0009] Step 3: The optimized Baum-Welch algorithm and the optimized Viterbi algorithm are used to estimate the model parameters so that the probability of the observation sequence under the model is maximized. This includes updating the state transition probability matrix, the initial state probability vector and the parameters of the Gaussian mixture model. The distribution of alarm observation samples is generated by GMM, while the state transition follows the rules of HMM.

[0010] Step 4: Using the improved TL method, the difficulty of optimizing model parameters and the finiteness of the MSA labeled dataset are solved by linearly transforming the source model parameters. At the same time, a KL divergence value is added as a penalty term to the objective function of the GMM-HMM training algorithm to reduce the distribution difference between the source and target domains and solve the bias problem in the TL process.

[0011] Furthermore, the GMM-HMM includes a six-tuple λ = (N, M, A, π, B, E), where N is the number of hidden states, M is the number of Gaussian mixture components in the GMM, representing the number of stages in a multi-stage network attack, A is the transition probability matrix, where each element represents the transition probability of the MSA from one stage to another, π is the initial probability distribution vector, representing the probability that each attack stage is the initial attack stage, B is the observation matrix, where each row represents the Gaussian component in the GMM clustered from the alarm data of each attack stage, composed of the parameter mixing coefficient ω, the mean vector μ, and the covariance matrix ∑, and E is the cluster center of each Gaussian component in the recorded GMM, serving as the judgment condition for the TL method.

[0012] Furthermore, step one specifically includes data parsing, data cleaning, feature encoding, feature scaling, feature extraction and dimensionality reduction, and sequence data preparation. After these steps, the preprocessed data is converted into a sequence format suitable for GMM-HMM, and symbolic representations are assigned to each attack phase and alarm type in the MSA dataset. Continuous alarm data is divided according to the alarm sample window size, and the data in each sample window is considered as an observation sequence. The values ​​of π and each element in A in the GMMM-HMM are initialized to... The observed data are clustered using the k-means algorithm. The center of each cluster is set as the mean of a Gaussian mixture, the covariance of the cluster is set as the covariance of the Gaussian mixture, and the ratio of the number of data points in the cluster to the total number of data points is set as the weight of the Gaussian mixture.

[0013] Furthermore, the mixing coefficient ω in GMM j This represents the proportion of the j-th Gaussian component. The parameters of the j-th sub-model are μ j Mean vector, ∑ jThe covariance matrix; each Gaussian component corresponds to a state in the GMM-HMM, and each state in the GMM-HMM corresponds to each stage of the MSA; the probability density function of the GMM is calculated by the following formula:

[0014] log P(O t |q t =s i ,Θ)=logω i N(O t |μ i , Σ i )

[0015]

[0016] Where ω i It is the mixing coefficient, N(O) t |μ i , ∑ i ) indicates observation O t Follows the mean μ i The covariance matrix is ​​∑ i The probability density function is a Gaussian distribution, where d is the dimension of the observed data (the number of features observed in the alarm sample).

[0017] Furthermore, an optimized Baum-Welch algorithm is developed to train GMM-HMM model parameters to address the identification and prediction problems of traditional HMMs in the face of complex multi-stage attacks. The probability distribution of alarm observations is determined by the GMM, including the calculation of forward and backward probabilities. The optimized Baum-Welch algorithm can more accurately estimate model parameters to adapt to the complexity and uncertainty of MSA behavior. In unsupervised learning (UL), the training data is unlabeled. To estimate the parameters of GMM-HMM using the optimized Baum-Welch algorithm, the Q-function is first calculated using the initial parameters. Then, given the observation data, new model parameters are found to maximize the Q-function. These two steps are repeated until the model parameters converge.

[0018] Furthermore, the forward probability α t (i) Backward probability β t (i) and the updated model parameters are calculated using the following formula:

[0019]

[0020]

[0021]

[0022]

[0023]

[0024]

[0025]

[0026] Wherein, the forward probability α t (i) indicates that the partial observation sequence up to time t is O1, O2, ..., O t And the state is s i The probability of the backward probability β t (i) indicates that the state is s at time t. i Under these conditions, the partial observation sequence from t+1 to T is O t+1 O t+2 , ..., O T The probability, GMM i (O t ) indicates the hidden state s i Generate observation data points O below t The probability of a Gaussian mixture model, GMM j (O t+1 ) represents the observed data point O t+1 From hidden state s j The probability of the generated Gaussian mixture model.

[0027] Furthermore, the optimized Viterbi algorithm, adapted to train GMM-HMM model parameters, can more effectively identify and predict attack sequences, improving the model's detection performance. The Viterbi algorithm uses dynamic programming to find the path with the highest probability, which corresponds to a state sequence, where the variable δ represents the state s at time t. i The maximum probability among all individual paths, the variable ψ is defined at time t when the state is s. i Find the state s of the (t-1)th node of the path with the highest probability among all individual paths. j The value of is determined by the observation probability density in the formula;

[0028] All the hidden states, the δ and ψ values ​​of the attack path phase are calculated using the following formula:

[0029]

[0030] ψ t (i) = argmax 1≤j≤N [δ t-1 (j)*A ji ], i = 1, 2, ... N.

[0031] Furthermore, the improved TL method proposed in step four achieves fine-tuning of the model parameters for the target task by performing a linear transformation on the source model parameters. It addresses the problem of scarce label data in the MSA scenario through UL (Ultimate Value Scale). The transfer formula for the optimized TL method is as follows:

[0032]

[0033]

[0034] in, These are the improved target domain model parameters, combined with the source domain model parameters λ. S and target domain model parameters λ T We obtain that k corresponds to the k-th state of the GMM-HMM, which is the k-th Gaussian component of the GMM, e k This represents the observation center of each Gaussian component of the GMM-HMM performed in the source domain under supervised learning (SL). This represents the observation center of each Gaussian component trained in the UL in the target domain, corresponding to the mean vector μ. k and ε is a threshold defined for the relevance between the source and the target.

[0035] Furthermore, the KL divergence value is used to measure the similarity between two probability distributions. A GMM-HMM is trained on the source domain, and another GMM-HMM is obtained on the target domain training dataset. The KL divergence between the GMMs-HMMs is calculated, and the calculated penalty term is added to the Q function of the GMM to form a new objective function. The GMM-HMM model is then trained and fine-tuned on the target domain training dataset using this penalized objective function. The KL divergence value between the two Gaussian components is calculated using the following formula:

[0036]

[0037] Where k is the dimension of the Gaussian component, tr represents the trace of the matrix, and det represents the determinant of the matrix.

[0038] The technological advancements achieved by this invention due to the adoption of the above technical solutions are as follows:

[0039] Compared to other technologies mentioned above, this invention offers faster mixed alarm processing speed and better MSA detection performance. Consequently, it demonstrates superior performance in evaluation metrics such as accuracy, Bayesian inference criterion (BIC), and adjusted RAND index (ARI).

[0040] This invention applies GMM combined with HMM to the field of MSA detection. By clustering high-dimensional alarm data with GMM and combining it with HMM, the temporal structure of MSA, alarm characteristics at each stage and transitions between stages are comprehensively considered, thereby improving the detection effect of MSA.

[0041] This invention is based on GMM-HMM and proposes an optimized Baum-Welch algorithm and an optimized Viterbi algorithm, combined with a forward-backward algorithm to train GMM-HMM model parameters and detect MSA attack sequences.

[0042] This invention employs an improved transfer learning method to adjust the adaptability of the source model parameters to the target task through linear transformation. This method aims to address the problem of scarce labeled data in multi-stage network attack scenarios through UL (Ultimate Learning). Simultaneously, a penalty term, KL divergence, is added to the objective function of the Gaussian Mixture Hidden Markov Model (GMMM) training algorithm to reduce the distribution difference between the source and target domains, thus solving the bias problem in the transfer learning process and improving the model's performance in detecting multi-stage network attacks. Attached Figure Description

[0043] Figure 1 This is the overall flowchart of the present invention;

[0044] Figure 2 This is a comparison of AS detection in various experiments under different alarm sample window sizes;

[0045] Figure 3 This is a comparison of CS detection in various experiments under different alarm sample window sizes;

[0046] Figure 4 This is a comparison of the prediction of NS1 in various experiments under different alarm sample window sizes;

[0047] Figure 5 This is a comparison of the prediction of NS2 in various experiments under different alarm sample window sizes;

[0048] Figure 6 This is a comparison of the prediction of NO1 in various experiments under different alarm sample window sizes;

[0049] Figure 7 This is a comparison of the prediction of NO2 by various experiments under different alarm sample window sizes;

[0050] Figure 8 This is a comparison of the BIC values ​​of GMM-HMM obtained from various experiments;

[0051] Figure 9 This is a comparison of the ARI values ​​of GMM-HMM obtained from various experiments. Detailed Implementation

[0052] The present invention will be further described in detail below with reference to embodiments:

[0053] like Figure 1 As shown, the multi-stage attack detection algorithm based on Gaussian mixture hidden Markov and transfer learning includes the following steps:

[0054] Step 1: Preprocess the alarm data, extract features and reduce dimensionality to extract basic fields and assign observation and status symbols;

[0055] Step 2: The processed sequence data is fed into GMM-HMM for model training. The observation probability distribution of HMM is represented by GMM, which can effectively extract real threat alarms from complex alarm mixtures, while eliminating false alarms and irrelevant alarms. In the presence of multiple MSAs, the mixed alarm data is clustered into multiple GMMs. Each Gaussian component in these GMMs corresponds to each stage of the MSA. GMM-HMM comprehensively learns and processes a large number of complex and intertwined high-dimensional alarm features.

[0056] Step 3: The optimized Baum-Welch algorithm and the optimized Viterbi algorithm are used to estimate the model parameters so that the probability of the observation sequence under the model is maximized. This includes updating the state transition probability matrix, the initial state probability vector and the parameters of the Gaussian mixture model. The distribution of alarm observation samples is generated by GMM, while the state transition follows the rules of HMM.

[0057] Step 4: Using the improved TL method, the difficulty of optimizing model parameters and the finiteness of the MSA labeled dataset are solved by linearly transforming the source model parameters. At the same time, a KL divergence value is added as a penalty term to the objective function of the GMM-HMM training algorithm to reduce the distribution difference between the source and target domains and solve the bias problem in the TL process.

[0058] (1) Construct SL_GMM-HMM to obtain model parameters λ SL

[0059] Using all the knowledge from the source domain Dataset 1, namely the alarm observation sequence and the hidden state sequence, we construct an SL_GMM-HMM using the SL method mentioned in Section 3.2, and denote the model parameters as λ. SL .

[0060] (2) Construct UL1_CML_GMM-HMM to obtain model parameters λ UL1

[0061] For the target domain, a UL1_CML_GMM-HMM is constructed using the UL-optimized Baum-Welch algorithm mentioned in Section 2.3 on the training set of Dataset 2, and the model parameters are denoted as λ.UL1 .

[0062] (3) Construct UL_TL_GMM-HMM to obtain model parameters λ TL

[0063] Based on the UL1_CML_GMM-HMM obtained in (2), the optimization TL method mentioned in Section 3.1 is used to transfer the source domain knowledge obtained in (1) to construct a UL_TL_GMM-HMM, and the model parameters are denoted as λ. TL .

[0064] (4) Construct UL2_CML_GMM-HMM to obtain model parameters λ UL2

[0065] To further verify the performance improvement brought by the transfer learning method, this paper merges Dataset 1 and Dataset 2 into a new dataset, uses the training set in this new dataset to train GMM-HMM on UL to construct UL2_CML_GMM-HMM, and denotes the model parameters as λ. UL2 .

[0066] In summary, this paper will obtain λ UL1 , λ TL , λ UL2 The detection and prediction performance of these three GMM-HMM parameters on the target domain validation set was compared using MSA. During the training phase, an optimized Baum-Welch algorithm was used to train the GMM-HMM. In the testing phase, the performance evaluation of UL1_CML_GMM-HMM, UL_TL_GMM-HMM, and UL2_CML_GMM-HMM was based on the same test observation sequence. The effectiveness of TL and GMM-HMM was verified by comparing their detection accuracy for all states (AS) and the current state (CS), as well as their prediction accuracy for the next state (NS) and the next observation (NO), using model parameters, forward-backward algorithms, and an optimized Viterbi algorithm.

[0067] The specific plan is as follows:

[0068] I. Alarm Data Preprocessing

[0069] GMM-HMM processes high-dimensional feature data such as alerts generated by IDS. The MSA dataset is fed into the IDS, which generates alert events by monitoring network traffic and logging. These events have high dimensionality, including multiple features such as rule name, category, priority, IP address, port number, protocol type, and timestamp. GMM-HMM models IDS alert events as sequential data. It preprocesses Snort IDS alerts, extracts features, and reduces dimensionality to extract basic fields and assign observation and status symbols, following these steps:

[0070] (1) Data parsing. Parse the given raw alarm event text into structured data such as CSV, ensuring that each field (such as rule ID, rule name, category, priority, etc.) is assigned a separate column.

[0071] (2) Data cleaning. Delete erroneous or invalid records and fill in missing values ​​using statistical methods (the median corresponding to a certain feature column).

[0072] (3) Feature encoding. One-hot encoding and label encoding are used to convert classification features (such as rule name, alarm classification, protocol type, etc.) into numerical features, and timestamps into absolute time, and then into relative time relative to the initial alarm.

[0073] (4) Feature scaling. Numerical features are scaled to achieve optimal performance when training the model. The features are scaled to the range [0, 1] using the min-max normalization method.

[0074] (5) Feature extraction and dimensionality reduction. Since IDS alert data has a high dimensionality, principal component analysis (PCA) is used to project the data into a lower-dimensional space, which helps reduce computational complexity and improve model performance.

[0075] (6) Sequence data preparation. The preprocessed data is converted into a sequence format suitable for GMM-HMM. Continuous alarm data is divided according to the alarm sample window size, and the data of each sample window is regarded as an observation sequence.

[0076] II. GMM-HMM and Training Algorithms

[0077] 2.1 Hidden Markov Model

[0078] Hidden Markov Models (HMMs) constitute a two-layer stochastic process. The first layer represents hidden states that cannot be directly detected. The second layer represents the observations generated by the system; in the field of network security, these observations originate from IDS alerts, which reflect the system's state. The literature outlines the quintuple representation of HMM parameters as λ = (Σ, S, A, B, π). The following is a brief explanation of the correspondence between the five HMM parameters and MSA detection tasks.

[0079] (1) x represents the possible observations based on IDS alerts, denoted as Σ={v1, v2, …, v M}

[0080] (2) S is the set of HMM states corresponding to similar attack steps, denoted as S = {s1, s2, ..., s}. N}

[0081] (3) A is the transition probability matrix, as shown in formulas (1) and (2). Discrete time t corresponds to the arrival time of the IDS alarm, a ij Indicates the system from state s i to s j The transition probability.

[0082] A={{a ij} N×N |a ij =P(q) t =s j |q t-1 =s i )} Formula (1)

[0083]

[0084] (4) B is an observation probability matrix that satisfies ∑ for all j∈[1, N] and k∈[1, M]. k b j (v k ) = 1, as shown in formulas (3) and (4). Where b j (v k This indicates that at a certain moment, the system is in state s. j And observed the symbol v k The probability of.

[0085] b j (v k )=P(o t =v k |q t =s j ) Formula (3)

[0086]

[0087] (5) π is an initial probability distribution vector, used to represent the probability of each state as the initial state, denoted as π = {π1, π2, ..., π}. N}

[0088] Hidden Markov Models (HMMs) face three core challenges: The training problem—tuning the HMM's parameters to maximize the probability of the observed sequence—is a difficult optimization problem. The decoding problem—finding the most probable state sequence given observations is a complex search problem. The evaluation problem—processing all possible state paths and calculating the probability of a specific observed sequence, given the HMM, is a complex probability computation problem.

[0089] 2.2 Gaussian Mixture Hidden Markov Model

[0090] This paper defines GMM-HMM as a six-tuple λ = (N, M, A, π, B, E). Here, N represents the number of hidden states, M represents the number of Gaussian mixture components in the GMM, A and π are defined as in the HMM five-tuple, and B and E are defined as follows.

[0091] (1) B represents a GMM composed of N Gaussian components, as shown in Equation (5). Each Gaussian component corresponds to a hidden state, which is represented by three parameters (mixing coefficient ω, mean vector μ, covariance matrix Σ).

[0092]

[0093] (2) E represents the cluster center of each Gaussian component in the GMM, denoted as E = {e1, e2, ..., e...} N}

[0094] This paper addresses three core challenges of GMM-HMM by employing optimized Baum-Welch, optimized Viterbi, and forward-backward algorithms. The training problem involves using the proposed optimized Baum-Welch algorithm to train the GMM-HMM, obtaining model parameters that maximize the probability of the observed sequence. The decoding problem involves using the proposed optimized Viterbi algorithm to find the most probable state sequence for a given set of observations. The evaluation problem involves using the forward-backward algorithm to calculate the probability of the observed sequence generated by the model, given the HMM.

[0095] 2.3 Optimized Baum-Welch Algorithm for GMM-HMM

[0096] In UL, the training data is unlabeled. For GMM-HMM, this means that only the observation sequence is known, with no state knowledge whatsoever. This paper uses an optimized Baum-Welch algorithm to estimate the parameters of GMM-HMM.

[0097] The EM (Expectation Maximization) algorithm is used for maximum likelihood estimation of parameters in probabilistic models containing latent variables. The main idea of ​​this algorithm is to iteratively optimize the parameters to maximize the likelihood of the observed sequence. First, the parameters are randomly initialized. Then, in the E-step (Expectation step), the Q-function is computed, which describes the relationship between the current parameters and the parameters for the next iteration. The M-step (Maximization step) searches for model parameters that maximize the Q-function given the observed data. These two steps are repeated until the model parameters converge.

[0098] The original Q-function of the EM algorithm is defined as shown in equation (6). Where Θ represents the model parameters, Θ (k) Let Y represent the model parameters for the k-th iteration, Y represent the observed variable data, and Z represent the latent variable data.

[0099] Q(Θ,Θ (k) )=∑ z P(Z|Y,Θ (k) Formula (6) is logP(Y, Z|Θ).

[0100] In this paper, the observed data are high-dimensional data in sequence form, and the state of the system at a certain moment is used as latent variable data. Therefore, the Q function of the optimized Baum-Welch algorithm proposed in this paper is defined as shown in Equation (7). The main difference from the original Q function is that, given the latent variables, the observation probability distribution P(O|q) is changed. t =s i Q) is determined by the GMM. Where T refers to the length of the observation sequence, O represents the observation sequence, and q... t =s i Let s represent the hidden state at time t. i .

[0101]

[0102] 2.3.1 E-step (Expectation step)

[0103] The forward-backward algorithm is used to obtain the forward and backward probabilities, and then the state-related probabilities P(q) are calculated. t =s i |O,Θ (k) ) and P(q t =s i qt+1 =s j |O,Θ (k) Then, by combining the probability density function of the GMM, the value of the Q function can be obtained.

[0104] Given model parameters, the forward probability represents the partial observation sequence up to time t as O1, O2, ..., O t And the state is s i The probability of backward probability represents the probability of state s at time t. i Under these conditions, the partial observation sequence from t+1 to T is O t+1 O t+2 , ..., O T The probability of.

[0105] In the forward probability calculation, the initial state probability π is used. i With a specific hidden state s i The probability of the generated GMM for the first observed data point O1. i The value of α is initialized by the product of (O1), i.e., α1(i) = π. i *GMM i (O1). Then, for each time point t (1 < t ≤ T) and each hidden state, first, the value of α from the previous time step is compared with the state transition probability A. ji Multiplying and summing these probabilities yields the sum of transition probabilities from the previous state to the current state. The recursive calculation of the forward probability generates observation data points O by summing these transition probabilities and applying them to the current state. t The probability of GMM i (O t It is accomplished by multiplying by ), that is

[0106] For the calculation of the backward probability, for each hidden state s i Initialize β T (i) = 1. Then, for each time point t (1 < t ≤ T) and each hidden state s i The recursive calculation of the backward probability is achieved through the state transition probability A. ij The next observation data point O t+1 From hidden state s j The probability of generating a GMM j (O t+1 This is accomplished by summing the product of the β value at the next time point and the β value at the next time point.

[0107] Therefore, we obtain P(q) t =s i |O,Θ(k) ) and P(q t =s i q t+1 =s j |O,Θ (k) These two probabilities are shown in formulas (8) and (9).

[0108]

[0109]

[0110] In the optimized Baum-Welch algorithm presented in this paper, the first half of the Q-function, P(q), has already been obtained. t =s i |O,Θ (k) The latter half is log P(O, q). t =s i |Θ) via log P(O|q t =s i ,Θ) and log P(q t =s i The summation is obtained by |Θ).

[0111] Given hidden state q t =s i Observation probability P(O) t |q t =s i Θ) is determined by the corresponding Gaussian components. logP(O t |q t =s i The expression for ω is shown in formula (10). i It is the mixing coefficient, N(O) t |μ i , ∑ i ) indicates observation O t Follows the mean μ i The covariance matrix is ​​∑ i The probability density function of the Gaussian distribution.

[0112] log P(O t |q t =s i ,Θ)=logω i N(O t |μ i , Σ i ) Formula (10)

[0113] For a multidimensional Gaussian distribution (e.g., d-dimensional), the probability density function is calculated as shown in (11). Here, d is the dimension of the observed data (the number of features observed in the alarm sample), O t It is the observation value at time t, μ i Is it related to the hidden state s i The mean vector of the corresponding Gaussian components, ∑ i Is it related to the hidden state s i The covariance matrix of the corresponding Gaussian components.

[0114]

[0115] In the E-step of the Baum-Welch algorithm, the Q-function is computed using these probabilities, and then the model parameters are optimized in the M-step.

[0116] 2.3.2 M-step (Maximization step)

[0117] Update the model parameters to maximize the Q function. Specifically, the Q function is maximized by updating the initial state probability vector π, the state transition matrix A, and the parameters (ω, μ, Σ) of the GMM, as follows.

[0118] (1) Update the initial state probability vector π. The initial state probability vector π is updated by maximizing the part of the Q function with respect to π. The updated π is calculated according to formulas (7) and (10). i As shown in formula (12).

[0119]

[0120] (2) Update the state transition probability matrix A. Update the state transition matrix by maximizing the portion of the Q function with respect to A. This yields the updated A. ij As shown in formula (13).

[0121]

[0122] (3) Update the parameters of the GMM. Update the mixing coefficients ω by maximizing the part of the Q function that is related to the GMM parameters. i Covariance matrix ∑ i and mean vector μ i As shown in formulas (14), (15), and (16) respectively.

[0123]

[0124]

[0125]

[0126] 2.4 The proposed optimized Viterbi algorithm for GMM-HMM

[0127] The Viterbi algorithm uses dynamic programming to find the path with the highest probability, which corresponds to a sequence of states. According to the principles of dynamic programming, the optimal path has the following property: if the optimal path passes through node t at time t... So, for from arrive Of all possible paths, the optimal path must be included in some of them. Based on this principle, starting from time t=1, the state s at time t is recursively calculated. i The maximum probability of each path is calculated until the state at time t=T is obtained. i The maximum probability of each path at time t=T. The maximum probability at time t=T is the probability P* of the optimal path, and the destination of the optimal path is... This is also obtained simultaneously. Therefore, the specific steps for optimizing the Viterbi algorithm are as follows. Wherein, the GMM-HMM model parameters and observations O = (o1, o2, ..., o...) T As input, output the optimal path. The variable δ is defined at time t when the state is s. i All individual paths The maximum probability is defined by the variable ψ, where the state is s at time t. i All individual paths The state s of the (t-1)th node of the path with the highest probability is obtained. j The value of .

[0128] (1) Initialize the δ and ψ values ​​of all hidden states, as shown in formulas (17) and (18). For each hidden state s i δ1(i) is calculated by multiplying the initial probability by the observation value O1 in the hidden state s. i The probability density is obtained from the corresponding Gaussian distribution. At the same time, the value of ψ is initialized to 0 because there is no previous state at this stage.

[0129] δ1(i)=π i *ω i *N(O1|μ i , ∑ i ), i = 1, 2, ... N Formula (17)

[0130] ψ1(i)=0,i=1,2,…N Formula (18)

[0131] (2) For each time step t (starting from 2 and continuing to T) and each hidden state s i Find the hidden state s given the model parameters Θ and the observation sequence O. iThe maximum probability path is found by formulas (19) and (20). This is achieved by finding the largest δ value among all values ​​at the previous time step t-1 and then comparing it with the corresponding state transition probability A. ji Multiply the product by the observation probability density, store the result in the δ matrix, and record the state s that maximizes the product. j The value of is stored in the ψ value matrix.

[0132] δ t (i)=max 1≤j≤N [δ t-1 (j)*A ji ]*ω i *N(O t |μ i , ∑ i ), i = 1, 2, ... N Formula (19)

[0133] ψ t (i) = argmax 1≤j≤N [δ t-1 (j)*A ji ], i = 1, 2, ... N Formula (20)

[0134] (3) Find the maximum value in the δ matrix of the last time step T, and denote it as P. * This value represents the probability of the most likely state sequence. Simultaneously, the corresponding hidden state is found. That is, the most likely hidden state at time step T, as shown in formulas (21) and (22).

[0135] P * =max 1≤i≤N δ T (i) Formula (21)

[0136]

[0137] (4) Starting from the last time step T, backtrack through the ψ value matrix all the way back to time step 1 to find the most likely hidden state sequence and obtain the optimal path. As shown in formula (23).

[0138]

[0139] III. Transfer Learning Methods

[0140] 3.1 Optimized Transfer Learning Methods

[0141] The application of knowledge transfer (TL) in GMM-HMM aims to achieve knowledge transfer from the source domain to the target domain. GMM-HMM is a method for network attack detection and prediction, but its performance is often limited by the characteristics of the dataset when dealing with problems in different data domains. Furthermore, network attacks are becoming increasingly complex. Through analysis of the MSA dataset, this study demonstrates the effectiveness of TL in GMM-HMM for MSA detection and prediction, addressing the challenges of low detection accuracy faced by traditional machine learning methods.

[0142] Chadza et al. proposed a migration formula for transferring HMM parameters from the source domain to the target domain, as shown in formula (24). Here, ζ is a ratio inversely proportional to the time instance t, ζ = 1 / t.

[0143]

[0144] Using the modified formula (24) As parameters of the target domain HMM, they can gradually incorporate knowledge from the source domain (λ) during the learning process. odd This method uses the similarity between the source and target domains to fine-tune the model parameters, which can avoid overfitting and better adapt to the target domain. However, it also has some drawbacks. This method relies on the similarity between the source and target domains. If the difference between them is too large, this parameter transfer may have an adverse effect on the learning results, because the knowledge transferred from the source domain is basically no longer applicable to the target domain. If the difference between the source and target domains is small, this method can only transfer a small amount of knowledge, even though most of the knowledge in the source domain is applicable to the target domain. Therefore, this invention proposes to use a formula related to the number of parameter learning iterations t, as shown in formulas (25) and (26). When the source and target are highly correlated, more knowledge is transferred; otherwise, less knowledge is transferred.

[0145]

[0146]

[0147] in, These are the improved target domain model parameters (by combining the source domain model parameters λ). S and target domain model parameters λ T ), k corresponds to the kth state of GMM-HMM, that is, the kth Gaussian component of GMM, e k This represents the observation center of each Gaussian component of the GMM-HMM performed in the source domain. This represents the observation center of each Gaussian component trained in the UL of the target domain, which corresponds to the mean vector μ. k and ε is a threshold representing the degree of relevance between the source and the target. f(t) is used to control the knowledge of the transfer; for example, the second line of the piecewise function formula indicates the transfer λ when the relevance between the source and the target is relatively low. S A lower value means less knowledge is transferred, and the λ value of the transferred knowledge decreases as the number of parameter learning iterations increases. S The reduction speed is faster. This can, to some extent, reduce the deviation between the source model and the target task.

[0148] Furthermore, to address potential bias issues during the training process, this paper proposes adding a penalty term to the objective function of the GMM-HMM model training algorithm to reduce the distributional difference between the source and target domains. A GMM-HMM is trained on the source domain, and another GMM-HMM is obtained on the target domain training dataset. The KL divergence between the GMMs is calculated, and the calculated penalty term is added to the Q function of the GMM to form a new objective function. This penalized objective function is then used to fine-tune the GMM-HMM model on the target domain training dataset.

[0149] KL divergence is used to measure the similarity between two probability distributions. For GMM-HMM, the KL divergence of the GMM is calculated. However, there is no closed-form solution for calculating the KL divergence of GMM. Therefore, the KL divergence is decomposed into a weighted sum of the KL divergences between each Gaussian component, as shown in Equation (27).

[0150]

[0151] Where, ω i This represents the i-th Gaussian component. It is the KL divergence between the two Gaussian components, calculated by formula (28).

[0152]

[0153] Where k is the dimension of the Gaussian component, tr represents the trace of the matrix, and det represents the determinant of the matrix.

[0154] The new objective function is represented as Q(Θ, Θ (k) ) * =Q(Θ,Θ) (k) )-τ*P, where Q(Θ, Θ (k) ) is the original Q function, P is the calculated penalty term (KL divergence), and τ is a regularization coefficient used to control the weight of the penalty term. As shown in formula (29).

[0155]

[0156] 3.2 Source Domain SL in the TL Model

[0157] In the SL method, this means that prior knowledge of the observed and hidden states is used to estimate the GMM-HMM parameters. The calculation methods for the initial state probability vector π, the state transition matrix A, and the GMM parameters proposed in this paper are as follows.

[0158] (1) Initial state probability vector π. Calculate the frequency of each hidden state as the starting state of the hidden state sequence. This is determined by considering all hidden state sequences starting with state s. i The ratio of the number of hidden state sequences to the total number of hidden state sequences is used for calculation, as shown in formula (30).

[0159]

[0160] (2) State transition matrix A. Each element a of A ij Calculated as from state s i to s j The ratio of the number of transitions to the total number of transitions from state i is shown in formula (31).

[0161]

[0162] (3) Parameters of GMM (μ, ∑, ω).

[0163] The mixing coefficient ω is calculated as shown in formula (32). It is calculated by the ratio of the number of observations corresponding to the i-th state in the training dataset to the total number of observations in the training dataset.

[0164]

[0165] The mean vector μ is calculated as shown in formula (33). Where O t It is the observation value at time t, I(q) t =s i ) is an indicator function, when q t =s i The value is 1 if the condition is met, and 0 otherwise. T represents the total number of observed samples. This is achieved through all corresponding hidden states s. i The ratio of the observed results to the number of observations corresponding to that state is used for calculation.

[0166]

[0167] Calculate the covariance matrix ∑, as shown in formula (34). Where, (O t -μ i (O) t -μ i ) T It is an outer product operation that computes the observation vector O. t and mean vector μ iThe outer product of the differences between them. This outer product is a square matrix representing the covariance of the bias in each dimension. The hidden state is s. i All observations O t The outer product of the biases and all hidden states is s i It is calculated by the ratio of the number of observations.

[0168]

[0169] Finally, record the cluster centers e1, e2, ..., e of the Gaussian components corresponding to each state. n This is used as a condition in the time-to-data structure (TL). In GMM-HMM, the cluster center of the Gaussian component corresponding to each state is its mean vector μ.

[0170] IV. Algorithm Evaluation

[0171] To verify the effectiveness of the proposed algorithm, we used the DARPA 2000 (including Inside and DMZ) and CSE-CIC-IDS2018 (including CSE-CIC1 and CSE-CIC2) MSA datasets. Data packets collected from Inside nodes and CSE-CIC1 were used as the source domain for optimizing the time-of-flight (TL) method, while data packets collected from DMZ nodes and CSE-CIC2 were used as the target domain. We conducted ablation experiments to verify the effectiveness of the proposed GMM-HMM alarm data modeling method, the TL optimization method, and the KL divergence method addressing the bias problem in the TL process. Furthermore, we verified the overall performance of the algorithm, including comparisons with other similar algorithms on various metrics.

[0172] The experimental environment for this paper was a computer with a 64-bit Windows 11 operating system, an Intel 12th generation i9 processor, 32GB of RAM, and an NVIDIA GeForce RTX 3060 GPU. The experiment was conducted using MATLAB 2023a.

[0173] 4.1 Dataset

[0174] This application uses the DARPA 2000 and CSE-CIC-IDS2018 MSA datasets, with packets collected from the Inside node and CSE-CIC1 as the source domain for optimizing the TL method, and packets collected from the DMZ node and CSE-CIC2 as the target domain, triggering alarms via Snort IDS.

[0175] The DARPA 2000 dataset contains two distributed denial-of-service (DDoS) scenarios. Each scenario has two nodes for packet collection and provides five dump files, capturing five independent phases of the attack traffic. These five phases of MSA are summarized as IP scanning, Sadmind probing, Sadmind exploitation, DDoS software installation, and initiation.

[0176] Unlike the DARPA 2000 dataset, the CSE-CIC-IDS2018 dataset provides a complex MSA scenario that includes seven interrelated specific attack types, which are divided into five phases: DoS (phase 1), DDoS (phase 2), Brute Force-Web, Brute Force-XSS and SQL Injection (phase 3), Penetration-Dropbox Download (phase 4), and Penetration-Nmap and Port Scan (phase 5).

[0177] For the DARPA 2000 dataset, the default Snort IDS rules are limited in their inability to detect the first four stages of an attack. To improve this, this paper uses custom rules described in the references (rules aggregated by PulledPork 0.7.4), as shown in Table 1. After applying these rules, the internal nodes in Scenario 1 generated 2306 alerts, and the DMZ nodes generated 2949 alerts, as shown in Table 2. For the CSE-CIC-IDS2018 dataset, the default rules are sufficient for detection.

[0178] Table 1. Customized Snort IDS rules for DARPA 2000 Scenario 1

[0179] Phase Customised Rules IP sweep ICMP-INFO Rules Sadmind probe PROTOCOL-RPC Rules,ICMP-INFO Rules Sadmind exploit PROTOCOL-RPC Rules DDoS install PROTOCOL-SERVICES RULES,TELNET Rules DDoS launch SNMP Rules,DDoS RULES

[0180] Table 2 Alarms generated by DARPA 2000 and CSE-CIC-IDS2018

[0181]

[0182] 4.2 Evaluation Indicators

[0183] The experiment considers the detection of AS and CS, as well as the prediction of NS and NO. For NS and NO, two possible levels are used. The probability of each state at the next time point is obtained by multiplying the current time-point state probability vector by the state transition probability matrix. Then, the two states with the highest probabilities (NS1 and NS2) are identified. NS level 1 calculates accuracy by comparing the actual next state with the predicted next state (NS1). NS level 2 compares whether the actual next state equals the two possible predicted next states (NS1 or NS2, either one is sufficient). The probability of each observation at the next time point is obtained by multiplying the current time-point state probability vector by the observation probability density. Then, the two observations with the highest probabilities (NO1 and NO2) are identified. The representations for NO level 1 and 2 are the same as for NS level 1 and 2.

[0184] To verify the effectiveness of the proposed algorithm, three performance metrics were used: Accuracy, BIC, and ARI, with BIC and ARI used for model parameter evaluation.

[0185] The accuracy of AS is the ratio of the number of times the actual state (States_Actual) and the predicted state (States_Computed) are the same at each time point of the observation sequence to the total number of states in the observation sequence, as shown in Equation (35). NS at time t+1 is s j The probability is obtained by using the current forward variable α. t (i) Multiply by the corresponding state transition a ij The calculation is shown in formula (36). NO at time t+1 is v. k The probability is obtained by considering the forward variable α. t (j) and the corresponding probabilistic GMM model j (v k The product is multiplied together, as shown in formula (37).

[0186]

[0187]

[0188]

[0189] The BIC value was used instead of the log-likelihood to include a penalty for over-parameterized models. The calculation method for BIC in the literature is shown in Equation (38). The optimal GMM-HMM is the model with the lowest BIC value.

[0190] BIC=-2×ln(P(O|λ))+(N 2 +2N-1)×ln(T) Formula (38)

[0191] ARI measures the consistency between the actual situation and the clustering results, and the best GMM-HMM is the model with the highest ARI value. The formulas for calculating ARI are shown in formulas (39) and (40).

[0192]

[0193]

[0194] 'a' represents the number of sample pairs in two clustering results that belong to the same Gaussian component; 'b' represents the number of sample pairs in two clustering results that do not belong to the same Gaussian component; 'c' represents the number of sample pairs in one clustering result that belong to the same Gaussian component but not in another clustering result; 'd' represents the number of sample pairs in one clustering result that do not belong to the same Gaussian component but belong to the same Gaussian component in another clustering result. Expected RI Max represents the expected value of the Rand index obtained under random conditions. RI This represents the maximum possible value of the RAND index.

[0195] To verify the effectiveness of the proposed GMM-HMM, and to evaluate the contributions of the optimized TL method and the KL divergence method for addressing the bias problem in the TL process to the proposed algorithm, the following experiments were conducted under the same experimental conditions.

[0196] Experiment 1: Training and validation of GMM-HMM model + UL1 on target domain Dataset 2 (GMM-HMM + UL1)

[0197] Experiment 2: Training and validation of GMM-HMM model + UL2 on target domain Dataset 1 + Dataset 2 (GMM-HMM + UL2)

[0198] Experiment 3: Training and validation of GMM-HMM model + optimized TL method on target domain Dataset 2 (GMM-HMM+TL)

[0199] Experiment 4: The proposed algorithm, GMM-HMM model + optimized TL method + KL divergence method, was trained and validated on the target domain Dataset 2 (GMM-HMM+TL+KL).

[0200] The experimental design of this invention uses a window size between 100 and 250 samples, sliding in increments of 30. The aim is to compare the detection accuracy of ablation experiments for AS and CS, and the prediction accuracy of NS and NO, under different alarm window sizes.

[0201] Figure 2The study shows the impact of varying alarm sample window sizes from 100 to 250 on AS detection in each experiment. As the window size increased, the accuracy of different techniques remained inconsistent.

[0202] Depend on Figure 2 It can be seen that the AS detection performance of each ablation experiment is better when the sample window size is 190. This indicates that the model can better utilize the information within the window at this sample window size. In particular, Experiments 3 and 4 significantly outperform Experiments 1 and 2, demonstrating the strong adaptability of the optimized TL method. Furthermore, Experiment 4 consistently performs best across all sample window sizes, indicating that the combination of TL and KL strategies can better improve model performance compared to other strategies.

[0203] Depend on Figure 3 It can be seen that the CS detection performance of Experiments 1 and 2 decreased with the increase of the sample window size. This may be because when the sample window is too large, the model may not be able to effectively process and utilize all the information within the window, leading to a performance decline. For Experiments 3 and 4, when the sample window sizes are 100 and 190, the accuracy increased from 72.4% and 85.3% to 79.53% and 90.19%, respectively. This may indicate that the introduction of TL and KL strategies can help the model better process and utilize the information within a large sample window. Furthermore, Experiment 4 consistently achieved the best performance across all experimental settings, further confirming the effectiveness of the TL and KL strategies. Experiment 4 reached its optimal performance with a sample window size of 190.

[0204] Depend on Figure 4 and 5 It can be seen that the prediction performance changes similarly under different alarm sample window sizes. Specifically, between 100 and 190 sample window sizes, except for Experiment 1 where the effect is not significant, the performance of the other experiments increases significantly with increasing window size, reaching its highest prediction accuracy at 190 sample window size. In predicting NS2, the prediction accuracies of Experiments 1, 2, 3, and 4 are 84.54%, 88.27%, 91.26%, and 97.23%, respectively, demonstrating that the proposed GMM-HMM modeling of alarms is very effective for detecting and predicting MSA. Furthermore, for predicting NS, Experiments 3 and 4 show that the KL divergence method, proposed to address the bias problem in the TL process, contributes significantly to the proposed algorithm, improving accuracy by a maximum of 7.86%.

[0205] Depend on Figure 6 and 7As can be seen, the prediction performance results of the two levels are quite similar. With sample window sizes of 100 and 190, Experiment 4 shows a significant improvement in prediction performance, reaching a maximum of 79.2% (NO 2). However, Experiments 1 and 2 show a significant decrease in accuracy with increasing sample size. Based on the performance of each ablation experiment, a window size of 160 is considered suitable for all experiments. Compared with Experiments 1 and 2 without using TL, Experiment 3 using TL shows only a limited improvement in the accuracy of NO prediction, and even a decrease. This further illustrates the importance of the KL divergence method proposed in this paper to address the bias problem in the TL process for the overall algorithm, and the maximum accuracy improvement compared to not using KL reaches 9.68%.

[0206] In addition to detection and prediction accuracy, BIC and ARI are also used to measure the consistency between the GMM-HMM parameters of each ablation experiment and the ideal parameters generated when training the entire target dataset with SL. Figure 8 and Figure 9 The comparisons are of the BIC and ARI values ​​of the GMM-HMM obtained from each experiment.

[0207] Depend on Figure 8 and Figure 9 It can be seen that Experiment 4 is the best experimental combination because the optimal GMM-HMM is the model with the lowest BIC value and the highest ARI value. It can also be seen that Experiments 3 and 4 using TL have significantly different ARI values ​​compared to Experiments 1 and 2 without TL, further demonstrating the contribution of the optimized TL method proposed in this paper to optimizing GMM-HMM parameters.

[0208] In summary, with an optimal window size of 190, the ablation experiment results are as follows: Figures 2-9 As shown, the proposed GMM-HMM modeling for alarm detection and MSA prediction is feasible. Based on this, the optimized TL method is introduced, significantly improving the model's detection and prediction performance compared to the traditional UL method. Furthermore, considering the bias issue in the TL process, a KL divergence value is added, further enhancing the detection and prediction accuracy of GMM-HMM. Therefore, the proposed algorithm achieves detection accuracies of 84.69% and 90.19% for AS and CS, respectively; prediction accuracies of 92.64% and 97.23% for NS1 and NS2, respectively; and prediction accuracies of 60.23% and 79.2% for NO1 and NO2, respectively.

Claims

1. A multi-stage attack detection algorithm based on Gaussian mixture hidden Markov and transfer learning, characterized in that... Includes the following steps: Step 1: Preprocess the alarm data, extract features and reduce dimensionality to extract basic fields and assign observation and status symbols; Step 2: The processed sequence data is fed into GMM-HMM for model training. The observation probability distribution of HMM is represented by GMM, which can effectively extract real threat alarms from complex alarm mixtures, while eliminating false alarms and irrelevant alarms. In the presence of multiple MSAs, the mixed alarm data is clustered into multiple GMMs. Each Gaussian component in these GMMs corresponds to each stage of the MSA. GMM-HMM comprehensively learns and processes a large number of complex and intertwined high-dimensional alarm features. Step 3: The optimized Baum-Welch algorithm and the optimized Viterbi algorithm are used to estimate the model parameters so that the probability of the observation sequence under the model is maximized. This includes updating the state transition probability matrix, the initial state probability vector and the parameters of the Gaussian mixture model. The distribution of alarm observation samples is generated by GMM, while the state transition follows the rules of HMM. An optimized Baum-Welch algorithm is developed to train GMM-HMM model parameters to address the identification and prediction problems of traditional HMMs when faced with complex MSA (Multiple Instances of Alarms). The probability distribution of alarm observations is determined by the GMM, including the calculation of forward and backward probabilities. The optimized Baum-Welch algorithm can more accurately estimate model parameters to adapt to the complexity and uncertainty of MSA behavior. The training data in UL (Ultimate Logic) is unlabeled. The optimized Baum-Welch algorithm is used to estimate the parameters of GMM-HMM. First, the Q-function is calculated using the initial parameters. Then, given the observation data, new model parameters are found to maximize the Q-function. These two steps are repeated until the model parameters converge. The optimized Viterbi algorithm, adapted for training GMM-HMM model parameters, can more effectively identify and predict attack sequences, improving the model's detection performance. The Viterbi algorithm uses dynamic programming to find the path with the highest probability, which corresponds to a sequence of states, where the variable δ represents the state s at time t. i The maximum probability among all individual paths, the variable ψ is defined at time t when the state is s. i Find the state s of the (t-1)th node of the path with the highest probability among all individual paths. j The value of is determined by the observation probability density in the formula; All hidden states, and the δ and ψ values ​​for each stage of the attack path are calculated using the following formula: Step 4: Using the improved TL method, the difficulty of optimizing model parameters and the finiteness of the MSA labeled dataset are solved by linearly transforming the source model parameters. At the same time, a KL divergence value is added as a penalty term to the objective function of the GMM-HMM training algorithm to reduce the distribution difference between the source and target domains and solve the bias problem in the TL process. The improved TL method proposed in step four achieves fine-tuning of the model parameters for the target task by performing a linear transformation on the source model parameters. It addresses the problem of scarce label data in the MSA scenario through UL (Ultimate Value Scale). The transfer formula for the improved TL method is as follows: in, These are the improved target domain model parameters, combined with the source domain model parameters λ. S and target domain model parameters λ T We obtain that k corresponds to the k-th state of the GMM-HMM, which is the k-th Gaussian component of the GMM, e k This represents the observation center of each Gaussian component of the GMM-HMM performed in the source domain. This represents the observation center of each Gaussian component trained in the UL in the target domain, corresponding to the mean vector μ. k and ε is a threshold defined for the relevance between the source and the target.

2. The multi-stage attack detection algorithm based on Gaussian mixture hidden Markov and transfer learning according to claim 1, characterized in that: The GMM-HMM includes a six-tuple λ = (N, M, A, π, B, E), where N is the number of hidden states, M is the number of Gaussian mixture components in the GMM, representing the number of stages in the MSA, a is the transition probability matrix, where each element represents the transition probability of the MSA from one stage to another, π is the initial probability distribution vector, representing the probability that each attack stage is the initial attack stage, B is the observation matrix, where each row represents the Gaussian component in the GMM clustered from the alarm data of each attack stage, composed of the parameter mixing coefficient ω, the mean vector μ, and the covariance matrix ∑, and E is the cluster center of each Gaussian component in the recorded GMM, serving as the judgment condition for the TL method.

3. The multi-stage attack detection algorithm based on Gaussian mixture hidden Markov and transfer learning according to claim 1, characterized in that: Step one specifically includes data parsing, data cleaning, feature encoding, feature scaling, feature extraction and dimensionality reduction, and sequence data preparation. After these steps, the preprocessed data is transformed into a sequence format suitable for GMM-HMM, and symbolic representations are assigned to each attack phase and alarm type in the MSA dataset. Continuous alarm data is divided according to the alarm sample window size, and the data in each sample window is considered as an observation sequence. The values ​​of π and each element in A of the Gaussian Mixture Hidden Markov Model are initialized to... The observed data are clustered using the k-means algorithm. The center of each cluster is set as the mean of a Gaussian mixture, the covariance of the cluster is set as the covariance of the Gaussian mixture, and the ratio of the number of data points in the cluster to the total number of data points is set as the weight of the Gaussian mixture.

4. The multi-stage attack detection algorithm based on Gaussian mixture hidden Markov and transfer learning according to claim 1, characterized in that: The mixing coefficient ω in GMM j This represents the proportion of the j-th Gaussian component. The parameters of the j-th sub-model are μ j Mean vector, ∑ j The covariance matrix; each Gaussian component corresponds to a state in the GMM-HMM, and each state in the GMM-HMM corresponds to each stage of the MSA; the probability density function of the Gaussian mixture model is calculated by the following formula: log P(O t |q t =s i ,Θ)=logω i N(O t |m i ,∑ i ) Where ω i It is the mixing coefficient, N(O) t |μ i ,∑ i ) indicates observation O t Follows the mean μ i The covariance matrix is ​​∑ i The probability density function of the Gaussian distribution, where d is the dimension of the observed data.

5. The multi-stage attack detection algorithm based on Gaussian mixture hidden Markov and transfer learning according to claim 1, characterized in that: The forward probability α t (i) Backward probability β t (i) and the updated model parameters are calculated using the following formula: Wherein, the forward probability α t (i) represents the partial observation sequence up to time t as O1, O2, ..., O t And the state is s i The probability of the backward probability β t (i) indicates that the state is s at time t. i Under these conditions, the partial observation sequence from t+1 to T is O t+1 O t+2 ,...,O T The probability, GMM i (O t ) indicates the hidden state s i Generate observation data points O below t The probability of a Gaussian mixture model, GMM j (O t+1 ) represents the observed data point O t+1 From hidden state s j The probability of the generated Gaussian mixture model.

6. The multi-stage attack detection algorithm based on Gaussian mixture hidden Markov and transfer learning according to claim 1, characterized in that: The KL divergence value is used to measure the similarity between two probability distributions. A Gaussian Mixture Model (GMM-HMM) is trained on the source domain, and another GMM-HMM is trained on the target domain dataset. The KL divergence between the GMMs is calculated, and the calculated penalty term is added to the Q-function of the GMM to form a new objective function. The GMM-HMM model is then trained and fine-tuned on the target domain dataset using this penalized objective function. The KL divergence value between the two Gaussian components is calculated using the following formula: Where k is the dimension of the Gaussian component, tr represents the trace of the matrix, and det represents the determinant of the matrix.

Images