title: The application of Baum-Welch algorithm in multistep attack.
abstract: The biggest difficulty of hidden Markov model applied to multistep attack is the determination of observations. Now the research of the determination of observations is still lacking, and it shows a certain degree of subjectivity. In this regard, we integrate the attack intentions and hidden Markov model (HMM) and support a method to forecasting multistep attack based on hidden Markov model. Firstly, we train the existing hidden Markov model(s) by the Baum-Welch algorithm of HMM. Then we recognize the alert belonging to attack scenarios with the Forward algorithm of HMM. Finally, we forecast the next possible attack sequence with the Viterbi algorithm of HMM. The results of simulation experiments show that the hidden Markov models which have been trained are better than the untrained in recognition and prediction.
authors.affiliation: College of Mathematics and Information Science, Hebei Normal University, Shijiazhuang 050000, China.
authors.forename: Yanxue
authors.initials: Y
authors.lastname: Zhang
authors.affiliation: College of Information Technology, Hebei Normal University, Shijiazhuang 050000, China.
authors.forename: Dongmei
authors.initials: D
authors.lastname: Zhao
authors.affiliation: The First Aeronautics College of PLAAF, Xinyang 464000, China.
authors.forename: Jinxing
authors.initials: J
authors.lastname: Liu
mesh_terms: D000465:Algorithms; D016494:Computer Security / Q000592:standards*; D020407:Internet / Q000592:standards*; D008390:Markov Chains