
216 The State of the Art in Intrusion Prevention and Detection
In our system design, we assume that a Markov chain is time invariant unless otherwise stated.
Moreover, we consider a one-step transition probability for the Markov model between each system
state and the other. Generally, the transition probability, P
i,j
, is described as the probability the system
is in a state (j) at time (t + 1) if the system is in state (i) at time t. When the system has a nite number
of states (1, 2, ..., s), the Markov model can be described by a matrix of transition probability:
P
pp p
pp p
pp p
ij
s
s
ss s
,
,, ,
,, ,
,, ,
=
11 12 1
21 22 2
12
ss