Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
YouTube Security VideosVisual Studio Code: VS Code Learn: Extending Agents(24.09.2026 um 21:00 Uhr)
•
YouTube Security VideosGoogle Cloud Tech: Turn Audio into Action with Gemini 3.5 Transcribe(24.09.2026 um 21:00 Uhr)
••••
Unix & Linux ServerUSN-8815-1: libass vulnerabilities(24.09.2026 um 16:57 Uhr)
•••••
YouTube Security VideosVisual Studio Code: VS Code Learn: Extending Agents(24.09.2026 um 21:00 Uhr)
•
YouTube Security VideosGoogle Cloud Tech: Turn Audio into Action with Gemini 3.5 Transcribe(24.09.2026 um 21:00 Uhr)
••••
Unix & Linux ServerUSN-8815-1: libass vulnerabilities(24.09.2026 um 16:57 Uhr)
•••••
Intelligence View
⚡ tsecurity.de Intelligence

Markov Chain Monte Carlo: Theoretical Foundations

Adapted from an appendix of my MS thesis. Markov Chain Monte Carlo Almost as soon as computers were invented, they were used for simulation. Markov chain Monte Carlo (MCMC) was invested as Los Alamos, Metropolis et al (1953)…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Adapted from an appendix of my MS thesis.







Markov Chain Monte Carlo



Almost as soon as computers were invented, they were used for simulation. Markov chain Monte Carlo (MCMC) was invested as Los Alamos, Metropolis et al (1953) simulated a liquid in equilibrium with its gas phase. Their tour de force was the realization that they did not need to simulate the exact dynamics, they only needed to simulate some Markov chain with the same equilibrium distribution. The Metropolis algorithm was widely used by chemists and physicists, but was not widely known among statisticians until after 1990. Hastings (1970) generalized the Metropolis algorithm, and simulations following his scheme are said to use the Metropolis-Hastings (MH) algorithm [1].



A special case of the MH algorithm was introduced by Geman et al (1984) discussing optimization to find the posterior mode rather than simulation. Algorithms following their scheme are said to use the Gibbs sampler. It took some time for the spatial statistics community to understand that the Gibbs sampler simulated the posterior distribution, thus enabling full Bayesian inference of all kinds. Gelfand et al (1990) made the wider Bayesian community aware of the Gibbs sampler, and then it was rapidly realized that most Bayesian inference could be done using MCMC, whereas very little could be done without MCMC. Green (1995) generalized the MH algorithm as much as it could be generalized [1].






Theoretical Foundations



A sequence


X1​,X2​,…

of random elements of some set is a Markov chain if the conditional distribution of

Xn+1​

given

X1​,…,Xn​

depends on

Xn​

only. The set in which the

Xi​

take values is called the state space of the Markov chain. A Markov chain has stationary transition probabilities if the conditional distribution of

Xn+1​

given

Xn​

does not depend on

n

. This is the main kind of Markov chain of interest in MCMC. The joint distribution of a Markov chain is determined by the following [1].




  • The marginal distribution of

    X1​

    called the initial distribution, and


  • The conditional distribution of

    Xn+1​

    given

    Xn​

    called the transition probability distribution.




If the state space is finite or countable, written

x1​,…,xn​

, then the initial distribution can be associated with a vector

λ=(λ1​,…,λn​)

defined by

P(X1​=xi​)=λi​

for

i=1,…,n

, and the transition probabilities can be associated with a matrix

P

having elements

pij​

defined by

P(Xn+1​=xj​∣Xn​=xi​)

where

i=1,…,n

and

j=1,…,n

. When the state space is uncountable, we must think of the initial distribution and transition probability distribution as unconditional and conditional probability distributions [1].



A stochastic process is stationary if for every positive integer

k

the distribution of the

k

-tuple

(Xn+1​,…,Xn+k​)

does not depend on

n

. An initial distribution is said to be stationary, invariant, or equilibrium for some transition probability distribution if the Markov chain specified by this initial distribution and transition probability distribution is stationary. Stationarity implies stationary transition probabilities, but not vice versa. The Metropolis-Hastings-Green (MHG) algorithm constructs a transition probability distribution that preserves a specified equilibrium distribution [1].



A transition probability distribution is reversible with respect to an initial distribution if for its Markov chain

X1​,X2​,…

, the distribution of pairs

(Xi​,Xi+1​)

is exchangeable. Reversibility implies stationarity, but not vice versa. A reversible Markov chain has the same laws running forward and backward. That is, for any

i

and

k

, the distributions

(Xi+1​,…,Xi+k​)

and

(Xi+k​,…,Xi+1​)

are the same. All known methods for constructing transition probabilities that preserve a specified equilibrium are special cases of the MHG algorithm, and all elementary updates from the MHG algorithm are reversible [1].



A bit of compute code that makes a pseudorandom change to its state is an update mechanism. An update mechanism is elementary if it is not made up of parts that are themselves update mechanisms preserving the specified distribution. Suppose the specified distribution (the desired stationary distribution of the MCMC sampler) has unnormalied density

h

. The Metropolis-Hastings update does the following [1]:




  • When the current state is

    x

    , propose a move to

    y

    , having conditional probability density given

    x

    denoted

    q(x,y)

    .



  • Calculate the Hastings ratio




    r(x,y)=h(x)q(x,y)h(y)q(y,x)​.



  • Accept the proposed move

    y

    with probability




    a(x,y)=min(1,r(x,y)),


    that is, the state after the update is

    y

    with probability

    a(x,y)

    , and the state after the update is

    x

    with probability

    1−a(x,y)

    .



For example, consider the probability density function

h(x)

is given by

h(x)=∫−∞∞​g(u)dug(x)​

where we cannot or do not desire to solve the integral in the denominator analytically. Therefore, the distribution is only known up to some unknown constant:

h(x)∝g(x)

. Notice that the ratio

h(x)h(y)​

from

r(x,y)

does not depend on the normalizing constant. The latter term

q(x,y)q(y,x)​

corrects for biases from the proposal distribution. The special case of the Metropolis-Hastings algorithm where the proposal distribution is symmetric meaning

q(y,x)=q(x,y)

is referred to as the Metropolis algorithm [1].



The Metropolis-Hastings update is reversible with respect to

h

, meaning that the transition probability that describes the update is an exact sampler of the specified distribution. If

Xn​

is the current state and

Yn​

is the proposal, we have

Xn​=Xn+1​

whenever the proposal is rejected. The distribution of

(Xn​,Xn+1​)

given rejection is exchangeable, and we must show that

(Xn​,Yn​)

is exchangeable given acceptance. That is, we must show that for any function

f

that has expectation, we can interchange the arguments of

f

[1].





E[f(Xn​,Yn​)a(Xn​,Yn​)]=∬f(x,y)h(x)a(x,y)q(x,y)dxdy=E[f(Yn​,Xn​)a(Xn​,Yn​)].



This follows if we can interchange

x

and

y

in

h(x)a(x,y)q(x,y)

. Only the set of

x

and

y

such that

h(x)>0

,

q(x,y)>0

, and

a(x,y)>0

contribute to the integral or sum in the discrete case. These inequalities further imply that

h(y)>0

and

q(y,x)>0

. Thus

r(y,x)=r(x,y)1​

for all

x

and

y

. Suppose that

r(x,y)≤1

, so

r(x,y)=a(x,y)

and

a(y,x)=1

. Then we have the following [1].





h(x)a(x,y)q(x,y)​=h(x)r(x,y)q(x,y)=h(y)q(y,x)=h(y)a(y,x)q(y,x).​



Conversely, suppose that

r(x,y)>1

, so

a(x,y)=1

and

a(y,x)=r(y,x)

, and we have the following [1].





h(x)a(x,y)q(x,y)​=h(x)q(x,y)=h(y)r(y,x)q(y,x)=h(y)a(y,x)q(y,x).​






References




  1. Brooks, Steve, Gelman, Andrew, Jones, Galin, Meng, Xiao-Li (Eds.) (2011) Handbook of Markov Chain Monte Carlo. Chapman and Hall/CRC.

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - Markov Chain Monte Carlo: Theoretical Foundations
id: d906ecf6-fcde-439b-9e47-87bf5ad5a5fe
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "Markov Chain Monte Carlo: Theo" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Markov Chain Monte Carlo Theoretical Fou")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Markov Chain Monte Carlo Theoretical Fou*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Markov Chain Monte Carlo Theoretical Fou"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Markov Chain Monte Carlo: Theoretical Fo.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Markov Chain Monte Carlo: Theoretical Foundations

Thematisch verwandte Begriffe: Markov, Chain, Monte, Carlo · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-61823 | code16 Sharp is a Laravel-based framework for building content-managemen…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel • Rechts: nächster Artikel • unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...
↗ Original-Quelle