Experimental evaluation of hierarchical hidden markov models

  • Authors:
  • Attilio Giordana;Ugo Galassi;Lorenza Saitta

  • Affiliations:
  • Dipartimento di Informatica, Università del Piemonte Orientale, Alessandria, Italy;Dipartimento di Informatica, Università del Piemonte Orientale, Alessandria, Italy;Dipartimento di Informatica, Università del Piemonte Orientale, Alessandria, Italy

  • Venue:
  • AI*IA'05 Proceedings of the 9th conference on Advances in Artificial Intelligence
  • Year:
  • 2005

Quantified Score

Hi-index 0.00

Visualization

Abstract

Building profiles for processes and for interactive users is a important task in intrusion detection. This paper presents the results obtained with a Hierarchical Hidden Markov Model. The algorithm discovers typical ”motives” of a process behavior, and correlates them into a hierarchical model. Motives can be interleaved with possibly long gaps where no regular behavior is detectable. We assume that motives could be affected by noise,modeled as insertion, deletion and substitution errors. In this paper the learning algorithm is briefly recalled and then it is experimentally evaluated on three profiling case studies. The first case is built on a suite of artificial traces automatically generated by a set of given HHMMs. The challenge for the algorithm is to reconstruct the original model from the traces. It will be shown that the algorithm is able to learn HHMMs very similar to the original ones, in presence of noise and distractors. The second and third case studies refer to the problem of constructing a discriminant model for a user typing on a keyboard.