Abstract
Building profiles for processes and for interactive users is a important task in intrusion detection. This paper presents the results obtained with a Hierarchical Hidden Markov Model. The algorithm discovers typical ”motives” of a process behavior, and correlates them into a hierarchical model. Motives can be interleaved with possibly long gaps where no regular behavior is detectable. We assume that motives could be affected by noise,modeled as insertion, deletion and substitution errors. In this paper the learning algorithm is briefly recalled and then it is experimentally evaluated on three profiling case studies. The first case is built on a suite of artificial traces automatically generated by a set of given HHMMs. The challenge for the algorithm is to reconstruct the original model from the traces. It will be shown that the algorithm is able to learn HHMMs very similar to the original ones, in presence of noise and distractors. The second and third case studies refer to the problem of constructing a discriminant model for a user typing on a keyboard.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Bleha, S., Slivinsky, C., Hussein, B.: Computer-access security systems using keystroke dynamics. IEEE Transactions on Pattern Analysis and Machine Intelligence PAMI-12(12), 1217–1222 (1990)
Botta, M., Galassi, U., Giordana, A.: Learning complex and sparse events in long sequences. In: Proceedings of the European Conference on Artificial Intelligence, ECAI 2004, Valencia, Spain (August 2004)
Brown, M., Rogers, S.J.: User identification via keystroke characteristics of typed names using neural networks. International Journal of Man-Machine Studies 39, 999–1014 (1993)
Durbin, R., Eddy, S., Krogh, A., Mitchison, G.: Biological sequence analysis. Cambridge University Press, Cambridge (1998)
Fine, S., Singer, Y., Tishby, N.: The hierarchical hidden markov model: Analysis and applications. Machine Learning 32, 41–62 (1998)
Gussfield, D.: Algorithms on Strings, Trees, and Sequences. Cambridge University Press, Cambridge (1997)
Joyce, R., Gupta, G.: User authorization based on keystroke latencies. Communications of the ACM 33(2), 168–176 (1990)
Murphy, K., Paskin, M.: Linear time inference in hierarchical hmms. In: Advances in Neural Information Processing Systems (NIPS 2001), vol. 14 (2001)
Rabiner, L.R.: A tutorial on hidden markov models and selected applications in speech recognition. Proceedings of IEEE 77(2), 257–286 (1989)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2005 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Giordana, A., Galassi, U., Saitta, L. (2005). Experimental Evaluation of Hierarchical Hidden Markov Models. In: Bandini, S., Manzoni, S. (eds) AI*IA 2005: Advances in Artificial Intelligence. AI*IA 2005. Lecture Notes in Computer Science(), vol 3673. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11558590_25
Download citation
DOI: https://doi.org/10.1007/11558590_25
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-29041-4
Online ISBN: 978-3-540-31733-3
eBook Packages: Computer ScienceComputer Science (R0)