Experimental Evaluation of Hierarchical Hidden Markov Models

Building profiles for processes and for interactive users is a important task in intrusion detection. This paper presents the results obtained with a Hierarchical Hidden Markov Model. The algorithm discovers typical ”motives” of a process behavior, and correlates them into a hierarchical model. Motives can be interleaved with possibly long gaps where no regular behavior is detectable. We assume that motives could be affected by noise,modeled as insertion, deletion and substitution errors. In this paper the learning algorithm is briefly recalled and then it is experimentally evaluated on three profiling case studies. The first case is built on a suite of artificial traces automatically generated by a set of given HHMMs. The challenge for the algorithm is to reconstruct the original model from the traces. It will be shown that the algorithm is able to learn HHMMs very similar to the original ones, in presence of noise and distractors. The second and third case studies refer to ...

• Type: Conference
• Year: 2005
• Where: AIIA
• Authors: Attilio Giordana, Ugo Galassi, Lorenza Saitta
• Keywords: AIIA 2005, Algorithm, Artificial Intelligence, Case Studies, Hierarchical Hidden Markov Model