Hierarchical Hidden Markov Models for User/Process Profile Learning

• Autorzy: Galassi U. , Botta M. , Giordana A.
• Języki publikacji: EN

Abstrakty

EN

This paper presents an algorithm for automatically constructing sophisticated user/process profiles from traces of their behavior. A profile is encoded by means of a Hierarchical Hidden Markov Model (HHMM), which is a well formalized tool suitable to model complex patterns in long temporal or spatial sequences. A special sub-class of this hierarchical model, oriented to user/process profiling, is also introduced. The algorithm follows a bottom-up strategy, in which elementary facts in the sequences (motifs) are progressively grouped, thus building the abstraction hierarchy of a HHMM, layer after layer. The method is firstly evaluated on artificial data. Then a user identification task, from real traces, is considered. A preliminary experimentation with several different users produced encouraging results.

Słowa kluczowe

EN

hidden Markov model (HMM); modelling

• Wydawca: IOS Press
• Czasopismo: Fundamenta Informaticae
• Rocznik: 2007
• Tom: Vol. 78, nr 4
• Strony: 487--505
• Opis fizyczny: bibliogr. 21 poz., wykr.

Twórcy

autor

Galassi U.

autor

Botta M.

autor

Giordana A.

• Via Bellini 25G, 15100 - Aleksandria, Italy,

Bibliografia

• [1] Bleha, S., Slivinsky, C., Hussein, B.: Computer-access security systems using keystroke dynamics, IEEE Transactions on Pattern Analysis and Machine Intelligence, PAMI-12(12), 1990, 1217-1222.
• [2] Botta, M., Galassi, U., A.Giordana: Learning Complex and Sparse Events in Long Sequences, Proceedings of the European Conference on Artificial Intelligence, ECAI-04, Valencia, Spain, August 2004.
• [3] Brown, M., Rogers, S.: User identification via keystroke characteristics of typed names using neural networks, International Journal of Man-Machine Studies, 39, 1993, 999-1014.
• [4] Durbin, R., Eddy, S., Krogh, A., Mitchison, G.: Biological sequence analysis, Cambridge University Press, 1998.
• [5] Fawcett, T., Provost, F.: Adaptive Fraud Detection, Data Mining and Knowledge Discovery Journal, 1, 1997, 291-316.
• [6] Fine, S., Singer, Y., Tishby, N.: The Hierarchical Hidden Markov Model: Analysis and Applications, Machine Learning, 32, 1998, 41-62.
• [7] Forney, G. D.: The Viterbi algorithm, Proceedings of IEEE, 61, 1973, 268-278.
• [8] Gates, G.: The Reduced Nearest Neighbor Rule, IEEE Transactions on Information Theory, 18, 1972, 431-433.
• [9] Gussfield, D.: Algorithms on Strings, Trees, and Sequences, Cambridge University Press, 1997.
• [10] Hart, P.: The Condensed Nearest Neighbor Rule, IEEE Transactions on Information Theory, 14, 1968, 515-516.
• [11] Joyce, R., Gupta, G.: User authorization based on keystroke latencies, Communications of the ACM, 33(2), 1990, 168-176.
• [12] Lee,W., w. Fan,Miller, M., Stolfo, S., Zadok, E.: Toward cost-sensitive modeling for intrusion detection and response, Journal of Computer Security, 10, 2002, 5 - 22.
• [13] Lee, W., Stolfo, S.: Data Mining Approaches for Intrusion Detection, Proceedings of the Seventh USENIX Security Symposium (SECURITY '98), San Antonio, TX, 1998.
• [14] Levenstein, V.: Binary Codes Capable of Correcting Insertions and Reversals, Soviet. Phys. Dokl., 10, 1966, 707-717.
• [15] Murphy, K., Paskin, M.: Linear time inference in hierarchical HMMs, Advances in Neural Information Processing Systems (NIPS-01), 14, 2001.
• [16] Pazzani, M., Billsus, D.: Learning and Revising User Profiles: The Identification of Interesting Web Sites, Machine Learning, 27, 1997, 313331.
• [17] Rabiner, L.: A tutorial on hidden Markov models and selected applications in speech recognition, Proceedings of IEEE, 77(2), 1989, 257-286.
• [18] Rabiner, L., Juang, B.: Fundamentals of Speech Recognition, Prentice Hall, Englewood Cliffs, NY, 1993.
• [19] Smith, T.,Waterman,M.: Identification of CommonMolecular Subsequences, Journal ofMolecular Biology, 147, 1981, 195-292.
• [20] Stolfo, S., Fan, W., Lee, W., Prodromidis, A., Chan, P.: Cost-based Modeling for Fraud and Intrusion Detection: Results from the JAM Project, Proceedings of the 2000 DARPA Information Survivability Conference and Exposition (DISCEX '00), 2000.
• [21] Waterman, M.: Sequence Aligments in the Neighborhood of the Optimum with General Application to Dynamic programming, Proceedings of National Academy of Science, 80, 1983, 3123-3147.