Anomaly detection based on a dynamic Markov model

Abstract

a b s t r a c tAnomaly detection in sequence data is becoming more and more important in a wide variety of application domains such as credit card fraud detection, health care in medical field, and intrusion detection in cyber security. In the existing anomaly detection approaches, Markov chain techniques are widely accepted for their simple realization and few parameters. However, the short memory property of a classical Markov model ignores the interaction among data, and the long memory property of a higher order Markov model clouds the relationship between the previous data and current test data, and reduces the reliability of the model. Besides, both of these models cannot successfully describe the sequences changing with a tendency. In this paper, we propose an anomaly detection approach based on a dynamic Markov model. This approach segments sequence data by a sliding window. In the sliding window, we define the states of data according to the value of the data and establish a higher order Markov model with a proper order consequently, to balance the length of the memory property and keep up with the trend of sequences. In addition, an anomaly substitution strategy is proposed to prevent the detected anomalies from impacting the building of the models and keep anomaly detection continuously. The experimental results using simulated datasets and real-world datasets have demonstrated that the proposed approach improves the adaptability and stability of anomaly detection in sequence data.

Improvement of Anomaly Detection Performance Using Packet Flow Regularity in Industrial Control Networks

“…The Markov dictionaries were created by training the normal data including both the periodic packets peculiar to ICSs and the packets irregularly transmitted between OSs. In particular, we modelled the second order Markov-chain because it has been claimed that high order Markov-chain would cause a decrease in the accuracy [11].…”

Anomaly Detection Based on Mining Six Local Data Features and BP Neural Network

“…One of the essential keys to develop anomaly detection models to detect the KPIs anomalies efficiently is time-series feature mining technique, which may affect the superior limit of the models. In previous studies, sliding window-based strategy was widely used for time series analysis, see for example [13][14][15][16] and the references therein. However, the prediction performance of this method relies on the description of similarity metrics between two sub-sequences.…”

AA-HMM: An Anti-Adversarial Hidden Markov Model for Network-Based Intrusion Detection

“…The enhanced versions of HMMs published in other papers [16][17][18][19][20][21][22][23] usually use some sort of prior knowledge to initialize the transition and emission matrices, which enables the adopted parameters' distribution comply with the real data distribution to be evaluated. As a result, we could not distinguish if the improvement in performance was due to the skewed initial model or the enhancement mechanisms created by us.…”

“…The efficiency problem might be resolved by quantum computers in the future [15], but deep-learning should not be considered the best choice for NIDS in terms of efficiency based on the current circumstances. (4) There are many enhanced models [16][17][18][19][20][21][22][23] classified as hybrid-type, which perform better by either combining the existing approaches in other domains (e.g., fuzzy logic) or creating novel mechanisms (e.g., feedback variables) specifically for NIDS (i.e., our AA-HMM), based on a specific shallow algorithm (e.g., decision tree) [14]. The temporary disadvantage of hybrid classifiers is that they need to be tested on various data sets to verify their stability.…”