Using Hidden Markov Model in Anomaly Intrusion Detection

Hidden Markov Model (HMM) has been successfully used in speech recognition and some classification areas. Since Anomaly Intrusion Detection can be treated as a classification problem, we proposed some basic idea on using HMM model to modeling user's behavior. Then we tried HMM modeling on the real SIAC company log data. The results are not good, the reasons are: 1. SIAC data gives us too little information that can distinguish normal behavior and anomaly behavior; 2. Anomaly Intrusion Detection is a very hard topic. By now, it is still in academic research area without real application; 3. HMM is suitable for one-dimension sequence classification, like voice wave or spectrum. Typical anomaly detection data are multi-dimensional sequences with continuous and discrete variables mixed together. It seems that HMM is not quite suitable for anomaly intrusion detection task.