Masquerade detection using profile hidden Markov models

In this paper, we consider the problem of masquerade detection, based on user-issued UNIX commands. We present a novel detection technique based on profile hidden Markov models (PHMMs). For comparison purposes, we implement an existing modeling technique based on hidden Markov models (HMMs). We compare these approaches and show that, in general, our PHMM technique is competitive with HMMs. However, the standard test data set lacks positional information. We conjecture that such positional information would give our PHMM a significant advantage over HMM-based detection. To lend credence to this conjecture, we generate a simulated data set that includes positional information. Based on this simulated data, experimental results show that our PHMM-based approach outperforms other techniques when limited training data is available.     

Almost sure parameter estimation and convergence rates for hidden Markov models

A continuous-time version of Kronecker's Lemma is established and used to give rates of convergence for parameter estimates in hidden Markov models.     

A comparative evaluation of neural networks and hidden Markov models for monitoring turning tool wear

Condition monitoring of machine tool inserts is important for increasing the reliability and quality of machining operations. Various methods have been proposed for effective tool condition monitoring (TCM), and currently it is generally accepted that the indirect sensor-based approach is the best practical solution to reliable TCM. Furthermore, in recent years, neural networks (NNs) have been shown to model successfully, the complex relationships between input feature sets of sensor signals and tool wear data. NNs have several properties that make them ideal for effectively handling noisy and even incomplete data sets. There are several NN paradigms which can be combined to model static and dynamic systems. Another powerful method of modeling noisy dynamic systems is by using hidden Markov models (HMMs), which are commonly employed in modern speech-recognition systems. The use of HMMs for TCM was recently proposed in the literature. Though the results of these studies were quite promising, no comparative results of competing methods such as NNs are currently available. This paper is aimed at presenting a comparative evaluation of the performance of NNs and HMMs for a TCM application. The methods are employed on exactly the same data sets obtained from an industrial turning operation. The advantages and disadvantages of both methods are described, which will assist the condition-monitoring community to choose a modeling method for other applications.     

A multiscale edge detection algorithm based on wavelet domain vector hidden Markov tree model

The wavelet analysis is an efficient tool for the detection of image edges. Based on the wavelet analysis, we present an unsupervised learning algorithm to detect image edges in this paper. A wavelet domain vector hidden Markov tree (WD-VHMT) is employed in our algorithm to model the statistical properties of multiscale and multidirectional (subband) wavelet coefficients of an image. With this model, each wavelet coefficient is viewed as an observation of its hidden state and the hidden state indicates if the wavelet coefficient belongs to an edge. The WD-VHMT model can be learned by an expectation-maximization algorithm. After the model is learned, we employ an extended Viterbi algorithm to uncover the hidden state sequences according to the maximum a posterior estimation. The experiment results of the edge detection for several images are provided to evaluate our algorithm.     

On asymmetric generalised t stochastic volatility models

In stochastic volatility (SV) models, asset returns conditional on the latent volatility are usually assumed to have a normal, Student-t or exponential power (EP) distribution. An earlier study uses a generalised t (GT) distribution for the conditional returns and the results indicate that the GT distribution provides a better model fit to the Australian Dollar/Japanese Yen daily exchange rate than the Student-t distribution. In fact, the GT family nests a number of well-known distributions including the commonly used normal, Student-t and EP distributions. This paper extends the SV model with a GT distribution by incorporating general volatility asymmetry. We compare the empirical performance of nested distributions of the GT distribution as well as different volatility asymmetry specifications. The new asymmetric GT SV models are estimated using the Bayesian Markov chain Monte Carlo (MCMC) method to obtain parameter and log-volatility estimates. By using daily returns from the Standard and Poors (S&P) 500 index, we investigate the effects of the specification of error distributions as well as volatility asymmetry on parameter and volatility estimates. Results show that the choice of error distributions has a major influence on volatility estimation only when volatility asymmetry is not accounted for.     

Perception-based hidden Markov models: a theoretical framework for data mining and knowledge discovery

 The combination of objective measurements and human perceptions using hidden Markov models with particular reference to sequential data mining and knowledge discovery is presented in this paper. Both human preferences and statistical analysis are utilized for verification and identification of hypotheses as well as detection of hidden patterns. As another theoretical view, this work attempts to formalize the complementarity of the computational theories of hidden Markov models and perceptions for providing solutions associated with the manipulation of the internet.     

Bayesian analysis of stochastic volatility models with mixture-of-normal distributions

Stochastic volatility (SV) models usually assume that the distribution of asset returns conditional on the latent volatility is normal. This article analyzes SV models with a mixture-of-normal distributions in order to compare with other heavy-tailed distributions such as the Student-t distribution and generalized error distribution (GED). A Bayesian method via Markov-chain Monte Carlo (MCMC) techniques is used to estimate parameters and Bayes factors are calculated to compare the fit of distributions. The method is illustrated by analyzing daily data from the Yen/Dollar exchange rate and the Tokyo stock price index (TOPIX). According to Bayes factors, we find that while the t distribution fits the TOPIX better than the normal, the GED and the normal mixture, the mixture-of-normal distributions give a better fit to the Yen/Dollar exchange rate than other models. The effects of the specification of error distributions on the Bayesian confidence intervals of future returns are also examined. Comparison of SV with GARCH models shows that there are cases that the SV model with the normal distribution is less effective to capture leptokurtosis than the GARCH with heavy-tailed distributions.     

A review of Hidden Markov models and Recurrent Neural Networks for event detection and localization in biomedical signals

Biomedical signals carry signature rhythms of complex physiological processes that control our daily bodily activity. The properties of these rhythms indicate the nature of interaction dynamics among physiological processes that maintain a homeostasis. Abnormalities associated with diseases or disorders usually appear as disruptions in the structure of the rhythms which makes isolating these rhythms and the ability to differentiate between them, indispensable. Computer aided diagnosis systems are ubiquitous nowadays in almost every medical facility and more closely in wearable technology, and rhythm or event detection is the first of many intelligent steps that they perform. How these rhythms are isolated? How to develop a model that can describe the transition between processes in time? Many methods exist in the literature that address these questions and perform the decoding of biomedical signals into separate rhythms. In here, we demystify the most effective methods that are used for detection and isolation of rhythms or events in time series and highlight the way in which they were applied to different biomedical signals and how they contribute to information fusion. The key strengths and limitations of these methods are also discussed as well as the challenges encountered with application in biomedical signals.     

Embedding HMMs-based models in a Euclidean space: the topological hidden Markov models

Current extensions of hidden Markov models such as structural, hierarchical, coupled, and others have the power to classify complex and highly organized patterns. However, one of their major limitations is the inability to cope with topology: When applied to a visible observation (VO) sequence, the traditional HMM-based techniques have difficulty predicting the n-dimensional shape formed by the symbols of the VO sequence. To fulfill this need, we propose a novel paradigm named “topological hidden Markov models” (THMMs) that classifies VO sequences by embedding the nodes of an HMM state transition graph in a Euclidean space. This is achieved by modeling the noise embedded in the shape generated by the VO sequence. We cover the first and second level topological HMMs. We describe five basic problems that are assigned to a second level topological hidden Markov model: (1) sequence probability evaluation, (2) statistical decoding, (3) structural decoding, (4) topological decoding, and (5) learning. To show the significance of this research, we have applied the concept of THMMs to: (i) predict the ASCII class assigned to a handwritten numeral, and (ii) map protein primary structures to their 3D folds. The results show that the second level THMMs outperform the SHMMs and the multi-class SVM classifiers significantly.     

The H2-control for jump linear systems: cluster observations of the Markov state

The H₂-norm control problem of discrete-time Markov jump linear systems is addressed in this paper when part of, or the total of the Markov states is not accessible to the controller. The non-observed part of the Markov states is grouped in a number of clusters of observations; the case with a single cluster retrieves the situation when no Markov state is observed. The control action is provided in linear feedback form, which is invariant on each cluster, and this restricted complexity setting is adopted, aiming at computable solutions. We explore a recent result by de Oliveira, Bernussou, and Geromel (Systems Control Lett. 37 (1999) 261) involving an LMI characterization to establish a H₂ solution that is stabilizing in the mean square sense. The novelty of the method is that it can handle in LMI form the situation ranging from no Markov state observation to complete state observation. In addition, when the state observation is complete, the optimal H₂-norm solution is retrieved.     

Bayesian skew selection for multivariate models

We develop a Bayesian approach for the selection of skew in multivariate skew t distributions constructed through hidden conditioning in the manners suggested by either Azzalini and Capitanio (2003) or Sahu et al. (2003). We show that the skew coefficients for each margin are the same for the standardized versions of both distributions. We introduce binary indicators to denote whether there is symmetry, or skew, in each dimension. We adopt a proper beta prior on each non-zero skew coefficient, and derive the corresponding prior on the skew parameters. In both distributions we show that as the degrees of freedom increases, the prior smoothly bounds the non-zero skew parameters away from zero and identifies the posterior. We estimate the model using Markov chain Monte Carlo (MCMC) methods by exploiting the conditionally Gaussian representation of the skew t distributions. This allows for the search through the posterior space of all possible combinations of skew and symmetry in each dimension. We show that the proposed method works well in a simulation setting, and employ it in two multivariate econometric examples. The first involves the modeling of foreign exchange rates and the second is a vector autoregression for intra-day electricity spot prices. The approach selects skew along the original coordinates of the data, which proves insightful in both examples.