Hidden Markov Models for Automated Protocol Learning

Citation

• S. Whalen, M. Bishop, and J. Crutchfield, “Hidden Markov Models for Automated Protocol Learning,” Proceedings of SecureComm 2010 pp. 415–428 (Sep. 2010).

Paper

• Published version web page, paper paywalled at Springer Link: [DOI] [URL]

Abstract

Hidden Markov Models (HMMs) have applications in several areas of computer security. One drawback of HMMs is the selection of appropriate model parameters, which is often ad hoc or requires domain-specific knowledge. While algorithms exist to find local optima for some parameters, the number of states must always be specified and directly impacts the accuracy and generality of the model. In addition, domain knowledge is not always available or may be based on assumptions that prove incorrect or sub-optimal. We apply the ε-machine—a special type of HMM—to the task of constructing network protocol models solely from network traffic. Unlike previous approaches, ε-machine reconstruction infers the minimal HMM architecture directly from data and is well suited to applications such as anomaly detection. We draw distinctions between our approach and previous research, and discuss the benefits and challenges of ε-machine for protocol model inference.

Bibliographic Information: [BibTeX] [RIS]
DOI: 10.1007/978-3-642-16161-2_24