Data analytics for network intrusion detection

The exponential growth and proliferation of wireless devices for different wireless applications have led to the emergence of cognitive radio network (CRN) for optimal utilization of scarce spectrum resources. However, these resources have grossly been under-utilized due to the inaccurate spectrum predictions. Existing spectrum occupancy and prediction techniques which rely on 2-state hidden Markov model (HMM) results in false alarm or missed detection caused by noisy or incomplete observable effects. In this paper, a 3-state HMM spectrum occupancy and prediction technique in CRNs is proposed. The transmission, emission and initial state probabilities of the proposed 3-state HMM parameters were derived based on the three canonical problems associated with HMM. The evaluation, decoding and learning problems were solved using Forward algorithm, Viterbi algorithm and the Baum-Welch algorithm, respectively. The performance of the proposed 3-state HMM spectrum prediction technique was evaluated using prediction accuracy, probability of detection and spectrum utilization efficiency. The simulation results obtained revealed that the 3-state HMM outperformed the 2-state HMM spectrum prediction technique by 24.1% in prediction accuracy.

BACKGROUND A hidden Markov model (HMM) is used for exon prediction on DNA of genes Plasmodium falciparum that has a model structure based on exon region structure in coding sequence (CDS). The objective research was to develop a new structure model to predict exon on DNA-genes of Plasmodium falciparum based on CDS structure using the HMM system. METHODS Model design in CDS, between two exon regions can be found one intron region and the model state number is used for its region. Its state number is used by separating start codon from first exon region and stop codon from the last exon region up to 9. The Viterbi algorithm and the backward-forward method for transition as well as emission states are used for training process. Furthermore, Viterbi and Baum-Welch algorithms are used for the testing process. The correlation coefficient (CC) was used as performance indicator, as the ratio of the estimated state in the output and the original state in the input of the model. RESULTS The simulation results has shown that the CC values depend on the given of the backward-forward transition state values randomly. The model with state number 9 showed the highest average of CC values of 0.7289 for Viterbi algorithm, and is 0.7166 for Baum-Welch algorithm. However, the lowest average of CC values has been found for the model with state number five. Its values are 0.6735 by using Viterbi algorithm and 0.6661 by using Baum-Welch algorithm. CONCLUSION The new structure model based on HMM system was valid to predict exon on DNA-genes of Plasmodium falciparum.

Many problems such as voice recognition, speech recognition and many other tasks have been tackled with Hidden Markov Models (HMMs). These problems can also be dealt with an extension of the Naive Bayesian Classifier (NBC) known as Dynamic NBC (DNBC). From a dynamic Bayesian network (DBN) perspective, in a DNBC at each time there is a NBC. NBCs work well in data sets with independent attributes. However, they perform poorly when the attributes are dependent or when there are one or more irrelevant attributes which are dependent of some relevant ones. Therefore, to increase this classifier accuracy, we need a method to design network structures that can capture the dependencies and get rid of irrelevant attributes. Furthermore, when we deal with dynamical processes there are temporal relations that should be considered in the network design. In order to learn automatically these models from data and increase the classifier accuracy we propose an evolutionary optimization algorithm to solve this design problem. We introduce a new encoding scheme and new genetic operators which are natural extensions of previously proposed encoding and operators for grouping problems. The design methodology is applied to solve the recognition problem for nine hand gestures. Experimental results show that the evolved network has higher average classification accuracy than the basic DNBC and a HMM.

The discrete channel hidden Markov models indicate the temporal statistical characteristics of the generated error sequences by fading channels with memory precisely. In this paper first the optimal order of the hidden Markov models is estimated using Baum Welch algorithm (BWA) with comparing statistics such as average loglikelihood and autocorrelation function for error modelling of IEEE 802.16/WiMAX standard. As a perfect alternative to HMM error models, a new efficient stochastic swarm intelligent-based particle swarm optimization (PSO)-HMM is suggested for this standard to find the global and optimal solution. Comparing the proposed method with the conventional (BWA) by performing numerical simulations using error sequences of various lengths, the results indicate the superiority of the PSO approach even when the target sequences are as short as 2000 in length; moreover, the appropriateness of the PSO-HMM is investigated for different sampling periods. It can be concluded that the PSO with two states arrives at high level of accuracy in contrast to HMM with much higher number of states. For validating the proposed method, the burst error statistics of the PSO-HMM with respect to the autocorrelation function and error free interval distribution of the original error sequence are presented. The simulation results indicate that the PSO-HMM has better performance to find the optimal model parameters more stable than (BWA).

Bayesian Restoration of Ion Channel Records using Hidden Markov Models

BackgroundHidden Markov models are widely used for genome analysis as they combine ease of modelling with efficient analysis algorithms. Calculating the likelihood of a model using the forward algorithm has worst case time complexity linear in the length of the sequence and quadratic in the number of states in the model. For genome analysis, however, the length runs to millions or billions of observations, and when maximising the likelihood hundreds of evaluations are often needed. A time efficient forward algorithm is therefore a key ingredient in an efficient hidden Markov model library.ResultsWe have built a software library for efficiently computing the likelihood of a hidden Markov model. The library exploits commonly occurring substrings in the input to reuse computations in the forward algorithm. In a pre-processing step our library identifies common substrings and builds a structure over the computations in the forward algorithm which can be reused. This analysis can be saved between uses of the library and is independent of concrete hidden Markov models so one preprocessing can be used to run a number of different models.Using this library, we achieve up to 78 times shorter wall-clock time for realistic whole-genome analyses with a real and reasonably complex hidden Markov model. In one particular case the analysis was performed in less than 8 minutes compared to 9.6 hours for the previously fastest library.ConclusionsWe have implemented the preprocessing procedure and forward algorithm as a C++ library, zipHMM, with Python bindings for use in scripts. The library is available at http://birc.au.dk/software/ziphmm/.

We show that noise can speed training in hidden Markov models (HMMs). The new Noisy Expectation-Maximization (NEM) algorithm shows how to inject noise when learning the maximum-likelihood estimate of the HMM parameters because the underlying Baum-Welch training algorithm is a special case of the Expectation-Maximization (EM) algorithm. The NEM theorem gives a sufficient condition for such an average noise boost. The condition is a simple quadratic constraint on the noise when the HMM uses a Gaussian mixture model at each state. Simulations show that a noisy HMM converges faster than a noiseless HMM on the TIMIT data set.

We propose a simple, fast, deterministic pre-fitting approach which derives the Baum–Welch algorithm initial values directly from the input data. Such pre-fitting has the purpose of improving the fitting time for a given Hidden Markov Model (HMM) while maintaining the original Baum–Welch algorithm as the fitting one. The fitting time is improved by avoiding the Baum–Welch algorithm sensitiveness through the generation of parameters closer to the global maximum likelihood. Furthermore, by keeping the original Baum–Welch algorithm as the fitting one, we guarantee that all related methods will continue to work properly. On the other hand, the pre-fitting generates the HMM parameters directly derived from time-series data, without any data transformation, using an [Formula: see text] operation.

The security of the Industrial Internet of Things (IIoT) is of vital importance, and the Network Intrusion Detection System (NIDS) plays an indispensable role in this. Although there is an increasing number of studies on the use of deep learning technology to achieve network intrusion detection, the limited local data of the device may lead to poor model performance because deep learning requires large-scale datasets for training. Some solutions propose to centralize the local datasets of devices for deep learning training, but this may involve user privacy issues. To address these challenges, this study proposes a novel federated learning (FL)-based approach aimed at improving the accuracy of network intrusion detection while ensuring data privacy protection. This research combines convolutional neural networks with attention mechanisms to develop a new deep learning intrusion detection model specifically designed for the IIoT. Additionally, variational autoencoders are incorporated to enhance data privacy protection. Furthermore, an FL framework enables multiple IIoT clients to jointly train a shared intrusion detection model without sharing their raw data. This strategy significantly improves the model's detection capability while effectively addressing data privacy and security issues. To validate the effectiveness of the proposed method, a series of experiments were conducted on a real-world Internet of Things (IoT) network intrusion dataset. The experimental results demonstrate that our model and FL approach significantly improve key performance metrics such as detection accuracy, precision, and false-positive rate (FPR) compared to traditional local training methods and existing models.

Background: The genomics and microarray technology played tremendous roles in the amount of biologically useful information on gene expression of thousands of genes to be simultaneously observed. This required various computational methods of analyzing these amounts of data in order to discover information about gene function and regulatory mechanisms. Methods: In this research, we investigated the usefulness of hidden markov models (HMM) as a method of clustering Plasmodium falciparum genes that show similar expression patterns. The Baum-Welch algorithm was used to train the dataset to determine the maximum likelihood estimate of the Model parameters. Cluster validation was conducted by performing a likelihood ratio test. Results: The fitted HMM was able to identify 3 clusters from the dataset and sixteen functional enrichment in the cluster set were found. This method efficiently clustered the genes based on their expression pattern while identifying erythrocyte membrane protein 1 as a prominent and diverse protein in P. falciparum. Conclusion: The ability of HMM to identify 3 clusters with sixteen functional enrichment from the 2000 genes makes this a useful method in functional cluster analysis for P. falciparum

This paper presents a learning algorithm for adaptive network intrusion detection based on clustering and naïve Bayesian classifier, which induces a hybridization of unsupervised and supervised learning processes. The proposed approach scales up the balance detection rates for different types of network intrusions, and keeps the false positives at acceptable level in network intrusion detection. The algorithm first clusters the network logs into several groups based on similarity of network logs, and then calculates the prior and class conditional probabilities for each cluster. In classifying a new network log, the algorithm calculates the similarity of attribute values of network data with each cluster and initialize a weight value for each cluster. Then each cluster classifies the network data with its priori and conditional probabilities that multiply with respective cluster's weight value. Finally, voting techniques applied for classifying the new network data based on each cluster's classification result. The performance of the proposed algorithm tested by employing KDD99 benchmark network intrusion detection dataset, and the experimental results proved that it improves the detection rates as well as reduces the false positives for different types of network intrusions.

The Hidden Markov Model (HMM) has become increasingly popular in the last several years because it is used in a wide range of applications. There are some inherent limitations of this type of statistical model. The major limitation of HMM is large hidden state space, which limits their practical purview. The objective of this work is to reduce the task of solving some classical algorithms (Forward, Backward, Baum-Welch) by review of their theoretical aspects, offering faster improved algorithms based on the decomposition technique which represent a general approach to solving a problem by breaking it up into smaller ones and solving each of the smaller ones separately.

Intrusion detection is an important issue for network security. Many machine learning based detection technologies have been put forward and obtained rather good results, such as Bayesian classifiers, Extreme learning machine. However, the performance of these methods is dependent on parameters to a great extent. Aiming at learning the optimal parameters of extreme learning machine for network intrusion detection, the paper proposes a new network intrusion detection based on hybrid rice algorithm optimized extreme learning machine (HRO-ELM). First, the extreme learning machine parameters are encoded as rice gene location, and the accuracy of test results represents the fitness value of the algorithm. Then the optimal parameters of the extreme learning machine are found by simulating rice breeding behavior, and a network intrusion detection classifier is established. Finally, the KDD99 data set is used and simulation results show that the HRO-ELM improves the accuracy of network intrusion detection and can meet the requirements of network intrusion online detection.

Credit scoring become an important task to evaluate an applicant by a banker. Many models and tools are available for making initial lending decisions. This paper presents an Hidden Markov Models (HMMs) for modeling credit scoring problems. Baum-Welch algorithm - an iterative process for estimating HMM parameters are often used to developed such models and improve the pattern recognition for many problems. We introduce HMM/Baum-Welch initial model selection: a tool developed to test the impact of choosing initial model to train Baum-Welch process. Experiments results show that the performance of learned models depend on different way of generating the initial models used in credit scoring.

The Baum-Welch algorithm together with its derivatives and variations has been the main technique for learning hidden Markov models (HMMs) from observational data. We present an HMM learning algorithm based on the nonnegative matrix factorization (NMF) of higher order Markovian statistics that is structurally different from the Baum-Welch and its associated approaches. The described algorithm supports estimation of the number of recurrent states of an HMM and iterates the NMF algorithm to improve the learned HMM parameters. Numerical examples are provided as well.