Results 1 
9 of
9
Multiresolution Abnormal Trace Detection Using VariedLength nGrams and Automata
 IEEE Trans. on Systems, Man, and Cybernetics Part C: Applications and Reviews
, 2007
"... Detection and diagnosis of faults in a largescale distributed system is a formidable task. Interest in monitoring and using traces of user requests for fault detection has been on the rise recently. In this paper we propose novel fault detection methods based on abnormal trace detection. One essent ..."
Abstract

Cited by 27 (5 self)
 Add to MetaCart
(Show Context)
Detection and diagnosis of faults in a largescale distributed system is a formidable task. Interest in monitoring and using traces of user requests for fault detection has been on the rise recently. In this paper we propose novel fault detection methods based on abnormal trace detection. One essential problem is how to represent the large amount of training trace data compactly as an oracle. Our key contribution is the novel use of variedlength ngrams and automata to characterize normal traces. A new trace is compared against the learned automata to determine whether it is abnormal. We develop algorithms to automatically extract ngrams and construct multiresolution automata from training data. Further both deterministic and multihypothesis algorithms are proposed for detection. We inspect the trace constraints of real application software and verify the existence of long ngrams. Our approach is tested in a real system with injected faults and achieves good results in experiments. 1.
Learning hidden markov models using nonnegative matrix factorization
, 2008
"... Abstract—The BaumWelsh algorithm together with its derivatives and variations has been the main technique for learning Hidden Markov Models (HMM) from observational data. We present an HMM learning algorithm based on the nonnegative matrix factorization (NMF) of higher order Markovian statistics t ..."
Abstract

Cited by 6 (1 self)
 Add to MetaCart
(Show Context)
Abstract—The BaumWelsh algorithm together with its derivatives and variations has been the main technique for learning Hidden Markov Models (HMM) from observational data. We present an HMM learning algorithm based on the nonnegative matrix factorization (NMF) of higher order Markovian statistics that is structurally different from the BaumWelsh and its associated approaches. The described algorithm supports estimation of the number of recurrent states of an HMM and iterates the nonnegative matrix factorization (NMF) algorithm to improve the learned HMM parameters. Numerical examples are provided as well. Index Terms—Hidden Markov Models, machine learning, nonnegative matrix factorization.
Hidden Markov Models for Automated Protocol Learning
"... Abstract. Hidden Markov Models (HMMs) have applications in several areas of computer security. One drawback of HMMs is the selection of appropriate model parameters, which is often ad hoc or requires domainspecific knowledge. While algorithms exist to find local optima for some parameters, the numbe ..."
Abstract

Cited by 2 (1 self)
 Add to MetaCart
(Show Context)
Abstract. Hidden Markov Models (HMMs) have applications in several areas of computer security. One drawback of HMMs is the selection of appropriate model parameters, which is often ad hoc or requires domainspecific knowledge. While algorithms exist to find local optima for some parameters, the number of states must always be specified and directly impacts the accuracy and generality of the model. In addition, domain knowledge is not always available or may be based on assumptions that prove incorrect or suboptimal. We apply the ɛmachine—a special type of HMM—to the task of constructing network protocol models solely from network traffic. Unlike previous approaches, ɛmachine reconstruction infers the minimal HMM architecture directly from data and is well suited to applications such as anomaly detection. We draw distinctions between our approach and previous research, and discuss the benefits and challenges of ɛmachines for protocol model inference.
On the relationship between symbolic and neural computation
 Behavioral and Brain Sciences
, 2004
"... There is a need to clarify the relationship between traditional symbolic computation and neural network computation. We suggest that traditional contextfree grammars are best understood as a special case of neural network computation; the special case derives its power from the presence of cert ..."
Abstract

Cited by 2 (2 self)
 Add to MetaCart
There is a need to clarify the relationship between traditional symbolic computation and neural network computation. We suggest that traditional contextfree grammars are best understood as a special case of neural network computation; the special case derives its power from the presence of certain kinds of symmetries in the weight values. We describe a simple class of stochastic neural networks, Stochastic Linear Dynamical Automata (SLDAs), define Lyapunov Exponents for these networks, and show that they exhibit a significant range of dynamical behaviors—contractive and chaotic, with context free grammars at the boundary between these regimes. Placing contextfree languages in this more general context has allowed us, in previous work, to make headway on the challenging problem of designing neural mechanisms that can learn them.
The observer's observer's paradox
 Journal of Experimental & Theoretical Artificial Intelligence
, 2013
"... epistemology of true contradictions. Logos Architekton. Journal of Logic and ..."
Abstract

Cited by 2 (2 self)
 Add to MetaCart
(Show Context)
epistemology of true contradictions. Logos Architekton. Journal of Logic and
Master’s Thesis: Mining for Frequent Events in Time Series
, 2004
"... While much work has been done in mining nominal sequential data much less has been done on mining numeric time series data. This stems primarily from the problems of relating numeric data, which likely contains error or other variations which make directly relating values difficult. To handle this p ..."
Abstract
 Add to MetaCart
(Show Context)
While much work has been done in mining nominal sequential data much less has been done on mining numeric time series data. This stems primarily from the problems of relating numeric data, which likely contains error or other variations which make directly relating values difficult. To handle this problem, many algorithms first convert data into a sequence of events. In some cases these events are known a priori, but in others they are not. Our work evaluates a set of time series data instances in order to determine likely candidates for unknown underlying events. We use the concept of bounding envelopes to represent the area around a numeric time series in which the unknown noisefree points could exist. We then use an algorithm similar to Apriori to build up sets of envelope intersections. The areas created by these intersections represent common patterns found throughout the data. Acknowledgements I would like to thank my advisor, Professor Carolina Ruiz, for all her help and
Structure Discovery in Hidden Markov Models
"... have not otherwise been submitted in any form for any degree or diploma to any tertiary institution. Where use has been made of the work of others it is duly acknowledged in the text. Name: Date: ..."
Abstract
 Add to MetaCart
(Show Context)
have not otherwise been submitted in any form for any degree or diploma to any tertiary institution. Where use has been made of the work of others it is duly acknowledged in the text. Name: Date: