A Detection Approach of User Behaviors Based on HsMM

Abstract: It is difficult for the existing anomaly detection methods to distinguish the burst of normal traffic from the anomalous traffic in a large-scale web site. This paper extends the current Hidden semi-Markov Model (HsMM) that is used for single sequence of observations to the HsMM with multiple sequences of observations, and proposes a detection approach on user behaviors based on this extended HsMM. Two new on-line algorithms are proposed in this approach to solve the problems that we have incomplete training data and need an algorithm for on-line updating of the model parameters. By conducting an experiment with a real traffic data, this approach shows that it is not only suitable for describing the characteristics of the access behaviors of users, but also effective in measuring the degree of normality of the user behaviors.