1. 11/3/041 ME Extensible Markov Model Margaret H. Dunham, Yu Meng, Jie Huang CSE Department Southern Methodist University Dallas, Texas 75275 mhd@engr.smu.edu This material is based upon work supported by the National Science Foundation under Grant No. IIS-0208741

2. 11/3/042 EMM – Objectives/Outline Develop modeling techniques which can “learn” past behavior of spatiotemporal events. nObjectives nRelated Work nEMM Overview nEMM Applications and Performance

3. 11/3/043 Spatiotemporal Modeling nExample Applications: n Flood Prediction n Rare Event Detection – Network traffic, automobile traffic nRequirements n Capture Time n Capture Space n Dynamic n Scalable n Quasi-Real Time

4. 11/3/044 Problem with Markov Chains nThe required structure of the MC may not be certain at the model construction time. nAs the real world being modeled by the MC changes, so should the structure of the MC. nNot scalable – grows linearly as number of events. nMarkov Property nOur solution: n Extensible Markov Model (EMM) n Cluster real world events n Allow markov chain to grow and shrink dynamically

5. 11/3/045 EMM Overview nTime Varying Discrete First Order Markov Model nNodes are clusters of real world states. nLearning continues during prediction phase. nLearning: n Transition probabilities between nodes n Node labels (centroid of cluster) n Nodes are added and removed as data arrives

6. 11/3/046 Related Work nSplitting Nodes in HMMs n Create new states by splitting an existing state n M.J. Black and Y. Yacoob,”Recognizing facial expressions in image sequences using local parameterized models of image motion”, Int. Journal of Computer Vision, 25(1), 1997, 23-48. nDynamic Markov Modeling n States and transitions are cloned n G. V. Cormack, R. N. S. Horspool. “Data compression using dynamic Markov Modeling,” The Computer Journal, Vol. 30, No. 6, 1987. nAugmented Markov Model (AMM) n Creates new states if the input data has never been seen in the model, and transition probabilities are adjusted n Dani Goldberg, Maja J Mataric. “Coordinating mobile robot group behavior using a model of interaction dynamics,” Proceedings, the Third International Conference on Autonomous Agents (agents ’99), Seattle, Washington

7. 11/3/047 EMM vs AMM Our proposed EMM model is similar to AMM, but is more flexible: nEMM continues to learn during the application (prediction, etc.) phase. nThe EMM is a generic incremental model whose nodes can have any kind of representatives. nState matching is determined using a clustering technique. nEMM not only allows the creation of new nodes, but deletion (or merging) of existing nodes. This allows the EMM model to “forget” old information which may not be relevant in the future. It also allows the EMM to adapt to any main memory constraints for large scale datasets. nEMM performs one scan of data and therefore is suitable for online data processing.

8. 11/3/048 EMM Definition Extensible Markov Model (EMM): at any time t, EMM consists of an MC with designated current node, Nn, and algorithms to modify it, where algorithms include: nEMMCluster, which defines a technique for matching between input data at time t + 1 and existing states in the MC at time t. nEMMIncrement algorithm, which updates MC at time t + 1 given the MC at time t and clustering measure result at time t + 1. nEMMDecrement algorithm, which removes nodes from the EMM when needed.

9. 11/3/049 EMM Cluster nFind closest node to incoming event. nIf none “close” create new node nLabeling of cluster is centroid of members in cluster nProblem n O(n) n Examining use of Birch O(lg n)

10. 11/3/0410 EMM Increment <18,10,3,3,1,0,0><17,10,2,3,1,0,0><16,9,2,3,1,0,0><14,8,2,3,1,0,0><14,8,2,3,0,0,0><18,10,3,3,1,1,0.> 1/3 N1 N2 2/3 N3 1/1 1/3 N1 N2 2/3 1/1 N3 1/1 1/2 1/3 N1 N2 2/3 1/2 N3 1/1 2/3 1/3 N1 N2 N1 2/2 1/1 N1 1

11. 11/3/0411 EMM Decrement N2 N1N3 N5N6 2/2 1/3 1/2 N1N3 N5N6 1/6 1/3 Delete N2

12. 11/3/0412 EMM Performance – Growth Rate DataSim Threshold 0.990.9920.9940.9960.998 Ser went Jaccrd156190268389667 Dice7292123191389 Cosine1114193161 Ovrlap22334 Ouse Jaccrd566681105162 Dice40435266105 Cosine68101324 Ovrlap11111

13. 11/3/0413 EMM Performance – Growth Rate

14. 11/3/0414 EMM Performance - Prediction NARERMS No of States RLF0.3214231.5389 EMM Th=0.950.068443 0.43774 20 Th=0.990.046379 0.4496 56 Th=0.9950.055184 0.57785 92

15. 11/3/0415 Rare Events in Network Traffic nDetect (predict) unusual/rare behavior in network traffic. nLearning unusual behavior patterns and continue to learn as traffic arrives. nNot an outlier n We don’t know anything about the distribution of the data. Even if we did the data continues changing. n A model created based on a static view may not fit tomorrow’s data. nWe view a rare event as: n Unusual state of the network (or subset thereof). n Transition between network states which does not frequently occur. nBase rare event detection on determining events or transitions between events that do not frequently occur.

16. 11/3/0416 Rare Event Examples nThe amount of traffic through a site in a particular time interval as extremely high or low. nThe type of traffic (i.e. source IP addresses or destination addresses) is unusual. nCurrent traffic behavior is unusual based on recent precious traffic behavior. nUnusual behavior at several sites.

17. 11/3/0417 Rare Event Detection nObjective: Detect rare (unusual, surprising) events nTechnique: New data modeling tool developed by SMU DBGroup called Extensible Markov Model nAdvantages: n Dynamically learns what is normal n Based on this learning, can predict what is not normal n Do not have to a priori indicate normal behavior nApplications: n Network Intrusion n Data: IP traffic data, Automobile traffic data Weekdays Weekend Minnesota DOT Traffic Data Detected unusual weekend traffic pattern

18. 11/3/0418 Conclusion We welcome feedback