# AA-HMM: An Anti-Adversarial Hidden Markov Model for Network-Based Intrusion Detection
## 1 Introduction  
In the practical deployment of Network Intrusion Detection System (NIDS) in the industry, there is an imbalance phenomenon--almost only signature-based detectors are being used, which scan characteristic byte sequences of the network traffic [1]. This situation is somewhat striking, especially when considering that Machine Learning (ML) has successfully been implemented in many other areas of computer science, often resulting in large-scale deployments in the commercial world. Examples from these domains include product recommendation systems (such as those used by Amazon [2] and Netflix [3]), optical character recognition systems [4], natural language translation [5], and spam detection [6], which is closer to the NIDS scenario [1]. One of the important reasons causing this imbalance phenomenon is that ML-based NIDS is working in an adversarial environment, which makes detection tasks challenging due to the presence of adaptive and intelligent adversaries who can carefully manipulate the attacking payload to evade detection. These evasion attacks undermine the underlying assumption of ML--the stationarity (the same distribution) of data for training and testing [7]. As a larger number of novel on-line services are emerging, the patterns of legitimate behaviors have become diversified, which in turn blur the boundary between normal and anomaly patterns [8]. Consequently, the existing ML-based NIDS cannot attain the required the industry-level performance attributed to the aforementioned two reasons. Technically, the ML algorithms currently being studied and created for NIDS can be classified into four categories [9; 10]: (1) ensemble-based, (2) clustering-based, (3) deep-learning, and (4) hybrid. However, each one has its disadvantages. (1) The performance of ensemble-based classifiers is highly unpredictable on unseen samples due to the high and non-eliminable correlations among the base classifiers [11; 12]. (2) Since clustering-based models are unsupervised classifiers, their performance is not reliable as they classify samples without learning knowledge from the true labels. In many cases, a clustering algorithm is usually used as a component of a newly proposed classifier instead of being used as an individual classifier, such as in [13], who created a new model by combining the advantages of a clustering and ensemble algorithms. In practice, a model that solely relies on the ensemble or clustering technique should not be the best choice for NIDS, because deploying such a model would have a higher possibility of causing unexpected and serious damage to an organization due to its highly erratic generalization abilities on future packets. (3) Although deep-learning classifiers outperform the aforementioned two types of classifiers in terms of detection rate and stability, deploying a deep-learning model in practice may largely reduce network throughput because it usually suffers from the issue of high latency [14]. The efficiency problem might be resolved by quantum computers in the future [15], but deep-learning should not be considered the best choice for NIDS in terms of efficiency based on the current circumstances. (4) There are many enhanced models [16; 17; 18; 19; 20; 21; 22; 23] classified as hybrid-type, which perform better by either combining the existing approaches in other domains (e.g., fuzzy logic) or creating novel mechanisms (e.g., feedback variables) specifically for NIDS (i.e., our AA-HMM), based on a specific shallow algorithm (e.g., decision tree) [14]. The temporary disadvantage of hybrid classifiers is that they need to be tested on various data sets to verify their stability. However, this long-term evaluation process is necessary for all newly proposed algorithms. In conclusion, it is necessary to design a new accurate and efficient hybrid-type algorithm for anomaly-based NIDS in practice. The remainder of this paper is structured as follows.