# AA-HMM: An Anti-Adversarial Hidden Markov Model for Network-Based Intrusion Detection
## 2 Motivation  
According to the analysis of the disadvantages of the existing ML algorithms with respect to practical deployment (see Section 1), we determined four requirements that are necessary for an applicable NIDS: (1) high detection rate (or low bias) on the trained patterns, (2) online-learning ability for tackling the unseen (including evasion) attacks and patterns, (3) high stability (or low variance) for ensuring the expected performance can be achieved while avoiding the possible severe damage (caused by the erratic performance) in practice, and (4) high efficiency for avoiding the NIDS to be the bottleneck of the network throughput. Consequently, we thought that a qualified base algorithm for a hybrid algorithm should not be a clustering or deep-learning algorithm, as they violate requirements (1) and (4), respectively. Moreover, in order to enable a common algorithm (e.g., decision tree, support vector machine (SVM), etc.) with online learning ability, we should rely on an unsupervised learning procedure to learn knowledge from the features. Typically, there are three options: (1) creating a new unsupervised procedure and combining it with the base algorithm, (2) utilizing an existing unsupervised algorithm (e.g., K-Means) and combining it with the base algorithm, and (3) invoking the unsupervised learning procedure (i.e., Baum-Welch) that comes with the algorithm (i.e., the HMM) in a novel approach. Option (3) is better than options (1) and (2) in terms of performance and reliability because such procedures were specifically designed for the corresponding base classifiers and their performance has been verified by researchers for many years. Overall, the Hidden Markov Model (HMM) is one of the algorithms that perfectly meets all the four aforementioned requirements for NIDS. Both theoretical and empirical results have shown that the HMM is capable of representing probability distributions corresponding to complex real-world phenomena in terms of simple and compact models [24]. The HMM is superior due to the strong online learning ability, which is driven by a reliable unsupervised learning procedure called Baum-Welch (BW) [25]. This has been verified by the success of HMM in various practical applications, where it has become the predominant methodology for designing Automatic Speech Recognition systems (ASR) [26]. Likewise, the HMM has been successfully applied to other fields, such as signature verification, communication and control, bioinformatics, computer vision, and network security. A growing number of HMM-based NIDS have been developed in recent years, which have been applied either to misuse detection to model a predefined set of attacks, or in anomaly detection to model normal behavior patterns, such as in [16]. Most importantly, the HMM-based applications in anomaly and misuse detection have emerged in both the main categories of Intrusion Detection System (IDS): (1) host-based IDS (HIDS) in [17] and (2) network-based IDS (NIDS) in [18; 19; 27]. The HMM has recently begun to emerge in applications of Wireless IDS (WIDS) [20]. Given the most recent investigation in [28], the HMM is the algorithm that requires the least time of adoption for building NIDS. Therefore, adopting the HMM is not only a good choice in terms of the performance, but also a major progress in the ML-based NIDS research due to its unique qualities. The performance of HMM will not be improved unless we invoke the BW in a novel way, so we needed to design a feedback mechanism as a metric (represented as a set of variables on the implementation level) to determine the status of the underlying traffic pattern, so that we could update the model to a local optimal state and enhance its performance through invoking the BW based on the pattern status. Consequently, Sections 3-6 provide demonstrations of concrete solutions and the corresponding deductions of designing such an effective feedback mechanism (a set of variables), which can be divided into six challenges:  
1. What are the feedback variables (Section 3)? 2.