# AA-HMM: An Anti-Adversarial Hidden Markov Model for Network-Based Intrusion Detection
## 4 Methodology
### Adaptive Mechanism: MD and DT  
It is important to comprehend the cause of rendering the low detection rate before designing any enhancement mechanism. As the upper part of Figure 4 shows, if the accuracy decreases, it indicates that the model's parameters are not well tuned to fit the pattern being predicated. Since the Baum-Welch (BW) procedure is responsible for updating the model, the decreased accuracy demonstrates that BW is not capable of updating the transition and emission matrices appropriately, which indicates that the underlying pattern is intensively fluctuating. An intensive fluctuating pattern usually means a stronger randomness of all the samples, which causes two negative factors for a window-based model (predict samples section-by-section, refer to Section 3.3.): (1) high PV where the type and distribution of samples between windows are changing frequently and (2) high PE where windows include more types of samples as the types of samples are changing frequently. As such, the two negative factors, high PE and PV (refer to Section 1 Introduction and Section 2 Motivation) are presented here as possible consequences of intensive pattern fluctuation.  
As stated, both negative factors are a result of the same phenomenon--an intensive pattern fluctuation that would require the BW to significantly update the model's parameters. Since BW is  
Figure 4: The logic chain of AA-HMM. * Shapes with black background are components of AA-HMM, Solid lines represent the interactions between components and dashed lines are relationship between concepts.  
limited in its ability to update the model to a local optimal state against intensive fluctuated pattern, the model's accuracy is reduced and can be detected using the feedback variable MD, which is defined as the quantitative model difference between adjacent windows:  
\[\text{MD}(\text{ M}_{\text{n}},\text{ M}_{\text{n+1}})\ =\text{ Diff}[\text{ M}_{\text{n}}(\text{W}_{\text{n}}),\text{ M}_{\text{n+1}}(\text{W}_{\text{n+1}})\ ] \tag{3}\]  
where \(\text{W}_{\text{x}}\) is the identity of a window and \(\text{ M}_{\text{y}}\) represents a specific model y, then \(\text{M}_{\text{y}}(\text{W}_{\text{x}})\) is model y's parameters (transition and emission matrices) after updating upon the pattern in window x. Therefore, the entire term \(\text{Diff}[\text{ M}_{\text{n}}(\text{W}_{\text{n}}),\text{ M}_{\text{n+1}}(\text{W}_{\text{n+1}})]\) is the difference between the two models in terms of parameters/configuration, which can be formally defined as, \"a vector of differences calculated from consecutive transition and emission matrices in each iteration of the Baum-Welch procedure, which is calculated by summing the \(\text{L}_{2}-\text{Norm}\) distances between consecutive transition and emission matrices\" [29]. If the MD is larger than a certain pre-defined value E, it indicates that the predicted pattern is intensively fluctuating and the updated model would not be in a good state, which produces low accuracy. Therefore, in order to improve the accuracy, we needed to reduce the PE of the next window through reducing the WW, so that the BW could update the model in a more accurate state (Figure 4). If the MD is smaller than E, the accuracy is being maintained at a high level, indicating that the PE must be at a very low level. So, slightly enlarging the WW would not only keep the WW within the range of LOWWs (Figure 1),  
The variables MD and DT are indicators and reveal the underlying pattern information (Figure 4), which is used with the four operations to adjust the DW and WW based on the patterns, resulting in the ability of the model to correlate with the pattern of the samples. The pattern information is successfully extracted, stored, and utilized by the MD and DT. An overview of the architecture (assuming that there are six windows in total) of the adaptability of the approach is depicted in Figure 5.