Chapter 6 – Machine Learning in Anomaly Detection Systems
- What is an anomaly?
An anomaly is something that deviates from what is standard, normal, or expected.
- What is a Markov chain?
A Markov chain, or what we call a Markov process, is a stochastic model used for any random system that change its states according to fixed probabilities.
- What are Hidden Markov models?
The Hidden Markov Model is a Markov process where we are unable to directly observe the state of the system. Each state has a fixed probability of emitting. The main goal of an HMM model or classifier is assigning a label to a family of sequences, which means linking a sequence of observations to a sequence of labels.
- How can we detect anomalies with Hidden Markov models?
According to the Hidden Markov Model definition, we can use it to discriminate between normal and abnormal behavior of network traffic.
- What's the difference between time series anomaly detection and other types of anomaly detection?
Time series are values obtained at successive times, often with equal intervals between them. In time series anomaly detection, we are detecting anomalies in sequences of data points being recorded at specific times. In most other detection methods, we are using techniques such as the graph-based technique.
- What's the difference between supervised and unsupervised machine learning anomaly detection?
The difference between the two models is based on the machine learning algorithms used. For example, in supervised machine learning anomaly detection, we can use classification; while in unsupervised machine learning anomaly detection, we can use clustering.
