Hierarchical Hidden Markov Models for User/Process Profile Learning

This paper presents an algorithm for automatically constructing sophisticated user/process profiles from traces of their behavior. A profile is encoded by means of a Hierarchical Hidden Markov Model (HHMM), which is a well formalized tool suitable to model complex patterns in long temporal or spatial sequences. A special sub-class of this hierarchical model, oriented to user/process profiling, is also introduced. The algorithm follows a bottom-up strategy, in which elementary facts in the sequences (motifs) are progressively grouped, thus building the abstraction hierarchy of a HHMM, layer after layer. The method is firstly evaluated on artificial data. Then a user identification task, from real traces, is considered. A preliminary experimentation with several different users produced encouraging results.