# Anomaly Detection with HMM Gauge Likelihood Analysis

## TL;DR

This paper introduces HMM gauge likelihood analysis, a novel unsupervised method for anomaly detection in discrete time series using Hidden Markov Models and clustering, demonstrated on synthetic and real syslog data.

## Contribution

The paper presents a new unsupervised anomaly detection technique based on HMM gauge likelihood analysis that compares subsequences through model-based representations.

## Key findings

- Effective in detecting anomalies in synthetic data
- Successfully applied to real-world syslog data
- Does not require labeled training data

## Abstract

This paper describes a new method, HMM gauge likelihood analysis, or GLA, of detecting anomalies in discrete time series using Hidden Markov Models and clustering. At the center of the method lies the comparison of subsequences. To achieve this, they first get assigned to their Hidden Markov Models using the Baum-Welch algorithm. Next, those models are described by an approximating representation of the probability distributions they define. Finally, this representation is then analyzed with the help of some clustering technique or other outlier detection tool and anomalies are detected. Clearly, HMMs could be substituted by some other appropriate model, e.g. some other dynamic Bayesian network. Our learning algorithm is unsupervised, so it does not require the labeling of large amounts of data. The usability of this method is demonstrated by applying it to synthetic and real-world syslog data.