Real Time Learning of Non-stationary Processes with Dynamic Bayesian Networks

  • Matthieu HourbracqEmail author
  • Pierre-Henri Wuillemin
  • Christophe Gonzales
  • Philippe Baumard
Conference paper
Part of the Communications in Computer and Information Science book series (CCIS, volume 610)


Dynamic Bayesian Networks (DBNs) provide a principled scheme for modeling and learning conditional dependencies from complex multivariate time-series data and have been used in a wide scope. However, in most cases, the underlying generative Markov model is assumed to be homogeneous, meaning that neither its topology nor its parameters evolve over time. Therefore, learning a DBN to model a non-stationary process under this assumption will amount to poor predictions capabilities. To account for non-stationary processes, we build on a framework to identify, in a streamed manner, transition times between underlying models and a framework to learn them in real time, without assumptions about their evolution. We show the method performances on simulated datasets. The goal of the system is to model and predict incongruities for an Intrusion Dectection System (IDS) in near real-time, so great care is attached to the ability to correctly identify transitions times. Our preliminary results reveal the precision of our algorithm in the choice of transitions and consequently the quality of the discovered networks. We finally suggest future works.


DBN ns-DBN tv-DBN Non-stationnary Learning Real time Change point 



This work was supported by Akheros S.A.S./ANRT CIFRE grant #2014/0268, and the European project SCISSOR H2020-ICT-2014-1 #644425.


  1. 1.
    An, X., Jutla, D., Cercone, N.: Privacy intrusion detection using dynamic Bayesian networks. In: ACM International Conference Proceeding Series, vol. 156, pp. 208–215 (2006)Google Scholar
  2. 2.
    Beran, R.: Minimum hellinger distance estimates for parametric models. Ann. Stat. 5, 445–463 (1977)MathSciNetCrossRefzbMATHGoogle Scholar
  3. 3.
    Casella, G., George, E.I.: Explaining the Gibbs sampler. Am. Stat. 46(3), 167–174 (1992)MathSciNetGoogle Scholar
  4. 4.
    Charitos, T., Van Der Gaag, L.C., Visscher, S., Schurink, K.A., Lucas, P.J.: A dynamic Bayesian network for diagnosing ventilator-associated pneumonia in ICU patients. Expert Syst. Appl. 36(2), 1249–1258 (2009)CrossRefGoogle Scholar
  5. 5.
    Dean, T., Kanazawa, K.: A model for reasoning about persistence and causation. Comput. Intell. 5(2), 142–150 (1989)CrossRefGoogle Scholar
  6. 6.
    Gonzales, C., Dubuisson, S., Manfredotti, C.: A new algorithm for learning non-stationary dynamic Bayesian networks with application to event detection. In: The Twenty-Eighth International Flairs Conference (2015)Google Scholar
  7. 7.
    Grzegorczyk, M., Husmeier, D.: Non-stationary continuous dynamic Bayesian networks. In: Advances in Neural Information Processing Systems, pp. 682–690 (2009)Google Scholar
  8. 8.
    Grzegorczyk, M., Husmeier, D.: Non-homogeneous dynamic Bayesian networks for continuous data. Mach. Learn. 83(3), 355–419 (2011)MathSciNetCrossRefzbMATHGoogle Scholar
  9. 9.
    Grzegorczyk, M., Husmeier, D., Edwards, K.D., Ghazal, P., Millar, A.J.: Modelling non-stationary gene regulatory processes with a non-homogeneous Bayesian network and the allocation sampler. Bioinformatics 24(18), 2071–2078 (2008)CrossRefGoogle Scholar
  10. 10.
    Kruegel, C., Mutz, D., Robertson, W., Valeur, F.: Bayesian event classification for intrusion detection. In: 2003 Proceedings of the 19th Annual Computer Security Applications Conference, pp. 14–23. IEEE (2003)Google Scholar
  11. 11.
    Lerner, U., Parr, R., Koller, D., Biswas, G., et al.: Bayesian fault detection and diagnosis in dynamic systems. In: AAAI/IAAI, pp. 531–537 (2000)Google Scholar
  12. 12.
    Mitra, V., Nam, H., Espy-Wilson, C.Y., Saltzman, E., Goldstein, L.: Gesture-based dynamic Bayesian network for noise robust speech recognition. In: 2011 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 5172–5175. IEEE (2011)Google Scholar
  13. 13.
    Murphy, K.P.: Dynamic Bayesian networks: representation, inference and learning. Ph.D. thesis, University of California, Berkeley (2002)Google Scholar
  14. 14.
    Mutz, D., Valeur, F., Vigna, G., Kruegel, C.: Anomalous system call detection. ACM Trans. Inf. Syst. Secur. (TISSEC) 9(1), 61–93 (2006)CrossRefGoogle Scholar
  15. 15.
    Ourston, D., Matzner, S., Stump, W., Hopkins, B.: Applications of hidden Markov models to detecting multi-stage network attacks. In: 2003 Proceedings of the 36th Annual Hawaii International Conference on System Sciences, 10 p. IEEE (2003)Google Scholar
  16. 16.
    Pearl, J.: Probabilistic Reasoning in Intelligent Systems: Networks of Plausible Inference. Morgan Kaufmann, San Mateo (2014)zbMATHGoogle Scholar
  17. 17.
    Robinson, J.W., Hartemink, A.J.: Non-stationary dynamic Bayesian networks. In: Advances in Neural Information Processing Systems, pp. 1369–1376 (2009)Google Scholar
  18. 18.
    Robinson, J.W., Hartemink, A.J.: Learning non-stationary dynamic Bayesian networks. J. Mach. Learn. Res. 11, 3647–3680 (2010)MathSciNetzbMATHGoogle Scholar
  19. 19.
    Sicard, M., Baudrit, C., Leclerc-Perlat, M., Wuillemin, P.H., Perrot, N.: Expert knowledge integration to model complex food processes. Application on the camembert cheese ripening process. Expert Syst. Appl. 38(9), 11804–11812 (2011)CrossRefGoogle Scholar
  20. 20.
    Song, L., Kolar, M., Xing, E.P.: Time-varying dynamic Bayesian networks. In: Advances in Neural Information Processing Systems, pp. 1732–1740 (2009)Google Scholar
  21. 21.
    Xu, J., Shelton, C.R.: Continuous time Bayesian networks for host level network intrusion detection. In: Daelemans, W., Goethals, B., Morik, K. (eds.) ECML PKDD 2008, Part II. LNCS (LNAI), vol. 5212, pp. 613–627. Springer, Heidelberg (2008)CrossRefGoogle Scholar
  22. 22.
    Xu, J., Shelton, C.R.: Intrusion detection using continuous time Bayesian networks. J. Artif. Intell. Res. 39, 745–774 (2010)MathSciNetzbMATHGoogle Scholar
  23. 23.
    Yeung, D.Y., Ding, Y.: Host-based intrusion detection using dynamic and static behavioral models. Pattern Recogn. 36(1), 229–243 (2003)CrossRefzbMATHGoogle Scholar
  24. 24.
    Zanero, S., Serazzi, G.: Unsupervised learning algorithms for intrusion detection. In: 2008. IEEE Network Operations and Management Symposium, NOMS 2008, pp. 1043–1048. IEEE (2008)Google Scholar

Copyright information

© Springer International Publishing Switzerland 2016

Authors and Affiliations

  • Matthieu Hourbracq
    • 1
    • 2
    Email author
  • Pierre-Henri Wuillemin
    • 1
  • Christophe Gonzales
    • 1
  • Philippe Baumard
    • 2
  1. 1.Sorbonne Universités, UPMC Univ Paris 6, CNRS, UMR 7606 LIP6ParisFrance
  2. 2.AkherosParisFrance

Personalised recommendations