Continuous-time baum-welch training

摘要

The apparatus, systems, and methods described herein may operate to receive information identifying and describing at least one of a set of events, an initial distribution of a plurality of states, an initial transition matrix, or an initial event matrix; generate, based at least in part on the information, at least one intermediate transition matrix and at least one intermediate event matrix describing a sparse Baum-Welch training that allows no event to occur at one or more time steps; and transform the at least one intermediate transition matrix and the at least one intermediate event matrix into a transition matrix and an event matrix describing a continuous-time Baum-Welch training, the continuous-time Baum-Welch training allowing events to occur simultaneously or at sporadic time intervals in a Markov model including a hidden Markov Model (HMM) having more than two hidden states.

主权项

1. A method comprising:
receiving, at a data training module executable by one or more hardware processors of a training node and from a source node, information identifying and describing at least one of a set of events, an initial distribution of a plurality of states, an initial transition matrix, or an initial event matrix; generating, at the data training module and based at least in part on the information, at least one intermediate transition matrix and at least one intermediate event matrix describing a sparse Baum-Welch training that allows no event to occur at one or more time steps; transforming, using the data training module, the at least one intermediate transition matrix and the at least one intermediate event matrix into a transition matrix and an event matrix describing a continuous-time Baum-Welch training, the continuous-time Baum-Welch training allowing events to occur simultaneously or at sporadic time intervals in a Markov model including a Hidden Markov Model (HMM) having more than two hidden states; providing, using the data training module, the transition matrix and the event matrix to an application node; receiving, at the data training module and from the application node, data indicating that a threat is detected based on the transition matrix and the event matrix; and providing, using the data training module and to a display of the source node, data which causes the display to provide a warning that the threat exists.