K.R. Efficient algorithms for similarity measures over sequential data A look beyond kernel.pdfVIP

Efficient Algorithms for Similarity Measures over Sequential Data: A Look Beyond Kernels Konrad Rieck1, Pavel Laskov1, and Klaus-Robert Mu?ller1,2 1 Fraunhofer FIRST.IDA, Kekule?stra?e 7, 12489 Berlin, Germany 2 University of Potsdam, Am Neuen Palais 10, 14469 Potsdam, Germany {rieck, laskov, klaus}@first.fhg.de Abstract. Kernel functions as similarity measures for sequential data have been extensively studied in previous research. This contribution addresses the efficient computation of distance functions and similarity coefficients for sequential data. Two proposed algorithms utilize different data structures for efficient computation and yield a runtime linear in the sequence length. Experiments on network data for intrusion detec- tion suggest the importance of distances and even non-metric similarity measures for sequential data. 1 Introduction Sequences are a common non-vectorial data representation used in various ma- chine learning and pattern recognition applications, e.g. textual documents in information retrieval, DNA sequences in bioinformatics or packet payloads in in- trusion detection. An essential procedure for analysis of such data is the efficient computation of pairwise similarity between sequences. Beside specialized string distances [e.g. 1, 2] a large class of similarity measures for sequential data can be defined over contained subsequences by embedding them in a high-dimensional feature space. Previous research focused on compu- tation of kernel functions in such feature spaces. For example, the inner-product over n-gram or word frequencies has been widely used for analysis of textual documents [e.g. 3, 4, 5] or host-based intrusion detection [e.g. 6]. The challenge of uncovering information in DNA has influenced further advancement of kernel functions, e.g. by exploring different sets of subsequences [e.g. 7, 8, 9, 10] or incorporating mismatches, gaps and wildcards [e.g. 11, 12, 13]. There exist, however, a large amount of learning algorith