Analyzing Network Protocols of Application Layer Using Hidden Semi-Markov Model

Figure 6

The HsMM-based models for message format. (a) and (b) indicate the transition probability of states. (c) shows the probabilities of observations for each state; each line is corresponding to a state. (d) illustrates the state duration distribution; each line is corresponding to a state.

(a) Transition matrix (3D view)

(b) Transition matrix (2D view)

(c) Observation probability distribution

(d) State duration distribution