Hidden Markov Model (HMM)

HMMs model spectrum behavior as two coupled stochastic processes: a hidden state sequence representing the true RF environment (e.g., 'normal traffic', 'interference', 'jamming') and an observable emission sequence of measured signal features. The hidden process follows a Markov property, where each state depends only on the immediately preceding state, while emissions are governed by state-dependent probability distributions. This architecture naturally captures the temporal dependencies inherent in spectrum usage patterns.

HMMs are defined by three canonical problems solved in RF analysis:

• Evaluation: Computing the probability of an observed signal sequence given a trained model, directly yielding an anomaly score when probability falls below a threshold
• Decoding: Determining the most likely sequence of hidden spectrum states (e.g., 'idle', 'transmitting', 'jammed') that produced the observations using the Viterbi algorithm
• Learning: Estimating model parameters (transition and emission probabilities) from training data using the Baum-Welch algorithm, a specialized Expectation-Maximization technique

The core anomaly detection mechanism exploits the state transition matrix. After learning normal spectrum behavior patterns, the model assigns a probability to each observed sequence. An anomaly is flagged when:

• A state transition occurs with unexpectedly low probability (e.g., a sudden jump from 'idle' to 'high-power jamming' without intermediate states)
• The overall sequence likelihood falls below a calibrated threshold
• The forward algorithm computes this likelihood recursively, enabling real-time streaming detection without waiting for complete sequences

HMMs accommodate diverse RF feature representations through flexible emission models:

• Discrete HMMs: Use quantized signal features (e.g., RSSI bins, modulation type indices) with multinomial emission distributions
• Continuous HMMs: Model raw features like I/Q samples or spectral power using Gaussian Mixture Models (GMMs) as emission densities, capturing complex, multi-modal signal characteristics
• Autoregressive HMMs: Incorporate temporal dependencies within emissions, useful for modeling signals with memory like fading channels

The Baum-Welch algorithm iteratively optimizes HMM parameters from unlabeled spectrum data, making it suitable for unsupervised anomaly detection. The process:

• Alternates between Expectation step (computing state occupancy probabilities using forward-backward algorithm) and Maximization step (updating transition and emission parameters)
• Guarantees convergence to a local maximum of the likelihood function
• Enables training on normal operational data without requiring labeled anomaly examples, critical for detecting novel, previously unseen threats

Modern RF analysis systems combine HMMs with neural networks for enhanced performance:

• Neural HMM hybrids: Use deep networks to parameterize emission distributions, learning complex, non-linear relationships in high-dimensional signal data
• HMM-DNN cascades: Deep neural networks extract discriminative features from raw I/Q samples, which then feed into HMMs for temporal modeling and anomaly scoring
• Attention-augmented HMMs: Incorporate attention mechanisms to capture long-range dependencies beyond the Markov assumption, improving detection of slowly evolving spectrum anomalies

A stochastic model describing a sequence of possible events where the probability of each event depends only on the state attained in the previous event. This memoryless property is the foundational assumption upon which HMMs are built.

• States: Directly observable (unlike HMMs)
• Transition Matrix: Defines probabilities of moving between states
• Example: Modeling spectrum occupancy as a simple two-state chain (Idle/Busy) where tomorrow's state depends only on today's

A specialized Expectation-Maximization (EM) algorithm used to find the unknown parameters of an HMM. It iteratively re-estimates the transition probabilities, emission probabilities, and initial state distribution to maximize the likelihood of the observed sequence.

• E-Step: Calculates the probability of hidden state sequences given current parameters
• M-Step: Updates parameters to maximize expected log-likelihood
• Application: Training an HMM on normal spectrum behavior without labeled anomaly data

A dynamic programming algorithm used to find the most likely sequence of hidden states—called the Viterbi path—that explains a given sequence of observed emissions. It efficiently solves the decoding problem in HMMs.

• Trellis Diagram: Represents all possible state paths through time
• Backtracking: Reconstructs the optimal path after forward pass
• Anomaly Use: Identifying when the most probable hidden state sequence for a new signal has an abnormally low probability, indicating a deviation from normal patterns

An inference algorithm that computes the posterior probabilities of hidden states at each time step given the entire observation sequence. It combines a forward pass (causal filtering) and a backward pass (smoothing).

• Forward Probability (α): Probability of observing sequence up to time t and being in a specific state
• Backward Probability (β): Probability of observing future sequence given current state
• Anomaly Scoring: Low combined probability indicates the observation is poorly explained by the trained normal-behavior model

The probability distribution that governs the generation of observable outputs from each hidden state. In spectrum analysis, this often models the statistical characteristics of received signal features.

• Gaussian Mixture Models (GMMs): Commonly used to represent complex, multi-modal signal feature distributions per state
• Discrete Symbols: Used when signal features are quantized into a finite codebook
• Anomaly Context: An observation with extremely low emission probability under all normal hidden states is a strong anomaly indicator

A stochastic matrix A where each element aᵢⱼ represents the probability of transitioning from hidden state i to hidden state j. This matrix encodes the temporal dynamics of the underlying process.

• Rows sum to 1: Each row is a valid probability distribution
• Self-Transitions: High diagonal values indicate state persistence (e.g., a signal staying in 'transmit' mode)
• Anomaly Detection: A transition with near-zero probability in the trained matrix signals an unexpected behavioral sequence, such as a jammer abruptly switching patterns