**4.1 Framework of the HHMM**

Learning, decoding, and evaluating are the three principal HHMM objectives as described in [18]. Briefly, the techniques applied to achieve these objectives are as follows:

• **Learning:** Baum-Welch algorithm is used to create the object of the learning machine.

*An Effective Method for Secure Data Delivery in IoT DOI: http://dx.doi.org/10.5772/intechopen.104663*


This probabilistic hierarchical hidden Markov model should overcome the problem of the heterogeneity of IoT data. However, it suffers from high computational costs as the data increases in an exponential manner due to its used algorithms. Applying this scheme to IoT data undeviatingly will contribute to a problem of high state space. We, therefore, need to find a way to reduce the high state space without compromising the classification quality.

### **4.2 Framework of PHHMM**

Our proposed model uses clustering and dimension reduction techniques to partition the massive incoming network traffic to overcome the problem of largely hidden states, before applying HHMM for classification. It follows the framework described in **Figure 1** and achieves the objectives [18] and techniques are applied as follows:

**Figure 1.** *The PHHMM detection model.*


In our PHHMM model, applying dimension reduction techniques is a challenging step due to the lack of a standard approach for reducing the dimensionality of the observed IoT network traffic. It requires identifying the principal components and linear combinations of variables that describe the highest contrast in the massive data without compromising this data. Determining the principal components given a covariance matrix is computationally expensive as it claims the eigenvalue decomposition that requires the calculation of the covariance matrix. To overcome this challenge, we present an approach that avoids the direct computation of the covariance matrices but delivers the efficient subspace dimension. Our model applies the singular value decomposition (SVD) for calculating PCA to circumvent this expensive operation. The participating nodes in the algorithm use the PCA with the SVD learning mechanism to estimate principal components of the data traffic.

This work contributes to improving and resolving the common flaws in the application of HHMM in massive data by reducing the data dimensions based on traffic from both of the two streams being compared instead of depending only on some training data of normal traffic. Using only the most significant principal components, we could avoid the computation of the entire subspace. We can estimate a reduced number of principal components that are sufficiently effective in detecting malicious traffic. Our model allows the subsequent use of only the number of dimensions necessary at any given time.
