[sswaner]

That is a great intro. Thanks for putting it together. If you were to continue this to a Part #2, I would be interested in seeing the approach for determining if something was "abnormal". Is it considered abnormal to add a node to the chain, or to add a transition? Is detecting abnormal behavior more complicated than detecting new nodes or transitions?

[tantalum]

Abnormal really means that it has a probability less than some threshold. So you might have a transition that has a probability of less then 0.1, depending on your situation, you might consider that abnormal even thought that transition does exist. Also a non existent transition would be considered "abnormal" because the probability is 0 in your model.

I've been thinking about doing a part 2 with text analysis and a cool use case would be to detect "abnormal" text from an author because he/she uses strings of words that have a low probability in the rest of their text.

Hope this helps and I'm glad you like the post.

[sswaner]

Thanks for the response. Yours is the clearest intro to Markov Chains that I have found.