I would like to detect user anomalies or mal-behavior on a web site. For each user I monitor the web browser used, IP (and thus ISP & geo-location) of the user as well as users' activities on the site (there are ~10 types of activities). I thought to construct a hidden Markov model for this type, but all the examples I see on the net use only a single predictor, while here we have at least three families: (1) web browser information; (2) information derived from user IP and (3) user activity on the site. How are these predictors combined into a single Markov model?
Also, should the training set data be pre-labeled as normal/abusive?
PS: Why do I insist using Markov models instead of other classification methods? The truth is that I have a pretty successful neural network classifier working. I'm exploring Markov (or HMM) models mainly as an exercise, but also as a potential way to deal with the labeling problem: confirming non-normal behavior is hard, not all user activities that I believe are "unusual" are indeed so, and moreover, there might be abusive activities that may be unaware of.