This document describes a study that used Hidden Markov Models (HMM) for intrusion detection. The researchers built HMM models to profile clean network traffic and detect deviations that could indicate attacks. They tested single and layered HMM models, separating traffic by source/destination IP pairs and port numbers. The layered approach with multiple models had higher accuracy and lower false positive rates than a single model. Experiments detected signature-based fraggle and smurf attacks. The HMM approach performed well and showed potential for anomaly-based intrusion detection.