# An Approach for Anomaly Detection in Network Communications Using _k-Path_ Analysis
## 1 Introduction  
In the context of information systems, a widely accepted definition by [PERSON] ([PERSON], 1980) describes an anomaly as an observation that deviates so significantly from other observations that it raises suspicions that it was generated by a different mechanism [1]. Anomalies are of paramount importance in computer networks because they can signal unusual but significant activities. For instance, a sudden increase in network traffic to an unknown destination might indicate an attempt at hacking or a security breach, necessitating immediate response to protect data and systems from potential threats [2]. Therefore, anomaly detection is a crucial issue in many fields, especially cybersecurity. It involves detecting unexpected or rare events in data streams, commonly referred to as abnormal events. Anomaly detection in networks encompasses various methods and approaches, each with its own strengths and applications. It aims to identify unusual behaviors that might indicate intrusions or other cyberattacks. An overview of anomaly detection in networks using network flows is provided in [3]. A promising method in this domain is the _k-path_ approach [4], which leverages network flow events to identify paths exhibiting anomalies using a time series of flow events between pairs of computers. In 2007, Estonia was the target of a series of large-scale cyberattacks that specifically targeted several of its major banks [5]. These attacks were significant enough to force thecountry's leading bank to shut down its online services for several hours, disrupting financial transactions and causing widespread concern among the populace. Moving forward to May 2017, the world witnessed the emergence of WannaCry, a ransomware attack that quickly became one of the most notorious cyberattacks in history. WannaCry spread rapidly across the globe, infecting over 200,000 computers in more than 150 countries within a matter of days. The attack crippled critical systems in various sectors, including healthcare, finance, and government, causing billions of dollars in damages [6]. These incidents brutally remind us of the growing threat posed by cyberattacks to our interconnected digital systems. However, most attackers operate using brute-force attacks, resulting in abnormal spikes in network traffic. Other attackers prefer a more subtle approach by sending low-rate streams, thus blending in with normal flows generated by trusted sources on the network [7]. These low-rate tactics highlight the different strategies used by cybercriminals to infiltrate and disrupt digital systems, with intrusion being the predominant objective for most attackers. By definition, when an individual undertakes an action for which they are not legally authorized, it is termed intrusion. This intrusion can originate from external sources, through attacks such as unauthorized access attempts or exploitation of security vulnerabilities, or it can result from an intruder exceeding their authorized limits [8]. The actions taken by an intruder, whether from an external or internal source, may follow a well-defined pattern, often represented by the intrusion path. This path can be illustrated by several stages, as shown in Figure 1:  
* Initial infection and local research: The intruder often starts by infecting a system or network via various vectors, such as malware or social engineering techniques. Once infiltrated, the intruder conducts local research to identify other potential resources to compromise. * First Traversal and Further Exploration: After the initial infection, the first traversal of the network occurs. The intruder explores accessible systems to gather information and identify their potential target. * Complete Traversal and Malicious Actions: Once the intruder has identified their target and obtained the necessary privileges, they can undertake malicious actions.