## 4 Graph Theory Representation  
Given the significance of graph theory in several domains and its practical application in modeling and solving problems, several researchers have devoted time and effort to explore and advance the ideas in this subject [36; 37; 38]. A graph theory technique can help in identifying the IoT device's behaviour and attack pattern. Here, we employ the adjacency matrices of a graph, a powerful method for analyzing network structure and a useful approach to representing the topology of networks. Building a star network of IoT devices has the advantage of allowing us to thoroughly validate the characteristics of the predicted behavior. To demonstrate that either external or internal attackers are port scanning, we model the provided sending and receiving packets on a start graph by using Matlab simulation. The star graph consists of N-1 nodes connected to a central node, through which we can visualise the flow of data to and from the attacking or target nodes. There are two distinct situations to consider: the case in which the attacked node is the central one, and the case in which the attacked node is one of the external nodes. We say that a targeted node with the specified destination host IP address and destination port (dstIP, dstPort) is compromised if there are several nodes with the same source IP address but different source ports (srcIP, srcPort) that are exploiting the open ports to carry out the malicious actions; this type of attack is known as an external port scanning attack, as shown in Figure 2. On the other hand, an internal port scanning attack is present when the specified source host IP address and the same port target the specific destination host IP address and any port, as shown in Figure 3.  
To convert the preprocessed data into graph-based representation, each traffic flow is composed of the primary futures srcIP, srcPort, dstIP, and dstPort, where a node in the graph represents two values (srcIP, srcPort), from which one edge leads to the other node, which also represents two values (dstIP, dstPort), as shown in Figures 2 and 3. To illustrate how graph theory applies to network data, we assume that an attacker performs an internal port scan, where it sends a large number of packets from the same srcIP and srcPort to the target node with the same dstIP but various ports. Here, we indicate that each packet going from the malicious node, also known as the source node, to the target node (i.e., sink node) is represented by an edge. As a result, a sink node has an indegree of at most 1 but zero outdegree, while a source node has a number of outgoing edges but zero indegree, meaning that an attacker performs an internal port scan (see Figure 3). On the other hand, external port scanning is distinct from the preceding situation in that the attacking node launches its attacks from the same srcIP but with different ports towards the target node with the same srcIP and srcPort. In this scenario, the source node, where the number of outdegrees does not exceed 1 and the incoming edges are zero, becomes the one that attacks, while the target node receives a number of incoming edges but zero outdegrees (see Figure 2). Once the model is deployed and a star graph depicting the sending and receiving of packets is built, an adjacency matrix is used to represent the star graph as a matrix. An adjacency matrix (\(A_{ij}\)) is a matrix that contains rows and columns used to represent a simple labelled graph with the numbers 0, 1 in the position of (\(v_{i}\),\(v_{j}\)), according to the condition of whether or not the two \(v_{i}\) and \(v_{j}\) are adjacent such that its element \(A_{ij}\) is one when there is an edge from vertex \(v_{i}\) to vertex \(v_{j}\), and zero when there is no edge. As a star graph is considered a network traffic, we employed differently labeled entries to distinguish between normal and abnormal behaviour while representing the adjacency  
Figure 3: An internal port scan. Figure 2: An external port scan. matrix of a certain star graph.