# An Approach for Anomaly Detection in Network Communications Using _k-Path_ Analysis
## 2 Data Processing and Modeling
This graphical modeling involves grouping events associated with each pair of connected network equipment. These aggregated data also allow the construction of actionable time series, describing activity between well-defined time periods for each pair of network equipment. A graph [13], denoted \(G\), is defined as a pair \((V,E)\), where \(V\) is a set of vertices and \(E\) is a set of edges, disjoint from \(V\). This pair is accompanied by an incidence function \(\psi\) that associates with each edge of \(G\) a pair of vertices (which are not necessarily distinct) from \(V\). If \(e\) is an edge and \(u\) and \(v\) are the vertices such that \(\psi(e)=\{u,v\}\), then we say that \(e\) connects \(u\) and \(v\), and these vertices \(u\) and \(v\) are called the endpoints of \(e\). The numbers of vertices and edges of \(G\) are denoted \(v(G)\) and \(e(G)\); these two parameters are called the order and size of \(G\), respectively. In the context of a computer network, each vertex of the graph can represent an IP address. The edges can represent exchanges between these IP addresses. From this graph, we can now identify the set of active paths. These will be paths of multiple adjacent edges. In [PERSON] and colleagues' article, these paths are called _k-paths_ of \(G\). Although Figure 4a represents the network structure for a small to medium-sized enterprise, it shows the absence of communication in the network, although the links (edges) may represent potential communication flow opportunities between IP addresses in the future. Whereas Figure 4b depicts the network using flow data over a 30-min period, using this flow data we are able to illustrate the active side of the network with the aim of identifying only paths with flow activities. For example, the _four-path_ in red and the _three-path_ in green. The vulnerable _k-path_ captures the essence of many network attacks, which traverse a path through the network. In Section 4, we will address the methodology for detecting these attacks using modeling of the number of events or the number of packets per minute on each edge of the active _k-path_, based on the work of [4]. As a reminder, the _Path-scan_ model, associated with the observed Markov model, is a detection technique developed to identify abnormal subgraphs, such as paths (_k-path_). This  
Figure 4: (**a**) represents the graphical depiction of a computer network of a small to medium-sized enterprise, and (**b**) illustrates the graphical representation of the network using active paths during a 30-min period. In (**b**), we have depicted an example of a _four-path_ in red, and an example of a _three-path_ in green. model relies on a probabilistic representation of flow data, where two states are observed: the active state and the inactive state. The active state indicates the presence of positive records on an edge, meaning that there have been events or packets recorded on this edge during the considered time period. In contrast, the inactive state corresponds to the absence of activity on this edge during the studied period. Under the assumption that the attacker's behavior leads to an increase in the transition probability from the inactive state to the active state, a hypothesis test is conducted for each edge.