# An Approach for Anomaly Detection in Network Communications Using _k-Path_ Analysis
## 5 Results
### Training the Models  
We generated training and adjustment data for three edges \((A,B)\), \((B,C)\), and \((C,D)\) over a period from January 1 st to January 31 st. The total number of events for each edge is set to 13,780, 14,210, and 14,880, respectively, with specific means and standard deviations for the number of packets: 325 (standard deviation 50) for edge \((A,B)\), 357 (standard deviation 47) for edge \((B,C)\), and 332 (standard deviation 62) for edge \((C,D)\). For each edge, packets were generated following a normal distribution, with randomly added peaks of 451 for edge \((A,B)\), 672 for edge \((B,C)\), and 405 for edge \((C,D)\), simulating extreme variations. Timestamps were randomly assigned to these packets.  
Furthermore, we identified a traffic peak when the number of packets exceeded \(X_{\text{Peak}}\), determined using training data under normal conditions, with  
\[X_{\text{Peak}}=\mu+4\sigma,\]  
where \(\mu\) is the mean of \(X_{t}\) during the training phase and \(\sigma\) is its standard deviation. This approach ensures that the threshold is positioned significantly above the mean, making it less sensitive to minor fluctuations and more robust for detecting significant variations.  
The Tables 1 and 2 summarize the values of the training parameters for each edge according to the model:  
These models have identical transition probabilities from the inactive state to the inactive state, which is reflected as  
\[p_{\text{inactive,inactive}}(\epsilon)=p_{1,1}(e),\ \ \forall\ e\in\gamma.\]  
The transition probability from the active state to the inactive state in the _Path-scan_ model is equivalent to the average of the transition probabilities from the moderate state to the inactive state and the transition probability from the peak flow state to the inactive state. This combination is represented by  
\[p_{\text{active,inactive}}(e)=\frac{p_{3,1}(e)+p_{2,1}(e)}{2},\ \ \forall\ e\in\gamma.\]  
\begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline
**Index** & **Src** & **Dest** & \(P_{\text{inactive,inactive}}\) & \(P_{\text{inactive,active}}\) & \(P_{\text{active,inactive}}\) & \(P_{\text{active,active}}\) & \(p\) & \(\tau\) & \(\eta\) \\ \hline
0 & A & B & 0.681 & 0.318 & 0.679 & 0.320 & 0.479 & 0.330 & 6.045 \\
1 & B & C & 0.670 & 0.329 & 0.672 & 0.327 & 0.533 & 0.367 & 6.045 \\
2 & C & D & 0.654 & 0.345 & 0.657 & 0.342 & 0.520 & 0.330 & 6.045 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Observed two-state Markov model, active and inactive states (_Path-scan_ model).  
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c} \hline \hline
**Index** & **Src.** & **Dest.** & \(X_{\text{P1}}\) & \(p_{\text{11}}\) & \(p_{\text{12}}\) & \(p_{\text{13}}\) & \(p_{\text{21}}\) & \(p_{\text{22}}\) & \(p_{\text{23}}\) & \(p_{\text{31}}\) & \(p_{\text{32}}\) & \(p_{\text{33}}\) \\ \hline
0 & A & B & 505 & 0.680 & 0.681 & 0.310 The transition from the inactive state to the active state (\(p_{\text{inactive to active}}\)) in the adjusted model is equivalent to the transition from the inactive state to the moderate state or the peak flow state. This increased responsiveness is represented by  
\[p_{\text{inactive,active}}(e)=p_{1,3}(e)+p_{1,2}(e),\ \ \forall\ \ e\in\gamma.\]  
The transition from the active state to the active state in the adjusted model is equivalent to the transition from the moderate state or the peak flow state to the moderate state or the peak flow state. This integration of different activity levels is represented by  
\[p_{\text{active,active}}(e)=\frac{p_{2,3}(e)+p_{2,2}(e)+p_{3,3}(e)+p_{3,2}(e)}{ 2},\ \ \forall\ \ e\in\gamma.\]