# An Approach for Anomaly Detection in Network Communications Using _k-Path_ Analysis
## 2 Data Processing and Modeling  
In computer science, an event is an action or occurrence recognized by a software system. This occurrence can come from various sources such as operating systems, networks, servers, firewalls, antivirus software, database queries, hardware infrastructures, etc. Events are typically recorded in special files called event logs [10]. They come from different sources, such as firewalls, routers, and switches, thus providing an external perspective on activities that may be internal to the network or occur between an internal server and an external server. To collect event streams, organizations usually use automated collection methods such as NetFlow [11]. NetFlow, the most widely used standard for flow data statistics enables the monitoring and recording of all traffic entering or exiting an interface (A physical or logical connection point on a network device such as a router, switch, or a computer's network card), as illustrated in Figure 2.  
Figure 2 shows the NetFlow data collection process on a network. Computers and printers send data through routers. The router, enabled with NetFlow, analyzes and  
Figure 1: Representation of an intrusion. aggregates this traffic into distinct flows. These flows are then grouped into flow export datagrams and exported using the User Datagram Protocol (UDP). These datagrams are received and processed by a flow collector. The format of each NetFlow record contains at least the following information:  
* The date the flow was recorded. * The duration for which the flow was active was often measured in seconds. * The source and destination IP addresses (data can be replaced by the source name). * The type of IP protocol (e.g., TCP = 6; UDP = 17; ICMP = 1). * The source and destination TCP/UDP port numbers. * The number of packets in the flow. * The number of bytes in the flow's packets. However, to effectively utilize this data for detecting suspicious behaviors, careful preparation is essential. Firstly, it is crucial to select relevant features for analysis. Among these, commonly included are the number of exchanged packets, the total volume of transferred bytes, the source and destination ports used, the duration of the flow record, the date and time of the event, and the involved communication protocol. Furthermore, we recorded flow events per minute and packets exchanged per minute between 9:00 and 9:30 on a pair of connected addresses in the LNLA network [12]. Figure 2(a),b illustrates the number of events and the number of packets recorded per minute. Examining Figure 2(a) we observe a dynamic showing the number of events per minute against the date we notice a pronounced variability with several event peaks exceeding 100 events per minute. In contrast to Figure 2(a), Figure 2(b) illustrates a notable packet peak occurring at 9:18 a.m., indicating a sudden increase in traffic at that precise moment. These two behaviors exhibit irregular and potentially intense network activity at certain times, suggesting transitions between periods of no activity, moderate activity, and activity spikes. Figure 3: (**a**) Event count per minute between 9:00 and 9:30; (**b**) Packet count per minute between 9:00 and 9:30. Figure 2: Flow event collection process. However, to effectively use this data to detect suspicious behavior, careful preparation is essential. First and foremost, it is crucial to select relevant features for analysis. Among these, commonly included are the number of exchanged packets, the total volume of transferred bytes, the source and destination ports used, the duration of the flow record, the date and time of the event, and the involved communication protocol. These features provide a basis for detecting suspicious activities in network traffic. Additionally, it is important to model the mapping of the studied network from these event logs in order to identify active paths (each pair of computers, which compose this path, communicates through network flows) and analyze them. This simplifies the detection work.