# An Approach for Anomaly Detection in Network Communications Using _k-Path_ Analysis
## 1 Introduction
Let us consider an example where an attacker launches a phishing attack targeting employees of a company:  
* Step 1:
* An employee opens a malicious email containing a link to a compromised site. * The compromised site exploits a vulnerability in the employee's browser to install malware on their workstation. * The malware begins scanning the local network for other vulnerable systems. It identifies an internal server used for storing sensitive data. * Step 2:
* Once on the internal server, the malware begins collecting information about the system, such as credentials stored in plain text in configuration files. * The intruder uses the retrieved credentials to log in to the server and explore the stored data. They discover a database server containing customer information. * Step 3:
* Using the access privileges obtained on the internal server, the intruder accesses the database server and extracts sensitive customer data, including credentials and financial information. * The intruder uses this information to conduct fraudulent transactions and access sensitive user accounts. Each of these steps represents a critical phase of the attack, and detecting these behaviors at an early stage can be crucial in preventing damage and limiting the impact of the intrusion. Typically, an intrusion is rarely direct. It often employs the tactic of \"lateral movement\" [9] to traverse multiple servers within the computer network and form a path leading to its target. Despite significant advancements in cybersecurity, the persistent demand for solutions to identify these paths, which are often vulnerable, indicates that challenges remain. Researchers are, therefore, working on developing methods capable of detecting and characterizing unusual behaviors within these paths, aiming to enhance network security against intrusions. In this article, we address the problem of anomaly detection within these paths through the analysis of network flow data. We begin our discussion by presenting flow data, its processing, and modeling. Then, we review previous work on anomaly detection, such as the work by [PERSON] and his colleagues [4]. Their work forms the basis of our contribution, which involves considering the number of packets exchanged between two connected servers and applying a three-state observed Markov model to account for the three types of behavior in exchanges between two connected servers: no exchange, exchanges corresponding to a flux peak, or exchanges are moderate. We propose replacing the _Active_ state of the _Path Scan_ model [4], which represents an exchange of flow between two servers, with two new states. We introduce the _Peak_ state, indicating a massive increase in flows, indicating periods where the system is at maximum load, and the _Moderate_ state, which characterizes less intense but still significant flow levels. This modification provides a more nuanced representation of the system conditions, facilitating better adaptation. By integrating these new states into the _Path Scan_ model, our contribution aims to improve its ability to detect anomalies in the system. The rest of the document is organized as follows: Section 2 discusses the processing and modeling of flow data. Then, Section 3 presents related work. Section 4 describes the methodology used in our research. Section 5 presents the results obtained using the generated datasets. Finally, Section 6 concludes the paper.