# An Approach for Anomaly Detection in Network Communications Using _k-Path_ Analysis
## 5 Results
### Comparison of Models  
We evaluated the performance of different models to detect unusual behaviors on the studied path. Specifically, we compared the _Path-scan_ model associated with the Observed Markov Model (OMM) with two states, as presented in [PERSON] et al. 's article [4], against a three-state model using the number of exchanged packets. The latter model considers the occurrences of the inactive state observed in the observations. These models underwent several rounds of simulations. To reduce false positives, we adjusted the hypothesis test by adding 0.2 to the historical parameters. In the first scenario, we generated data reflecting the normal behavior of the studied path. To conduct this, we followed the data generation process used during the threshold determination phases for \(p\)-value. A total of \(100\times 100\) tests, each lasting 30 min, were conducted, all reflecting normal behavior. Subsequently, we randomly divided the tests into 100 series of 100 tests to determine the prediction accuracy percentages with a confidence interval. The results obtained for the different series for each model are presented in Figure 7. Figures 8 and 9, respectively, illustrate the box plots for the predictions of the _Path-scan_ model associated with the observed Markov model and the three-state model using the number of packets exchanged per minute. \begin{table}
\begin{tabular}{|p{113.8 pt}|p{113.8 pt}|p{113.8 pt}|} \hline Models & _Path-scan_ model associated with the observed [PERSON] model & Three-state model using the number of packets exchanged per minute \\ \hline Threshold (\(r_{0}\)) & 0.13846332431809666 & 0.3322934604988478 \\ \hline \end{tabular}
\end{table} 
Table 3: Thresholds (\(r_{0}\)) for the models. The results of the first scenario indicate that both models have comparable sensitivities for detecting normal behaviors. However, the observed two-state Markov model, combined with the _Path-scan_ method, slightly outperforms our three-state model for this specific task. Indeed, our three-state model shows a false positive rate ranging from 1.71% to 2.25%, whereas the observed two-state Markov model exhibits a false positive rate between 0.74% and 1.22%. These results highlight the effectiveness of the two-state model in identifying  
Figure 8: Scenario No. 1: _Path-scan_ model associated with the observed Markov model. Figure 7: Scenario No. 1: In green, the evolution of the number of times a model predicts “normal” behavior across the series of 100 tests is observed. In blue, the expected values for “normal” behaviors are depicted. (**a**) _Path-scan_ model associated with the observed Markov model; (**b**) Three-state model using the number of packets exchanged per minute. Figure 9: Scenario No. 1: Three-state model using the number of packets exchanged per minute. normal behaviors while minimizing false positives. However, a more in-depth analysis is necessary to evaluate the sensitivity of these models under different data flow conditions, particularly in the presence of brute force attacks. Such an evaluation would help determine if the models maintain their effectiveness in more complex and varied scenarios. In the second scenario, \(100\times 100\) tests were conducted, equally divided between tests reflecting the normal behavior of the studied path and tests reflecting abnormal behavior with one to three peaks per test. Following this data generation phase, the tests were randomly distributed into 100 series of 100 tests each, with each series containing exactly 50 normal tests and 50 abnormal tests. This random distribution creates realistic and varied conditions to evaluate the accuracy of prediction models by testing their ability to effectively distinguish between normal and abnormal behaviors in a given environment.