# An Approach for Anomaly Detection in Network Communications Using _k-Path_ Analysis
## 3 Related Works  
Anomaly detection using continuous data has become a crucial area of research due to the proliferation of data in recent decades and the need to detect events indicating that a process has changed significantly from its previous behavior. This is particularly true in the fields of audiology [14], imaging [15,16], engineering [17], and computer science [18]...  
In the field of cybersecurity, various anomaly detection systems have been proposed in the literature, notably in the work of [PERSON] el al., 2013 [4]; [PERSON] et al., 2014 [19]; [PERSON], 2014 [20]; [PERSON] et al., 2016 [21]; [PERSON] et al. 2020 [22] and [PERSON], 2021 [23]. Some of these studies have focused on developing models using data flows to detect anomalies in network communications. For example, in the 2018 study by [PERSON] et al. [24], the authors introduced a model called Deep Autoencoding Gaussian Mixture Model (DAGMM) for unsupervised anomaly detection. This model combines a deep autoencoder with a Gaussian Mixture Model (GMM) to detect anomalies in data streams. The anomaly detection process involves using the deep autoencoder to generate a low-dimensional representation and reconstruction error for each input data point. This information is then fed into the Gaussian mixture model to estimate the probability of each data point being generated by the model. In the 2020 study by [PERSON] et al. the Gamma-Normal Mixture Model (GNM) is presented as a crucial component for statistical anomaly detection in network traffic. The authors propose a fast statistical anomaly detector at the aggregate level for two types of anomalies: DDoS and Flood. They then study the compatibility between this model and network traffic using various tests.  
Although these anomaly detection methods are capable of identifying irregularities, they are based on specific assumptions about the distribution of packets exchanged or events. The difficulty lies in the lack of precise knowledge of these distributions, which leads us to consider the observed Markov model. This model evaluates the probability of transition from one state to another as a function of network flow events, as shown in the 2013 study by [PERSON] and colleagues. While this model is effective at detecting anomalies on specific paths through network flow data, it has limitations. In particular, it can struggle to spot anomalies when there is a rapid succession of exchanges. In other words, an unusual sequence of events over a very short period may escape the detection system associated with the observed Markov two-state model. Furthermore, this model does not take into account the quantity of packets exchanged and the spikes in flux that occur in these exchanges but rather focuses on the number of exchanges. These limitations can be problematic in scenarios where the quantity of exchanged packets is crucial for anomaly detection, such as in a brute force attack or a DoS attack, where the volume of exchanged packets can be a key indicator.  
In this paper, time series of communications are analyzed using the three-state Markov model and the generalized likelihood ratio test (GLRT) to detect anomalies, in particular, those resulting from brute force behavior that is often human-induced.