# An Approach for Anomaly Detection in Network Communications Using _k-Path_ Analysis
## 4 Three-State Markovian Approach
### Modeling, Estimation, and Hypothesis Testing
Upon differentiation, we obtain: \[\frac{\partial\ell(p_{e},\xi_{e},\eta|\lambda_{1}(e),\lambda_{2}(e),\cdots, \lambda_{m}(e))}{\partial p_{e}}=-\sum_{q=1}^{m}\frac{\mathbb{I}(\lambda_{q} (e)=0)}{1-p_{e}}+\sum_{q=1}^{m}\frac{\mathbb{I}(\lambda_{q}(e)>0)}{p_{e}}.\] Setting \[-\sum_{q=1}^{m}\frac{\mathbb{I}(\lambda_{q}(e)=0)}{1-p_{e}}+\sum_{q=1}^{m} \frac{\mathbb{I}(\lambda_{q}(e)>0)}{p_{e}}=0,\] we obtain: \[\frac{\sum_{q=1}^{m}\mathbb{I}(\lambda_{q}(e)=0)+\sum_{q=1}^{m}\mathbb{I}( \lambda_{q}(e)>0)}{\sum_{q=1}^{m}\mathbb{I}(\lambda_{q}(e)>0)}=\frac{1}{p_{e}},\] \[\frac{m}{\sum_{q=1}^{m}\mathbb{I}(\lambda_{q}(e)>0)}=\frac{1}{p_{e}}.\] Hence \[\hat{p}_{e}=\frac{\sum_{q=1}^{m}\mathbb{I}(\lambda_{q}(e)>0)}{m}.\]
* **Estimation of \(\xi_{e}\)**: To estimate \(\xi_{e}\), we will directly use numerical optimization of \[\ell(p_{e},\xi_{e},\eta|\lambda_{1}(e),\lambda_{2}(e),\cdots,\lambda_{m}(e)).\]
* **Estimation of \(\eta\)**: For this, we recommend using the derivative of \[\ell(p_{l},\xi_{l},\eta|\lambda_{1}(e),\lambda_{2}(e),\cdots,\lambda_{m}(e))\] with respect to \(\eta\) and setting it to zero, we obtain: \[\sum_{q=1}^{m}\mathbb{I}(\lambda_{q}(e)>0)\bigg{(}\frac{\lambda_{q}(e)}{\eta^ {2}}-\frac{\xi_{e}}{\eta}\bigg{)}=0\quad\text{with }\eta>0\] \[\frac{\sum_{q=1}^{m}\mathbb{I}(\lambda_{q}(e)>0)\lambda_{q}(e)}{\eta}=\sum_{q=1 }^{m}\mathbb{I}(\lambda_{q}(e)>0)\xi_{e}\quad\text{with }\eta>0\]\[\frac{\sum_{e\in\gamma}\sum_{q=1}^{m}\mathbb{I}(\lambda_{q}(e)>0) \lambda_{q}(e)}{\eta}=\sum_{e\in\gamma}\sum_{q=1}^{m}\mathbb{I}(\lambda_{q}(e)>0 )\xi_{e}\quad\text{with }\eta>0\] \[-\sum_{q=1}^{m}\frac{\mathbb{I}(\lambda_{q}(e)=0)}{1-p_{e}}+\sum_{q=1}^{m} \frac{\mathbb{I}(\lambda_{q}(e)>0)}{p_{e}}=0,\]0 \[-\sum_{q=1}^{m}\frac{\mathbb{I}(\lambda_{q}(e)=0)}{1-p_{e}}+\sum_{q=1}^{m} \frac{\mathbb{I}(\lambda_{q}(e)>0)}{p_{e}}=0,\]1  
We denote the maximum likelihood parameters on \(e\) of a path by \((\hat{p}_{e},\hat{\xi}_{e},\hat{\eta})\). Let \(I_{r}\) be defined by \(I_{r}=\{[t_{1}+i,t_{1}+i+1[,i=0,\cdots,30\}\) where \(t_{1}\) is the initial date. The \(p\)-value is computed by:  
\[-\sum_{q=1}^{m}\frac{\mathbb{I}(\lambda_{q}(e)=0)}{1-p_{e}}+\sum_{q=1}^{m} \frac{\mathbb{I}(\lambda_{q}(e)>0)}{p_{e}}=0,\]2 \[-\sum_{q=1}^{m}\frac{\mathbb{I}(\lambda_{q}(e)=0)}{1-p_{e}}+\sum_{q=1}^{m} \frac{\mathbb{I}(\lambda_{q}(e)>0)}{p_{e}}=0,\]3 \[-\sum_{q=1}^{m}\frac{\mathbb{I}(\lambda_{q}(e)=0)}{1-p_{e}}+\sum_{q=1}^{m} \frac{\mathbb{I}(\lambda_{q}(e)>0)}{p_{e}}=0,\]4 \[-\sum_{q=1}^{m}\frac{\mathbb{I}(\lambda_{q}(e)=0)}{1-p_{e}}+\sum_{q=1}^{m} \frac{\mathbb{I}(\lambda_{q}(e)>0)}{p_{e}}=0,\]5 \[-\sum_{q=1}^{m}\frac{\mathbb{I}(\lambda_{q}(e)=0)}{1-p_{e}}+\sum_{q=1}^{m} \frac{\mathbb{I}(\lambda_{q}(e)>0)}{p_{e}}=0,\]6  
where \(F_{\Gamma}\) is the cumulative distribution function of the Gamma distribution. The threshold for \(p\)-values is a pre-selected threshold, denoted as \(r_{0}\), representing the significance level of the statistical test. It indicates the maximum probability of incorrectly rejecting the null hypothesis when it is actually true. In other words, the \(p\)-value threshold is used to determine if a \(p\)-value obtained from a statistical test is sufficiently low to reject the null hypothesis. The threshold, \(r_{0}\), in these cases, could be defined as follows:  
* If the \(p\)-value \((\gamma,I_{r})>r_{0}\), then the observation on \((\gamma,I_{r})\) is considered normal. * If the \(p\)-value \((\gamma,I_{r})\leq r_{0}\), then the observation on \((\gamma,I_{r})\) is considered abnormal.