# An Approach for Anomaly Detection in Network Communications Using _k-Path_ Analysis
## 6 Conclusions  
In this article, we propose an innovative approach for anomaly detection in computer networks, focusing on the analysis of _k-paths_. By utilizing the observed Markov model and generalized likelihood ratio test (GLRT), we have developed a robust methodology to characterize normal behavior and detect suspicious activities. Our results have demonstrated the effectiveness of our approach in identifying anomalies in network data flows, particularly when associated with significant changes. Through well-established hypothesis testing and rigorous parameter estimation of the model, we have provided accurate tools for early detection of malicious behaviors along these paths.  
Ultimately, our approach makes a significant contribution to computer network security by providing advanced tools for detecting malicious activities. One research direction involves applying the model using the hidden Markov model [4], while considering the three states of the model and packet flows. Indeed, the model associated with the observed Markov model does not account for the distribution of packet counts exchanged. Additionally, it is crucial to consider work hours, downtime, and tool update times within a company to model a system capable of accounting for a more complex dimension. Another research direction concerns anomaly detection on each host, particularly supporting vulnerable path assets; queries (generating network flows) are indeed sent and received by hosts. Therefore, analyzing the behavior of individual hosts can provide valuable insights for attack detection. New processes and services, as well as file accesses, are potential data sources for identifying suspicious activities. However, collecting these data requires significant software engineering effort.  
Figure 12: Scenario No. 2: Three-state model using the number of packets exchanged per minute.  
**Author Contributions:** Conceptualization: M.K., R.C., A.B. and C.B.; Methodology: M.K., R.C., A.B. and C.B.; Software: M.K. and R.C.; Validation: R.C., A.B. and C.B.; Formal Analysis: M.K.; Investigation: M.K.; Data Curation: M.K.; Writing--Original Draft Preparation: M.K.; Writing--Review and Editing: M.K.; Supervision: R.C., A.B. and C.B.; Funding Acquisition: C.D. All authors have read and agreed to the published version of the manuscript.  
**Funding:** This research was funded by the LITIS laboratory, the LMAH laboratory, and Risk'n Tic, under a CIFRE agreement with the French National Association for Research and Technology (ANRT). We thank these entities for their financial support to cover the publication fees of this article.  
**Data Availability Statement:** The data supporting the results reported in this study are publicly available at the following address: [[https://github.com/[PERSON]/Donn-es-flux-g-n-r-es/blob/main/Data_set_zip.zip](https://github.com/[PERSON]/Donn-es-flux-g-n-r-es/blob/main/Data_set_zip.zip)]([https://github.com/[PERSON]/Donn-es-flux-g-n-r-es/blob/main/Data_set_zip.zip](https://github.com/[PERSON]/Donn-es-flux-g-n-r-es/blob/main/Data_set_zip.zip)), accessed on 3 July 2024.  
**Conflicts of Interest:** The authors declare no conflicts of interest. The funding sponsors had no role in the design of the study; in the collection, analyses, or interpretation of data; in the writing of the manuscript, and in the decision to publish the results.