## 3 Proposed Method
### Statistical Analysis of Network Topology  
Traditionally, ERGM have been used by social scientists to analyze social networks for the presence of certain network substructures, such as connections, mutual connections, triads, and cliques, and how social mechanisms may influence their formation. The incorporation of randomness allows the model to account for the fact that the observed network being inputted, with its valued edges and nodes, is just one possibility among a set of potential networks with the same nodes. This is because there is an underlying stochastic process that affects the frequency of certain manifestations. By attempting to deduce the parameters that influence these stochastic processes, we can then estimate a  
Figure 1: High-level overview of proposed method [11]. probabilistic measure, the log-odds coefficient, that indicates how usual or unusual the observed network is based on certain features. ERGM is a subset of the exponential family of functions [23]. The exponential family of functions is a set of probability distributions defined over some measure \(\eta\) such that the probability distribution density relative to \(\eta\) can be expressed in the following form:  
\[p(x|\eta)=h(x)exp\{\eta^{T}T(x)-A(\eta)\} \tag{1}\]  
The exponential family contains many commonly used probability distributions, such as the normal distribution, and Bernoulli distribution. The defining characteristic that makes exponential family functions so useful is that they can model an arbitrary amount of independent identically distributed data, which are needed in modeling network graph edges whose behaviors are similar but may be independent of each other. An ERGM is defined as follows:  
\[p(Y=y|\theta)=\frac{exp(\theta^{T}s(y))}{c(\theta)},\forall y\in Y \tag{2}\]  
where \(Y\) is a random network with the same number of vertices as \(y\), our input network. \(s(y)\) is a vector of sufficient statistic dependent on the input network \(y\), and \(\theta\) is a vector of model parameters associated with \(s(y)\). A statistic is defined as sufficient when its origin sample gives no additional info about the population source compared to the statistic itself. Lastly, \(c(\theta)\) is a normalizing constant that can be expanded to  
\[c(\theta)=\sum_{\forall y\in Y}exp(\theta^{T}s(y^{\prime})) \tag{3}\]  
The expanded form of the ERGM equation is therefore  
\[p(Y=y|\theta)=\frac{exp(\theta^{T}s(y))}{\sum\limits_{\forall y^{\prime}\in Y }exp(\theta^{T}s(y^{\prime}))},\forall y\in Y \tag{4}\]  
Due to the exponentially increasing computational requirements associated with increasing graph sizes, it would be infeasible to compute and analyze every possible set of graphs for a set of nodes in order to deduce the true log-odds coefficient of an observed graph. Instead, ERGMs utilize Markov Chain Monte Carlo Maximum Likelihood Estimation (MCMC-MLE) to estimate the log-odds of the input graph's structure by simulating a random graph distribution using a Markov chain, comparing the distribution to the input graph, adjusting the parameter values, and repeating this process until the parameter estimates converge. The Markov chain is assumed to have a similar equilibrium behavior to the probability distribution in question. The model runs the Markov chain in order to generate a sample which can then be used for estimation. The log-odds coefficients are associated with certain user-defined terms, such as dyadic connections, k-star, triangular connections, and the likelihood of their appearance in the graph. Other terms measure values of edges, such as the \(atLeast(x)\) term, which measures probability of finding edges with a value greater than \(x\). By utilizing different terms in an analysis, we can have a more cohesive understanding of network traffic. A discussion into the specific terms that we used in this study can be found in Section 4.3. In the end, the topological awareness of the ERGM translates to a comprehensive understanding of network traffic behavior.