diff --git a/Thesis_Docs/Nikkhah_Nasab-Aida-Mastersthesis.pdf b/Thesis_Docs/Nikkhah_Nasab-Aida-Mastersthesis.pdf
index 0e3295d241468b265aae1a849fbdc8596ff2586e..8c9bfea0c66d63478aea32631a5ac7106936a3e6 100644
Binary files a/Thesis_Docs/Nikkhah_Nasab-Aida-Mastersthesis.pdf and b/Thesis_Docs/Nikkhah_Nasab-Aida-Mastersthesis.pdf differ
diff --git a/Thesis_Docs/main.tex b/Thesis_Docs/main.tex
index c88398f547dc2d0f54c12d88090d97c30f300001..c313466ef0ae851a147875c33511533aef35059d 100644
--- a/Thesis_Docs/main.tex
+++ b/Thesis_Docs/main.tex
@@ -570,6 +570,15 @@ All the hosts in one day are 208,516; however, until now, only 61,207 hosts have
     \item 67,823 hosts have connected to unique URLs between 16 and 99.
 \end{itemize}
 
+Figure \ref{fig:ip_url} illustrates the distribution of unique URLs accessed by different IP addresses. The Y-axis, representing the count of unique URLs, is displayed on a logarithmic scale to better visualize the wide range of values in decreasing order, while the X-axis represents the IP addresses. The chart reveals a wide range of host behaviors, with 208,516 hosts exhibiting varying patterns of URL access. The steep decline in the number of hosts as the unique URL count increases indicates that while most hosts access a limited number of URLs, a small subset interacts with a significantly larger number of resources. This suggests diverse roles within the network, with some hosts performing specialized tasks requiring extensive access, while others are more focused. Analyzing this distribution helps identify unusual browsing patterns, optimize network performance, and enhance security by detecting potential anomalies. This insight is crucial for effective network management and security strategies.
+
+\begin{figure}
+    \centering
+    \includegraphics[width=\textwidth]{../Thesis_Docs/media/ip_url_chart.png}
+    \caption{Distribution of hosts based on unique URLs contacted. The X-axis represents the hosts, while the Y-axis shows the count of unique URLs each host connected to, displayed on a logarithmic scale in decreasing order.}
+    \label{fig:ip_url}
+\end{figure}
+
 \section{Summary}
 The data analysis presented in this chapter provides a comprehensive understanding of the dataset’s structure, user behavior, andnetworkinteractions. By visualizing URL request counts, analyzing 24-hour visit patterns, examining time intervals between requests, and studying the distribution of hosts, this chapter uncovers key insights that can inform network optimization and security strategies. The findings highlight the importance of focusing on high-traffic URLs, understanding temporal patterns in user activity, and detecting periodic behavior that may indicate malicious beaconing. These insights lay the foundation for further analysis and the development of effective detection mechanisms in the BAYWATCH framework. By leveraging advanced visualization techniques and statistical methods, this chapter offers valuable insights into the dataset’s characteristics and user behavior, providing a solid basis for enhancing network security and performance.
 
diff --git a/Thesis_Docs/media/ip_url_chart.png b/Thesis_Docs/media/ip_url_chart.png
new file mode 100644
index 0000000000000000000000000000000000000000..1e89bd32e0c830b69812ec2affe6e373f4e0885e
Binary files /dev/null and b/Thesis_Docs/media/ip_url_chart.png differ