Parres-Peredo, Álvaro I.Piza-Dávila, Hugo I.Cervantes, Francisco2026-07-032026-07-032019-10Parres-Peredo, A.I.; Piza-Dávila, H.I.; Cervantes, F. Unexpected-Behavior Detection Using TopK Rankings for Cybersecurity. Appl. Sci. vol. 9 no. 20, pp. 4381, 2019.2076-3417https://hdl.handle.net/11117/12406Anomaly-based intrusion detection systems use profiles to characterize expected behavior of network users. Most of these systems characterize the entire network traffic within a single profile. This work proposes a user-level anomaly-based intrusion detection methodology using only the user’s network traffic. The proposed profile is a collection of TopK rankings of reached services by the user. To detect unexpected behaviors, the real-time traffic is organized into TopK rankings and compared to the profile using similarity measures. The experiments demonstrated that the proposed methodology was capable of detecting a particular kind of malware attack in all the users tested.enghttps://creativecommons.org/licenses/by-nc/4.0/deed.esCibersecurityIntrusion Detection SystemProfilingNetwork SecurityToK Rankinginfo:eu-repo/semantics/article