In this paper, we present a new approach to NIDS deployment based on machine learning. This new approach is based on detecting attackers by analyzing the relationship between computers over time. The basic idea that we rely on is that the behaviors of attackers’ computers are different from those of other computers, because the timings and durations of their connections are different and therefore easy to detect. This approach does not analyze each network packet statistically. It analyzes, over a period of time, all traffic to obtain temporal behaviors and to determine if the IP is an attacker instead of that packet. IP behavior analysis reduces drastically the number of alerts generated. Our approach collects all interactions between computers, transforms them into time series, classifies them, and assembles them into a complex temporal behavioral network. This process results in the complex characteristics of each computer that allow us to detect which are the attackers’ addresses. To reduce the computational efforts of previous approaches, we propose to use visibility graphs instead of other time series classification methods, based on signal processing techniques. This new approach, in contrast to previous approaches, uses visibility graphs and reduces the computational time for time series classification. However, the accuracy of the model is maintained.

The Threat Intelligence discipline provides cyberdefenders with a high amount of information related to techniques, tactics and procedures involved in known cyberincidents. This information is key for the definition of a sound cybersecurity strategy, through a thorough process of risk analysis. The increasing amount of information available about known adversaries, campaigns, attacks, techniques, tactics, procedures and tools, among others, related to known cyberincidents makes it difficult to analyze and obtain useful conclusions that can be applicable to the cybersecurity strategy. Processing this information without automation leads to lack of escalability and introduction of biases and inconsistencies due to the participation of different experts with different criteria and background. The availability of a similarity measure between different cyberincidents based on their related data can be useful in this context, both increasing the efficiency identifying the cyberincidents whose analysis can provide more information, because of their dissimilitude and increasing the quality of the conclusions providing quantitative information in trends. In order to automate the processing of threat intelligence information, graphs theory can provide the capability of graphs to model and manipulate high quantities of heterogeneous data with complex relationships among them. For the definition of the similarity measure, hypergraphs can be used to model this high amount of complex and heterogeneous information along with the complex relationships between the different pieces of data, such as techniques used in attacks against banks or adversaries operating in 2023. All items related to a certain cyberincident, like adversaries, used techniques and so on, can be modelled using a hypergraphs whose nodes define the attributes that the item can or cannot have. The items related to different incidents will define different hyperedges depending on their attributes. With the model properly established, the mathematical tools available to operate with hypergraphs can be used to obtain actionable information. There are multiple similarity measures defined over hypergraphs that can be used in isolation or in combination in order to obtain similarity measures in different ways to respond to different questions like what are the techniques that have started to be used against a certain target or how similar are the attacks performed by two adversaries that can threaten a certain company.

This paper proposes a data-driven framework to identify and rank economically connected cities by using commercial air traffic as a proxy for urban economic connectivity. The study is motivated by the limitation of traditional city classifications, which often rely on costly and multidimensional socioeconomic indicators, and by the need for scalable alternatives based on open mobility data. Using daily flight frequencies between 213 cities included in the GaWC classification for the year 2022, we built a time series for each origin–destination pair and unsupervised clustering these temporal profiles. The resulting clusters were used to define the layers of a multiplex network, where each layer represents a different pattern of flight connectivity. City importance was then estimated through Multiplex PageRank, which allows for temporal behavior and multilayer network structure to be combined in a single ranking scheme. Rather than introducing a new standalone algorithm, this paper contributes a reproducible analytical pipeline that integrates time-series clustering with multiplex centrality analysis using open aviation data. The results show that the ranking obtained is broadly aligned with established classifications such as GaWC, supporting the idea that commercial flight dynamics can provide a useful proxy for economic interconnectedness. The proposed approach offers a simple and replicable tool for comparative urban analysis, although the results should be interpreted with caution given the limited post-pandemic period covered by the data.