# Online Intrusion Scenario Discovery and Prediction Based on Hierarchical Temporal Memory (HTM)
## 3 Results
### Evaluations on CICIDS2017 Dataset
#### 3.2.2 Data Learning Results  
The accuracy of the framework in discovering potential intrusion patterns and the ability of discovering the intrusion scenarios will be evaluated in this section. First, the framework will be tested on an automatically generated dataset by programming. Second, the system will be tested on a series of intrusion sessions extracted in the data preprocessing evaluation, and these intrusion sessions contain the real intrusion scenarios. In order to test the core algorithm of the system in a flexible way, the automatically generated dataset are used by programming. Five intrusion patterns are generated with about 10 actions in each pattern. Some irrelevant actions are inserted into these patterns randomly to mislead the system. The target of the system is to discover these unknown patterns in an unsupervised way. After training, some actions are provided to the system to make predictions. The predicted actions will be compared with the five patterns, and all the predicted actions that are not match with the patterns will be recorded for statistics. The details about the dataset are listed in Table 4. The whole evaluation contains 10 tests, and each test is conducted separately with the testing data regenerated. The test data contains three parts: (1) The intrusion patterns to be discovered by the system; (2) the background traffic; and (3) the gradually increased noise actions inserted into each pattern. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Scenarios** & **Actions 1** & **Alerts** \\ \hline \hline  & A & protocol-smmp request rp \\  & B & protocol-smmp agent\(\backslash\)lcp request \\  & C & protocol-icmp ping \\  & & protocol-icmp ping undefined code \\  & & protocol-icmp echo reply undefined code \\  & D & policy-other tcp packet with urgent flag attempt \\  & & server-other winner-wide attack \\  & E & policy-other tcp packet with urgent flag attempt \\  & F & server-webapp robots.txt access \\  & G & policy-other ftp anonymous login attempt \\  & H & app-detect failed ftp login attempt \\  & I & openssh masstartup threshold connection exhaustion \\  & J & denial of service \\  & J & indicator-scan ssh brute force login attempt \\  & K & server-other realnetworks helix server ntlm \\  & Authentication heap overflow attempt \\ \hline  & L & server-webapp password sent via post parameter \\ Web attack & M & server-webapp flexense diskpulse disk change \\  & & monitor login buffer overflow attempt \\  & N & policy-other script tag in url—likely cross-site \\  & O & scripting attempt \\ \hline \hline \end{tabular}  
* 1 Not all the actions are listed in the table for the limitation of this paper.  
\end{table} 
Table 3: Extracted intrusion sessions. The generated data are shown in Figure 6, the number denotes the action IDs, and the actions with ID more than 100 are irrelevant actions. For the system, the frequency of one or more actions appearing together in the sequence will be learned by the HTM algorithm through the prediction and revising process. The testing program will create the data file for each test and load the data into the framework. Each data file contains about 2000 actions and 20 randomly-selected intrusion patterns with noise. The noise actions will increase with testing. For each test, the framework will correlate the actions based on their high CS value. If two actions appear together only once, the anomaly score of the HTM for this prediction will be very low and the CS value too, and if one particular action frequently appears with many other different actions, the HTM will keep a low prediction accuracy for this action because it cannot decide which action will appear after it, Additionally, the confidence will decrease. Thus, only stable patterns will be discovered. In the test, the system will start searching with the given action and only select the action with the highest CS value among the candidate values which are greater than 0.6.