# Online Intrusion Scenario Discovery and Prediction Based on Hierarchical Temporal Memory (HTM)
## 2 Materials and Methods
### The Intrusion Scenario Discovery and Prediction Framework
#### 2.2.3 Online Learning and Prediction  
The HTM algorithm can provide some advantages for the proposed framework: (1) It learns the patterns and trends based on the variance of the features over time, which makes it suitable for sequence learning, and it has a better performance than other sequence learning algorithm [13]; (2) it further reduces the influence of the noise due to the special representations of the data; and (3) it can be used to reduce the negative influences of data problems, such as sudden changes in the pattern, and it highlights the real patterns that should be focused on. The association relation of actions is the main objective to be learned by HTM algorithm. The correlation between two actions A and B can be measured by their temporal orders in the sequence, and the TM (Temporal Memory) learning process of HTM which is described in Section 2.1 can discover and accumulate the temporal association strength between A and B. Thus, the intrusion sessions are first converted into the action ID sequences and the IDs are fed to the HTM by their occurrence order. The backend system will record and analyze the output of the HTM in real-time. There are three main output values are recorded for analyzing: The current input value, the predicted value, and the anomaly score calculated with the two values. The anomaly score assesses the differences between the predicted SDR and the input SDR. Considering \(P^{\prime}_{t-1}\) as the predicted SDR at time step \(t-1\), and \(P_{t}\) as the input SDR at time step \(t\). The anomaly score at time step \(t\) can be calculated as:  
\[\omega_{t}=1-\frac{p^{\prime}_{t-1}\bullet p_{t}}{\left|p_{t}\right|}, \tag{4}\]  
where \(\left|P_{t}\right|\) denotes the number of one bit in \(P_{t}\), the symbol \(\bullet\) computes the number of one bit of the SDR that is different from the other one. \(\omega_{t}\) will be 0 if the predicted SDR is totally different from the input SDR. The prediction made by HTM can be denoted as a triple: \(<\!p\), \(p^{\prime}\), \(\omega\!\!>\) where \(p\) indicates the current input value, \(p^{\prime}\) indicates the predicted value at the previous time step, and \(\omega\) indicates the anomaly score. The records with \(\omega\geq 0.6\) will be selected to update the correlation matrix. Although the introduction of the HTM algorithm enhances the framework in the ability of online learning and analyzing, the learned patterns will evolve with the data variance in the long-term continuous learning process. In other words, the learned patterns should be kept stable in a way. Thus, the correlation matrix (CM) is proposed. For given actions \(A_{1}\), \(A_{2}\), \(A_{3}\),..., \(A_{n}\), the correlation matrix can be defined as an \(n\times n\) matrix \(M(A_{i},A_{j})=<\!\left|A_{i}\to A_{j}\right|\), \(\overline{\omega_{0}}\!>\quad(i,j<n)\) where \(A_{i}\) indicates the input action, and \(A_{j}\) indicates the predicted action. The value of \(M(A_{i},A_{j})\) is a tuple, \(\left|A_{i}\to A_{j}\right|\) denotes that the number of \(A_{i}\to A_{j}\) has been predicted, and \(\overline{\omega_{0}}\) is a single exponential smoothed anomaly score. \(\overline{\omega_{0}}\) can be calculated by Equation (5):  
\[\overline{\omega_{0}}=\overline{\omega_{0}}+\alpha(\omega_{n}-\overline{\omega _{0}}) \tag{5}\]  
where \(\omega_{n}\) indicates the anomaly score of the latest prediction. \(\alpha\) denotes the smooth factor. In the prediction phase, the correlation strengths (CS values) between actions are calculated by the historical predictions as:  
\[CS(Ai,Aj)=\frac{\left|A_{i}\to A_{j}\right|}{\left|A_{i}\rightarrow\star \right|}\times\overline{\omega_{0}} \tag{6}\]  
where \(\left|A_{i}\rightarrow\star\right|\) denotes the total number of the predictions with \(A_{i}\) as the input action.