# Online Intrusion Scenario Discovery and Prediction Based on Hierarchical Temporal Memory (HTM)
## 3 Results
### Evaluations on CICIDS2017 Dataset
#### 3.2.2 Data Learning Results
The prediction errors for each pattern in each test are listed in Table 5. The prediction accuracy for each pattern is an average value of 10 tests. The prediction errors will increase with the noise level. The false positive of the framework can be calculated as _FP = #prediction errors#all actions predicted_\(\times\) 100%. Figure 7 shows the false positives at different noise levels. If each pattern contains less than five noise actions (50% of noise) the false positives can be lower than 3%; if the noise goes up to 80%, the false positives will increase significantly. Thus, the framework can work at a noise level lower than 80%. \begin{table}
\begin{tabular}{c c c} \hline
**Intrusion Patterns** & **Input Action** & **System Prediction** \\ \hline
1-2-3-4-5-6-7-8-9-10 & 1 & 2-3-4-5-6-7-8-9-10 \\
11-12-13-14-11-12-13-14-15-16 & 12 & 13-14-11(13-14-15-16) \\
17-18-19-20-24-28-29 & 17 & 18-19-20-24-28-29 \\
21-22-23-24-28-29-30 & 22 & 23-24-28-29-30 \\
25-26-27-28-29-30-21-24 & 26 & 27-28-29-30-21-24 \\ \hline \end{tabular}
\end{table} 
Table 4: Intrusion patterns for testing. The system makes predictions for input actions. \begin{table} \begin{tabular}{c c c} \hline
**Intrusion Patterns** & **Errors** & **Accuracy 1** \\ \hline
1-2-3-4-5-6-7-8-9-10 & (0,0,0,0,0,0,1,3,4) & 92\% \\
11-12-13-14-11-12-13-14-15-16 & (0,0,0,0,0,1,0,0,2) & 92.5\% \\
17-18-19-20-24-28-29 & (0,0,1,0,0,1,0,2,3) & 89\% \\
21-22-23-24-28-29-30 & (0,0,0,0,0,0,0,1,4) & 90\% \\
25-26-27-28-29-30-21-24 & (0,0,0,0,0,0,1,0,3) & 93\% \\ \hline \end{tabular}  \({}^{1}\) _accuracy = \(1-\frac{\#\text{fake}\) predicted actions_\(\times\) 100%. In the tests, the anomaly score threshold is set to 0.6, 30% of the data are filtered out and not recorded in the correlation matrix, which reduces the size of the matrix and the searching time. When actions 1-10 are correlated by the system, the CS values are shown in Figure 8.  
With the complex intrusion scenario, the framework tends to correlate multiple intrusion patterns together based on the common actions they are sharing. For instance, the three patterns (17-29, 21-30, 25-24) listed in Table 5 will be correlated because they share the actions 24, 28, and 29. Figure 9 illustrates the correlate graph. Figure 8: The correlated actions 1–10, and their CS values. Figure 7: The false positives of the framework. To evaluate the whole system based on a real intrusion scenario, the infiltration attack scenario of the CICIDS2017 dataset is used. The scenario is about a Dropbox download attack, which leveraged the technologies of overflow, port scanning, and Nmap. There are 13,700 IDS alerts generated by snort, 1647 intrusion actions, 163 sessions are extracted, and 22 sessions have more than two actions. All the extracted sessions are loaded into the framework. A part of the sessions is listed in the Table 6.  
The discovered intrusion scenario is shown in Figure 10. Compared with our previous work, the number of nodes in the correlation graph is reduced and the semantic of the correlation graph is closer to the real scenario. However, the samples related to the real scenario are very limited, although there are more than 13,700 alerts, only 720 alerts (5%) are used to construct the actions. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Sessions** & **Sessions** & **Sessions** \\ \hline
1-2-3-4-5-6-7 & 2-1-3-4-5-6-7-14 & 23-24-25 \\
8-9-10-3 & 7-8-18-17-19-20-21 & 3-8-9-10-11-26 \\
8-10-3-9 & 8-9-3-10-11 & 1-2-3-4-5-7-9-10 \\
1-2-4-5-14 & 2-1-3-4-5-6-14-7 & 1-2-27-13-6-14 \\
10-11-12-8-9 & 2-1-3-4-5-14-7-15-16-17-18-19-20 & 28-25-29 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: A part of the extracted intrusion sessions of an infiltration attack. Figure 10: The discovered intrusion scenario. Figure 9: The correlate graph based on the three patterns (17–29, 21–30, 25–24).