# Online Intrusion Scenario Discovery and Prediction Based on Hierarchical Temporal Memory (HTM)
## 2 Materials and Methods
### Preliminaries of HTM  
The formal name of the HTM is HTM cortical learning algorithms, which is a machine learning technology that aims to capture the structural and algorithmic properties of the neocortex. The HTM models neurons (cells), which are arranged in columns, in layers, in regions, and in a hierarchy [19]. The HTM learns and memorizes the patterns by building and destroying the synapse connections around the neuron bodies. The HTM theory and basic concepts are explained in this section.  
The software implementation of the HTM algorithm was published in 2011, which may be the real birth of the HTM. The theory of the HTM is developing quickly and the related applications are increasing every year for its distinct properties in online learning and prediction, especially in anomaly detection. More applications are being explored by academics and industry.  
The HTM model is a multi-layer structure that each layer contains a number of columns and each column possesses several neuron cells. The model extracts and represents the features of the outside world by checking the activated column locations within the whole layer. The process of converting the outside data into the inner representation (sparse distributed representations, SDR for short) is called SP (spatial pooling), which is the first phase of the whole learning process. The column can be activated as long as one of the cells composing the column is activated. Under two situations, the neuron cells will get fired into an active state. First, the specified cell is activated in the bursting phase. Second, if the cell is in the predictive state, it will be active in the next time step (for more details, please see [19]). The structure of the HTM is shown in Figure 1.  
Each layer not only represents the different data features but also accumulates the feature transitions over time through constructing or destroying the connections among cells of different columns in the same layer. The permanence value of the specified connection is increased when the connected two cells are successively activated in two adjacent time steps, otherwise, it decreased. This is the second process of HTM called TM (temporal memory), which can store and predict the most probable features based on strong connections. Each lower layer in the hierarchy is the input  
Figure 1: The structure of the HTM model. (**a**) The hierarchy structure of HTM; (**b**) the neuron cells in a layer of columns.  
representation of the higher layer, as a result, the highly abstracted patterns of the original data are obtained by the top layer.  
In a word, the learning process contains two phases: the SP (spatial pooling) and TM (Temporal memory). In the SP phase, the original data are first converted into bit array and then abstracted into an inner representation called SDR. In the TM phase, the temporal correlation of SDRs are accumulated over time. Finally, the SDRs that are predicted by TM are classified by the classifier in order to map the inner representation to the outer presentation. The learning phases are illustrated in Figure 2.  
In this paper, we will not discuss the details of the HTM model itself. For more information about the concepts, functions, and mathematical definitions used in the HTM, please see [13; 20; 21; 22; 23; 24].