# Online Intrusion Scenario Discovery and Prediction Based on Hierarchical Temporal Memory (HTM)
## 4 Discussion  
The discussions of the experimental results are given in Section 3.2. In this section, our works are concluded. The unsupervised online sequence learning and prediction system is proposed. Several measures have been introduced to enhance the performance of the system, such as intrusion action clustering, intrusion session reconstruction, and the optimizations of data processing. These measures can effectively reduce the data noises, redundancies, and false positives, making it easier to discover the potential intrusion behaviors and the correlations between them. The reduction of intrusion action types and unified intrusion sessions have greatly reduced the ambiguous correlations and further simplified the correlation graphs. We introduced the HTM cortical learning algorithms to improve the online sequence learning, based on the predictions of HTM, the correlation graph can be constructed in real-time and keeps updating over time. Offline training is not needed anymore, which makes it lightweight for online work. Many aspects of the system should be studied and enhanced in the future: (1) the orders of actions in a session are important for the system; if all actions randomly change their relative positions frequently, the association patterns between actions are difficult to discover for the system, thus, a pattern stabilization method (maybe based on the statistics) which can correct the disordered actions before learning is appropriate for the system; (2) if multiple intrusion scenarios occurred in parallel and share some common intrusion actions, the framework will correlate them into one large scenario, which leads to the complex model, so the studies of parallel intrusion scenario construction is a direction; and (3) although the HTM algorithm can learn the unknown patterns of the sequence, it can only predict the next time step, rather than predicting a sequence of future actions. The parameters of the HTM algorithm should be carefully set, though it is easier to set than other machine learning algorithms. Received:  
* [PERSON] et al. (2015) [PERSON]; [PERSON]; [PERSON] RTECA: Real Time Episode Correlation Algorithm for Multi-Step Attack Scenarios Detection. _Comput. Secur._**2015**, _49_, 206-219. [CrossRef]
* [PERSON] et al. (2010) [PERSON]; [PERSON]; [PERSON] An Online Adaptive Approach to Alert Correlation. In Proceedings of the Detection of Intrusions and Malware, and Vulnerability Assessment, Bonn, Germany, 8-9 July 2010; pp. 153-172. * [PERSON] and [PERSON] (2004) [PERSON]; [PERSON] Attack Plan Recognition and Prediction Using Causal Networks. In Proceedings of the 20 th Annual Computer Security Applications Conference, Tucson, AZ, USA, 6-10 December 2004; pp. 370-379. * [PERSON] et al. (2015) [PERSON]; [PERSON]; [PERSON] Real Time Alert Correlation and Prediction Using Bayesian Networks. In Proceedings of the 12 th International Iranian Society of Cryptology Conference on Information Security and Cryptology (ISCISC), Rasht, Iran, 8-10 September 2015; pp. 98-103. * [PERSON] et al. (2019) [PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON] Survey of Attack Projection, Prediction, And Forecasting in Cyber Security. _IEEE Commun. Surv. Tutor._**2019**, _21_, 640-660. [CrossRef]
* [PERSON] et al. (2011) [PERSON]; [PERSON]; [PERSON] [PERSON] Alert Correlation and Prediction Using Data Mining and HMM. _ISeCure_**2011**, \(3\), 77-101. * [PERSON] and [PERSON] (2018) [PERSON]; [PERSON] Towards Predicting Cyber Attacks Using Information Exchange and Data Mining. In Proceedings of the 14 th International Wireless Communications & Mobile Computing Conference (IWCMC), Limassol, Cyprus, 25-29 June 2018; pp. 536-541. * [PERSON] and [PERSON] (2014) [PERSON]; [PERSON] A study on cyber threat prediction based on intrusion detection event for APT attack detection. _Multimed. Tools Appl._**2014**, _71_, 685-698. [CrossRef]
* [PERSON] et al. (2016) [PERSON]; [PERSON]; [PERSON] A Neural Network based system for intrusion detection and attack classification.