## 4 Results  
For the data analysis with wavelet transform, we used the decomposition level of three with the 'db3' wavelet function. Different time scales (\(t_{s}=60\) and \(120\) s) and embedding dimensions (\(e_{d}=3\) and \(4\)) were taken into account to assess and compare performance differences. Based on the analysis, we also present the results from the forecasting models to predict future network events (i.e., normal and attack events). Rather than employing a one-step forecasting method that predicts a single value based on the past, a multi-step forecasting method is utilized to predict sequences of values. Figure 2 shows visual representations of variables associated with 'attack' and 'normal' network events on the first day of January 2015. Figure 2a,c present the total number of connections, destination port, and duration using the original network traffic data. The total number of connections represents the number of network connections made in the past two seconds with the same source and destination IP addresses. These variables are used to identify suspicious activities by detecting a significant volume of continuous network connections directed toward the same computer machines. The most commonly used port numbers in cyberattacks are 22--SSH (secure shell), 80--HTTP (hypertext transfer protocol), and 443--HTTPS (hypertext transfer protocol secure). However, by evaluating the destination port information, we found that attackers tried to use various ports to penetrate server machines in a honeypot environment (see Figure 2b). From the analysis  
Figure 1: A diagram of the proposed time-series prediction using LSTM. of the duration information, we determined that the time duration for the attack events varies. There were distinguishable patterns when comparing the difference between normal and attack events. However, further analysis needs to be performed to establish a clear distinction between them. Figure 2d,f represent the converted time series data with different time scales with the \(t_{s}=1\) s, \(t_{s}=60\) s, and \(t_{s}=120\) s. We found that the original network sequences data does not provide much information associated with normal and attack events, while the converted time series data clearly shows a difference between the normal and attack events. In addition, we discovered that the time scale with \(t_{s}=1\) s--compared with the rest of the time scales--does not clearly separate between normal and attack events. Therefore, we excluded the \(t_{s}=1\) s, and used \(t_{s}=60\) s and \(t_{s}=120\) s to analyze network traffic time series. Figure 3 displays data distributions using box plots for the data from January 2015. Due to skewed distributions in the data, logarithmic scales are applied to all figures. Figure 3a,b show box plots of the variables (i.e., source and destination bytes) associated with normal and attack events using the original data. We found that the attack events exhibited significantly higher quartiles in the destination bytes compared to normal events. But, there were only slight variations in the source bytes between normal and attack events. We also observed that the source and destination bytes in the attack events showed multiple outliers (located outside the whiskers of the box plot). As a non-parametric test, the Mann-Whitney U test is used to compare the distribution of the variables between two groups. Comparisons between the normal and attack events for the variables (source and destination bytes) were assessed using the Mann-Whitney U test. From the test, we found significant differences (\(p=0.0004\)) in the distributions of the source byte variable between the normal and attack events. The destination byte varia  
Figure 2: Representations of the network traffic data on the first day of January 2015. Orange and blue color attributes are used to indicate attack and normal events, respectively.