## 4 Results
Evaluating the performances of the normal events with \(t_{s}=120\) s, we found that the embedding dimension (\(e_{d}=3\)) showed smaller RMSE values except for the months of April and July. Similarly, except for the months of March, April, June, July, and November, better performance in predicting attack events was observed using the embedding dimension (\(e_{d}=3\)). Figure 5 presents visual representations of predicted network events with the time scale \(t_{s}=60\) s by applying principal component analysis (PCA). PCA is a popular di  
Figure 4: Representations of nominal features with the time scale (\(t_{s}=120\) s). (**a**) Protocol types of the network events appeared on 1 January 2015, (**b**) protocol types of all network events in January 2015, (**c**) service types of the network events appeared on 1 January 2015, and (**d**) service types of all network events in January 2015. Logarithmic scales are applied to address data skewness along the \(y\)-axis. mension reduction technique in visualization to represent high-dimensional data in a lower-dimensional space. The first and second principal components are determined and used to map all data instances into the \(x\)- and \(y\)-axis of the 2D space. To better represent the forecasted network events, the Fisher-Jenks algorithm (often called Jenks' natural breaks classification method) is applied to form clusters. It determines the best arrangement of values into different classes. A classification process was performed to categorize different normal and attack events into three distinct groups. Figure 5 shows grouped representations of the events with distinctive colors using'red,' 'blue,' and 'green.' The colors represent clusters \(G_{1}\), \(G_{2}\), and \(G_{3}\), respectively. Figure 5a,b present the clusters analyzed on 1 January 2015 (one-day data). The clusters were split into three classification groups for the normal events (\(G_{1}:0\sim 44\), \(G_{2}:44\sim 244\), \(G_{3}:244\sim\max\)) and the attack events (\(G_{1}:43\sim 233\), \(G_{2}:233\sim 583\), \(G_{3}:583\sim\max\)). When classification was performed with the normal events, we observed distinctively separated clusters (see \(G_{1}:\) red and \(G_{2}:\) blue). However, the cluster (\(G_{3}:\) green) was not clearly visible. Interestingly, we identified that the cluster (\(G_{3}:\) green) became distinct when analyzing the attack events (see blue-colored glyphs, Figure 5b). For the one-month data in January 2015, the three groups were determined with the split ranges for for the normal events (\(G_{1}:0\sim 111\), \(G_{2}:111\sim 517\), \(G_{3}:517\sim\max\)) and the attack events (\(G_{1}:0\sim 518\), \(G_{2}:518\sim 6967\), \(G_{3}:6967\sim\max\)). With the Fisher-Jenks  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{3}{*}{\(t_{s}\)} & \multirow{3}{*}{**Month**} & \multicolumn{4}{c}{**Embedding Dimension \(e_{d}=3\)**} & \multicolumn{4}{c}{**Embedding Dimension \(e_{d}=4\)**} \\ \cline{3-10}  & & \multicolumn{2}{c}{**Normal Events**} & \multicolumn{2}{c}{**Attack Events**} & \multicolumn{2}{c}{**Normal Events**} & \multicolumn{2}{c}{**Attack Events**} \\ \cline{3-10}  & & **RMSE** & **MAE** & **RMSE** & **MAE** & **RMSE** & **MAE** & **RMSE** & **MAE** \\ \hline \multirow{8}{*}{60} & January & 3.96 \(\pm\) 0.03 & 2.39 \(\pm\) 0.02 & 5.89 \(\pm\) 0.04 & 3.82 \(\pm\) 0.03 & 3.27 \(\pm\) 0.02 & 2.25 \(\pm\) 0.02 & 4.83 \(\pm\) 0.03 & 3.66 \(\pm\) 0.03 \\ \cline{2-  
algorithm, we found that most network events fall into the lower classification group (i.e., \(G_{1}\)). Figure 5c,d show high-density regions (red-colored) representing \(G_{1}\). The blue-colored classification group (\(G_{2}\)) does not form separated clusters. From the analysis of data from January 2015, we found that it was not easy to see the classification group (\(G_{3}\)) in the PCA projections because not many network events are categorized into \(G_{3}\). Presenting the data on a PCA projection space aids in understanding the similarities and differences among network events.