## 5 Discussion  
In this study, we found that the extracted temporal features held significance in predicting network events. As demonstrated in the previous section, we found performance differences depending on the embedding dimensions (\(e_{d}=3\) and \(4\)) to forecast normal and attack events. To understand the effectiveness of embedding dimensions further, we measured the statistical significance of all temporal features. \(67.1\%(t_{s}=60)\) and \(58.6\%(t_{s}=120)\) of the features were identified as significant features to forecast attack events with \(e_{d}=3\). With \(e_{d}=4\), we found similar results, as \(68.6\%(t_{s}=60)\) and \(62.9\%(t_{s}=120)\) of the features were determined significant. These results suggest that there is no significant difference between the embedding dimensions in predicting attack events. However, we found fewer significant features for predicting normal events. Specifically, \(38.6\%(t_{s}=60)\) and \(37.1\%(t_{s}=120)\) of the features were significant to forecast normal events with \(e_{d}=3\). On the other hand, \(65.7\%(t_{s}=60)\) and \(38.6\%(t_{s}=120)\) of the features were determined significant when using \(e_{d}=4\). While there was no clear difference between the dimensions in terms of the number of significant features for predicting normal events, the dimension \(e_{d}=4\) provided a higher number of significant features when predicting normal events. From the analysis of forecasting performances, we found about \(25\%\) of the statistical features (\(\mathcal{P}\)) were significant for the time scale (\(t_{s}=60\) s) in forecasting both normal and attack events. However, none of the \(\mathcal{P}\) features were identified as significant for the \(t_{s}=120\) s. We also found statistical significance in forecasting normal and attack events using the first moment features (\(\mathcal{E}\)). More specifically, \(91.7\%\) of the features were  
Figure 6: Parallel coordinates plots by categorizing network events linearly into three groups with determining natural breaks using the Fisher-Jenks Algorithm. (**a**) Parallel coordinates of the three groups based on the total number of projected normal events for the 1 January 2015 data, (**b**) parallel coordinates of the three groups based on the total number of projected attack events for the 1 January 2015 data, (**c**) parallel coordinates of the three groups based on the total number of projected normal events for the January 2015 data, (**d**) parallel coordinates of the three groups based on the total number of projected attack events for the January 2015 data. The unique distinction between each group has happened because of the variable differences in the highlighted regions (see black bounding box in (**c**,**d**)). significant in predicting network normal and attack events at \(t_{s}=60\) seconds. When using the time scale (\(t_{s}=120\) s), we found 75% and 66.7% of the features were determined as significant in predicting normal events, respectively. However, for predicting attack events, we found that fewer features (66.7%) were significant at predicting attack events. These results highlight the importance of utilizing the \(\mathcal{E}\) features, as more than 50% of them were statistically significant for predicting both normal and attack events. In network analysis, many previous studies have overlooked the nominal features. This study highlights the importance of using the nominal features (\(\mathcal{N}\)) to predict normal and attack events. When analyzing the \(\mathcal{N}\) features, we found that 56.5% and 52.2% of the features were significant in predicting normal events using the time scale \(t_{s}=60\) and 120, respectively. However, when predicting the attack events, we found that much fewer features were significant in predicting attack events: 39.3%(\(t_{s}=60\)) and 30.4%(\(t_{s}=120\)). These results suggest that the \(\mathcal{N}\) features are effective in predicting normal events (about 50% significance).