## 5 Discussion
But, the effectiveness of the \(\mathcal{N}\) features in predicting attack events remains inconclusive, as less than 50% of the features showed significance. By analyzing the nominal features (protocol types 'TCP,' 'UDD,' and 'ICMP'), we found 'TCP' and 'UDD' were statistically significant in predicting network events in different time scales (\(t_{s}=60\) and 120). But, for the 'Flag' variable representing network connection statuses ('S0,' 'S1,' 'SE,' 'REJ,' 'S2,' 'S3,' 'RSTO,' 'RSTR,' 'RSTRH,' 'SH,' 'SHR,' etc. [30]), we observed that not all features were found to be significant. In detail, the features ('RSTR,' 'RSTRH,' and 'SH') were determined as non-significant features to predict normal and attack events. The 'RSTR' variable represents a network connection that has been established but is aborted by the destination-side machine before completion. The 'RSTRH' variable indicates that the destination machine sends a'synchronize acknowledge message' (i.e., SYN-ACK) and subsequently issues a RST (connection established) signal to abort the connection (forceful termination). SH denotes that a connection establishment message (i.e., SYN) has been sent and terminated without receiving the SYN-ACK message. Since the features ('RSTR,' 'RSTRH,' and 'SH') represent instances of incomplete network connection establishment, they were determined as non-significant variables when it came to predicting network events. In addition, the ANOVA features extracted from the duration variable were not significant. We found that the wavelet features (\(\mathcal{W}\)) from DWT and PE were significant in forecasting normal and attack events. Most importantly, all wavelet features were significant in predicting attack events even with different embedding dimensions (\(e_{d}=3\) and 4) and time scales (\(t_{s}=60\) and 120). To predict normal events, we found that 91.7% of the features were significant with the time scale (\(t_{s}=60\)). But, with the time scale (\(t_{s}=120\)), we found about 25% of the features were significant. This may be due to the fact that data aggregation with a relatively large time scale might degrade the sudden changes. In such a case, using smaller time scales can be more effective in analyzing normal events. As explained in Section 4, we conducted a comprehensive examination of all features using the Granger causality test to ascertain their statistical importance in predicting normal and attack events. Among the nominal variables, we found that the one-hot encoded variable ('REJ') was statistically significant in forecasting future events. Given that the 'REJ' variable represents the denial of a network connection request, it can prove valuable in predicting instances of rejected connection establishments, particularly in the context of attack events. 'TCP' and 'UDP' variables were determined as significant in predicting 70% and 69.6% of other features with \(t_{s}=60\) s and \(t_{s}=120\) s, respectively. We also found that the one-hot encoded variable 'SF' (indicating normal network connection establishment and termination) was significant in predicting 69% of the temporal variables. Interestingly, the one-hot encoded variable ('ICMP') was identified as non-significant when examining one-day and monthly data. The variables 'S0' (indicating a connection attempt was seen, but no reply) and 'SF' (referring to normal establishment and termination) were determined as significant in predicting both normal and attack events with January data (one month). But, the 'S0' variable was not significant when analyzing the January 1 data (one day)with the Granger casualty test. The variables (source and destination port numbers) were significant in predicting network events even with different time scales. When performing the Granger casualty test, only a limited number of nominal features were recognized as significant. However, by analyzing the January data, we observed a substantial count of nominal features being designated as significant.