## 4 Results
Only the \(\mathcal{P}\) features from multiple variables (duration, count, same_srv_rate, srv_error_rate, srv_error_rate, str_short_rate, dst_host_count, dst_host_same_src_port_rate, dst_host_error_rate) were determined as significant in predicting attack events with \(t_{s}=60\) s and \(t_{s}=120\) s. Also, the \(\mathcal{N}\) features from the variables (source port, destination port, TCP, and RSTOS0) were determined as significant in predicting attack events for both \(t_{s}=60\) and 120 s. As one of the attribute values in the flag variable, the RSTOS0 indicates the originator sends a synchronization signal (SYN) followed by a reset signal, but, an acknowledgment (ACK) of the SYN does not appear. The TCP feature is one of the attribute values in the protocol type variable. Interestingly, more nominal features were identified as significant for the \(t_{s}=120\) s (43.5%) to predict attack events. The nominal features from the flag variable, such as REJ, RSTO, and S0, were not determined as significant features for the \(t_{s}=60\) s. REJ indicates a rejected connection attempt, and S0 represents a connection attempt that has appeared but no reply. This finding suggests that nominal features might be better presented for a larger time scale. However, further analysis is required to determine an optimal time scale. We intend to address this aspect as part of our future work since finding the optional time scale is not the primary focus of this study. Figure 4 shows the extracted nominal features (i.e., protocol types and service types) based on our proposed approach with the targeted time scales (\(t_{s}=60\) and 120 s). Multiple charts are generated to understand the differences between daily and monthly network events. By analyzing the variable (protocol types), we found that TCP and UDP have been commonly utilized in network communications. ICMP was also widely used in normal and attack events. This is an interesting result because ICMP is a network layer protocol for diagnosing internal network communication issues. Specifically, since the Kyoto dataset was generated in a honeypot system consisting of multiple server nodes, each node communicates continuously to check its stability using ICMP. We also observed that ICMP was used in attack events as well. However, as stated earlier, ICMP was identified as significant in predicting normal events only. Among various service types, SSH was determined as a highly applied service type in network communication. SSH supports accessing systems remotely. While SSH supports highly secure network communication, it is frequently regarded as highly susceptible, especially when not properly administered and monitored. We found numerous brute-force attacks to gain access to systems (see Figure 4d). To analyze the daily network traffic data, we used twenty-three hours of data to generate an LSTM model. Then, the model was used to predict the normal and attack events in the upcoming hour. For the LSTM model, the epoch and batch size numbers were set to 100 and 200, respectively. The model was generated with the learning rate (0.001) using the 'ReLU' activation function and Adam optimizer. For the loss function, MSE was evaluated. Table 1 shows forecasting performances with the targeted time scales \(t_{s}=60\) and 120 s in two different embedding dimensions. We found that forecasting with \(t_{s}=60\) s targeted time scale performed better than using \(t_{s}=120\) s to predict normal and attack events. Interestingly, we observed relatively high RMSE and MAE scores for the \(t_{s}=120\) s to forecast normal events using the March and April data. When evaluating the performances of the normal events with \(t_{s}=60\) s, we observed that the embedding dimension (\(e_{d}=4\)) showed smaller RMSE values except for the months of January, March, November, and December. Furthermore, except for the months of January, March, and September, RMSE showed better performance in the attack events using the embedding dimension (\(e_{d}=4\)).