## 4 Results
(**a**) Total number of connections with the same source and destination IP addresses in the past two seconds, (**b**) destination port number of each network, (**c**) connection duration of each network event, (**d**) total number of events in each second, (**e**) total number of events in the converted time series data with the time scale (\(t_{s}=60\) s), (**f**) total number of events in the converted time series data with the time scale (\(t_{s}=120\) s). In (**c**,**f**), logarithmic scales are applied along the \(y\)-axis to advance the visualizations to resolve data skewness toward large-density network events. as significant (\(p<0.0001\)) between the normal and attack events. Figure 3c,d present box plots of the total number of normal and attack events in the converted time series data with different time scales (\(t_{s}=60\) and \(120\) s), respectively. When analyzing time series data, satisfying the stationarity property of data is essential because it influences the overall forecasting performances [39]. The augmented Dickey-Fuller (ADF) test is commonly used to check the stationarity of data. We performed the ADF test to validate if the converted time series data met the stationary assumption. The null hypothesis for the test was that the time series data were non-stationary. The test results demonstrated statistical significance (\(p<0.05\)) to reject the hypothesis, indicating that the converted time series data satisfied the stationary assumption. Figure 3: Box plot distributions of the network traffic data in January 2015. (**a**) Source and destination bytes of normal events, (**b**) source and destination bytes of attack events, (**c**) number of network events with the time scale (\(t_{S}=60\) s), and (**d**) number of network events with the time scale (\(t_{S}=120\) s). Logarithmic scales are applied to address data skewness. In time series analysis, it is important to determine the effectiveness of a particular time series in forecasting another one. The Granger causality test [40; 41] is commonly utilized to validate the effectiveness of time series. Thus, we performed the Granger causality test on the converted time series data, considering both time scales (\(t_{s}=60\) and 120 s) and the two embedding dimensions (\(e_{d}=3\) and 4). This test was carried out to assess the suitability of variables to forecast a dependent variable. We tested the extracted temporal features in forecasting network events with a 95% significance. We found high similarity even with different dimensions (either \(e_{d}=3\) or 4). We found that 67.6% and 69% of the temporal features showed their significance with \(t_{s}=60\) s and 42.3% and 61.9% with \(t_{s}=120\) s in forecasting normal and attack events, respectively. In addition, both 53.5% and 26.8% of features were determined as significant in predicting both normal and attack events with \(t_{s}=60\) s and \(t_{s}=120\) s. We also observed that all wavelet transform and permutation entropy features (\(\mathcal{W}\)) demonstrated significance in predicting the attack events with \(t_{s}=60\) s and \(t_{s}=120\) s. The summary of the Granger causality test result to forecast normal and attack events is included in Table 1 in Appendix A. The \(\mathcal{P}\) features from the variables (i.e., source bytes and Dst_host_srv error_rate) were significant to determine attack events with \(t_{s}=60\) s and \(t_{s}=120\) s. The source byte variable indicates the number of network event bytes transferred from source to destination in a single connection. The Dst_host_srv error_rate indicates the percentage of the flag connections (i.e., s0, s1, s2, or s3) that have activated among the connections.