ids_mal_viz.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "advance-interest",
   "metadata": {},
   "outputs": [],
   "source": [
    "\"\"\"\n",
    "Visualization of non-benign connections data\n",
    "Developed with Python version 3.10.7\n",
    "\"\"\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "ranking-termination",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Load the top modules that are used in multiple places\n",
    "import numpy as np\n",
    "import pandas as pd\n",
    "import matplotlib.pyplot as plt\n",
    "\n",
    "from sklearn.preprocessing import StandardScaler\n",
    "from sklearn.linear_model import LogisticRegression\n",
    "from sklearn.metrics import confusion_matrix\n",
    "\n",
    "from sklearn.metrics import ConfusionMatrixDisplay\n",
    "from sklearn.metrics import f1_score, precision_recall_fscore_support\n",
    "\n",
    "%matplotlib inline  "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "precious-comparison",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Column name mapping from original data to compact form\n",
    "# All the X** are features\n",
    "feature_map = {\n",
    " ' Destination Port' : 'X1',\n",
    " ' Flow Duration' : 'X2', \n",
    " ' Total Fwd Packets' : 'X3', \n",
    " ' Total Backward Packets' : 'X4', \n",
    " 'Total Length of Fwd Packets' : 'X5', \n",
    " ' Total Length of Bwd Packets' : 'X6', \n",
    " ' Fwd Packet Length Max' : 'X7', \n",
    " ' Fwd Packet Length Min' : 'X8', \n",
    " ' Fwd Packet Length Mean' : 'X9', \n",
    " ' Fwd Packet Length Std' : 'X10', \n",
    " 'Bwd Packet Length Max' : 'X11', \n",
    " ' Bwd Packet Length Min' : 'X12', \n",
    " ' Bwd Packet Length Mean' : 'X13', \n",
    " ' Bwd Packet Length Std' : 'X14', \n",
    " 'Flow Bytes/s' : 'X15', \n",
    " ' Flow Packets/s' : 'X16', \n",
    " ' Flow IAT Mean' : 'X17', \n",
    " ' Flow IAT Std' : 'X18', \n",
    " ' Flow IAT Max' : 'X19', \n",
    " ' Flow IAT Min' : 'X20', \n",
    " 'Fwd IAT Total' : 'X21', \n",
    " ' Fwd IAT Mean' : 'X22', \n",
    " ' Fwd IAT Std' : 'X23', \n",
    " ' Fwd IAT Max' : 'X24', \n",
    " ' Fwd IAT Min' : 'X25', \n",
    " 'Bwd IAT Total' : 'X26', \n",
    " ' Bwd IAT Mean' : 'X27', \n",
    " ' Bwd IAT Std' : 'X28', \n",
    " ' Bwd IAT Max' : 'X29', \n",
    " ' Bwd IAT Min' : 'X30', \n",
    " 'Fwd PSH Flags' : 'X31', \n",
    " ' Bwd PSH Flags' : 'X32', \n",
    " ' Fwd URG Flags' : 'X33', \n",
    " ' Bwd URG Flags' : 'X34', \n",
    " ' Fwd Header Length' : 'X35', \n",
    " ' Bwd Header Length' : 'X36', \n",
    " 'Fwd Packets/s' : 'X37', \n",
    " ' Bwd Packets/s' : 'X38', \n",
    " ' Min Packet Length' : 'X39', \n",
    " ' Max Packet Length' : 'X40', \n",
    " ' Packet Length Mean' : 'X41', \n",
    " ' Packet Length Std' : 'X42', \n",
    " ' Packet Length Variance' : 'X43', \n",
    " 'FIN Flag Count' : 'X44', \n",
    " ' SYN Flag Count' : 'X45', \n",
    " ' RST Flag Count' : 'X46', \n",
    " ' PSH Flag Count' : 'X47', \n",
    " ' ACK Flag Count' : 'X48', \n",
    " ' URG Flag Count' : 'X49', \n",
    " ' CWE Flag Count' : 'X50', \n",
    " ' ECE Flag Count' : 'X51', \n",
    " ' Down/Up Ratio' : 'X52', \n",
    " ' Average Packet Size' : 'X53', \n",
    " ' Avg Fwd Segment Size' : 'X54', \n",
    " ' Avg Bwd Segment Size' : 'X55', \n",
    " ' Fwd Header Length.1' : 'X56', \n",
    " 'Fwd Avg Bytes/Bulk' : 'X57', \n",
    " ' Fwd Avg Packets/Bulk' : 'X58', \n",
    " ' Fwd Avg Bulk Rate' : 'X59', \n",
    " ' Bwd Avg Bytes/Bulk' : 'X60', \n",
    " ' Bwd Avg Packets/Bulk' : 'X61', \n",
    " 'Bwd Avg Bulk Rate' : 'X62', \n",
    " 'Subflow Fwd Packets' : 'X63', \n",
    " ' Subflow Fwd Bytes' : 'X64', \n",
    " ' Subflow Bwd Packets' : 'X65', \n",
    " ' Subflow Bwd Bytes' : 'X66', \n",
    " 'Init_Win_bytes_forward' : 'X67', \n",
    " ' Init_Win_bytes_backward' : 'X68', \n",
    " ' act_data_pkt_fwd' : 'X69', \n",
    " ' min_seg_size_forward' : 'X70', \n",
    " 'Active Mean' : 'X71', \n",
    " ' Active Std' : 'X72', \n",
    " ' Active Max' : 'X73', \n",
    " ' Active Min' : 'X74', \n",
    " 'Idle Mean' : 'X75', \n",
    " ' Idle Std' : 'X76', \n",
    " ' Idle Max' : 'X77', \n",
    " ' Idle Min' : 'X78', \n",
    "}\n",
    "\n",
    "\n",
    "feature_map2 = {} \n",
    "for i in feature_map:\n",
    "    feature_map2.setdefault(feature_map[i], []).append(i)\n",
    "\n",
    "num_ids_features = len(feature_map)\n",
    "feature_names = list(feature_map.values())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "serial-hudson",
   "metadata": {},
   "outputs": [],
   "source": [
    "# label names (YY) in the data and their\n",
    "# mapping to numerical values\n",
    "label_map = {\n",
    " 'BENIGN' : 1,\n",
    " 'FTP-Patator' : 2,\n",
    " 'SSH-Patator' : 3,\n",
    " 'DoS slowloris' : 4,\n",
    " 'DoS Slowhttptest': 5,\n",
    " 'DoS Hulk' : 6,\n",
    " 'DoS GoldenEye' : 7,\n",
    " 'Heartbleed' : 8,\n",
    " 'Web Attack � Brute Force' : 9,\n",
    " 'Web Attack � XSS' : 10,\n",
    " 'Web Attack � Sql Injection' : 11,\n",
    " 'Infiltration' : 12,\n",
    " 'Bot' : 13,\n",
    " 'PortScan' : 14,\n",
    " 'DDoS' : 15,\n",
    "}\n",
    "\n",
    "ids_classes = list(label_map.keys())\n",
    "num_ids_classes = len(label_map)\n",
    "num_mal_classes = num_ids_classes - 1\n",
    "mal_class_num = np.arange(1, num_mal_classes + 1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "pointed-basin",
   "metadata": {},
   "outputs": [],
   "source": [
    "outdir = './MachineLearningCVE/restart/'\n",
    "mal_data = 'mal.csv'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "legendary-breakfast",
   "metadata": {},
   "outputs": [],
   "source": [
    "df = pd.read_csv(outdir + mal_data)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "necessary-samoa",
   "metadata": {},
   "outputs": [],
   "source": [
    "df.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "exposed-contamination",
   "metadata": {},
   "outputs": [],
   "source": [
    "\"\"\"\n",
    "Some rows with 'YY' = 5 have the 'X15' column as NaN.\n",
    "Set these to the average value of the 'X15' column for 'YY' = 5\n",
    "\"\"\"\n",
    "# Columns containing nan\n",
    "df.columns[df.isna().any()].tolist()\n",
    "\n",
    "# Only 'YY' = 5 has NaNs\n",
    "(df[df['X15'].isna()])['YY'].unique()\n",
    "\n",
    "avg_x15 = df[df['YY'] == 5]['X15'].mean()\n",
    "df.fillna(avg_x15, inplace=True)\n",
    "\n",
    "if len(df[df['X15'].isna()]) == 0:\n",
    "    print ('NaNs replaced with mean')\n",
    "else:\n",
    "    print ('something went wrong with NaN handling')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "quality-roads",
   "metadata": {},
   "outputs": [],
   "source": [
    "\"\"\"\n",
    "Some rows with 'YY' = 12, 13, 14, 1, 5 have inf in the X15 and X16 columns\n",
    "Replace these with the column max\n",
    "\"\"\"\n",
    "# Columns containing inf\n",
    "df.columns.to_series()[np.isinf(df).any()]\n",
    "\n",
    "# labels corresponding to rows with inf\n",
    "df.iloc[df.index[np.isinf(df).any(1)]]['YY'].unique()\n",
    "\n",
    "# replace infs in x15 column with max non-inf value\n",
    "max_x15 = df.loc[df['X15'] != np.inf, 'X15'].max()\n",
    "print (max_x15)\n",
    "df['X15'].replace(np.inf, max_x15, inplace=True)\n",
    "\n",
    "# replace infs in x16 column with max non-inf value\n",
    "max_x16 = df.loc[df['X16'] != np.inf, 'X16'].max()\n",
    "print (max_x16)\n",
    "df['X16'].replace(np.inf, max_x16, inplace=True)\n",
    "\n",
    "if len(df.columns.to_series()[np.isinf(df).any()]) == 0:\n",
    "    print ('infs replaced with max')\n",
    "else:\n",
    "    print ('something went wrong with inf handling')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "interpreted-success",
   "metadata": {},
   "outputs": [],
   "source": [
    "\"\"\"\n",
    "The dataset is badly skewed.\n",
    "\"\"\"\n",
    "df.groupby(['YY'])['YY'].count()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "declared-bronze",
   "metadata": {},
   "outputs": [],
   "source": [
    "\"\"\"\n",
    "Get the medians of the 14 classes across all dimensions.\n",
    "\n",
    "\n",
    "df_median = df.groupby(['YY'])[feature_names].median()\n",
    "\n",
    "print (df_median.shape)\n",
    "print (df_median)\n",
    "\"\"\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "changed-footwear",
   "metadata": {},
   "outputs": [],
   "source": [
    "\"\"\"\n",
    "PCA\n",
    "Plot them in 2D.\n",
    "\n",
    "from sklearn.decomposition import PCA\n",
    "\n",
    "mod_pca = PCA(n_components=10)\n",
    "X_pca = mod_pca.fit_transform(df_median)\n",
    "print (X_pca.shape)\n",
    "\n",
    "fig, ax = plt.subplots()\n",
    "ax.scatter(X_pca[:, 4], X_pca[:, 5])\n",
    "\n",
    "for i, txt in enumerate(mal_class_num):\n",
    "    ax.annotate(txt, (X_pca[i, 4], X_pca[i, 5]))\n",
    "    \n",
    "\"\"\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "persistent-porcelain",
   "metadata": {},
   "outputs": [],
   "source": [
    "\"\"\"\n",
    "Multi Dimensional Scaling (MDS)\n",
    "Plot them in 2D.\n",
    "\n",
    "from sklearn.manifold import MDS\n",
    "\n",
    "mod_mds = MDS(n_components=3, n_init=10, verbose=1, random_state=42)\n",
    "X_mds = mod_mds.fit_transform(df_median)\n",
    "print (X_mds.shape)\n",
    "\n",
    "fig, ax = plt.subplots()\n",
    "ax.scatter(X_mds[:, 0], X_mds[:, 1])\n",
    "\n",
    "for i, txt in enumerate(mal_class_num):\n",
    "    ax.annotate(txt, (X_mds[i, 0], X_mds[i, 1]))\n",
    "\"\"\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "13f942e2",
   "metadata": {},
   "outputs": [],
   "source": [
    "\"\"\"\n",
    "Logistic regression to understand the most important parameters\n",
    "\"\"\"\n",
    "n_iter = 100\n",
    "imp_cutoff = 3.75 # based on trial error to reduce the total number of features studied"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "major-transformation",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Logistic regression with all features\n",
    "\n",
    "mod_scaler = StandardScaler()\n",
    "X_std = mod_scaler.fit_transform(df[feature_names])\n",
    "mod_log = LogisticRegression(max_iter=n_iter)\n",
    "mod_log.fit(X_std, df['YY'])\n",
    "\n",
    "y_pred = mod_log.predict(X_std)\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "3c7024b3",
   "metadata": {},
   "outputs": [],
   "source": [
    "importances = pd.DataFrame(data={\n",
    "    'Attribute': feature_map.keys(),\n",
    "    'Importance': mod_log.coef_[0]\n",
    "})\n",
    "# importances = importances.sort_values(by='Importance', ascending=False)\n",
    "\n",
    "plt.rcParams[\"figure.figsize\"] = (6,12)\n",
    "plt.barh(y=importances['Attribute'], width=importances['Importance'], color='#087E8B')\n",
    "plt.title('Feature importances obtained from coefficients', size=12)\n",
    "plt.xticks(rotation='vertical')\n",
    "# save figure to file\n",
    "plt.savefig('Fig1.eps', format='eps', dpi=1200, bbox_inches=\"tight\")\n",
    "plt.show()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "f3f878b4",
   "metadata": {},
   "outputs": [],
   "source": [
    "# the six most important features\n",
    "idxs = np.argwhere(abs(mod_log.coef_[0]) > imp_cutoff).flatten().tolist()\n",
    "print (idxs)\n",
    "imp_feats = ['X' + str(i+1) for i in idxs]\n",
    "print (imp_feats)\n",
    "imp_names = [feature_map2[k][0] for k in imp_feats]\n",
    "print (imp_names)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "involved-costume",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Tested with python 3.10.7\n",
    "plt.rcParams[\"figure.figsize\"] = (20,10)\n",
    "\n",
    "cm = confusion_matrix(df['YY'], y_pred, labels=mod_log.classes_, normalize='true')\n",
    "cm = cm.round(decimals=2)\n",
    "disp = ConfusionMatrixDisplay(confusion_matrix=cm, display_labels=mod_log.classes_)\n",
    "disp.plot()\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "9a1a8921",
   "metadata": {},
   "outputs": [],
   "source": [
    "# f1 score only\n",
    "# print (f1_score(df['YY'], y_pred, average='weighted'))\n",
    "\n",
    "# precision recall f1\n",
    "precision_recall_fscore_support(df['YY'], y_pred, average='weighted')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "4d509b49",
   "metadata": {},
   "outputs": [],
   "source": [
    "# rererun the logistic regression with the same number of iterations but only with the top features\n",
    "mod_scaler_t = StandardScaler()\n",
    "X_std_t = mod_scaler_t.fit_transform(df[imp_feats])\n",
    "mod_log_t = LogisticRegression(max_iter=n_iter)\n",
    "mod_log_t.fit(X_std_t, df['YY'])\n",
    "\n",
    "y_pred_t = mod_log_t.predict(X_std_t)\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "c29e761f",
   "metadata": {},
   "outputs": [],
   "source": [
    "# f1 score only\n",
    "# print (f1_score(df['YY'], y_pred_t, average='weighted'))\n",
    "\n",
    "# precision recall f1\n",
    "precision_recall_fscore_support(df['YY'], y_pred_t, average='weighted')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "165f6196",
   "metadata": {},
   "outputs": [],
   "source": [
    "# box plots for important features\n",
    "plt.rcParams[\"figure.figsize\"] = (8,8)\n",
    "# index for saving figures to file; starting at 2\n",
    "j = 2\n",
    "for f in imp_feats:\n",
    "    bl = []\n",
    "    fig, ax = plt.subplots()\n",
    "    for m in range(1, num_ids_classes+1):\n",
    "        bl.append(df[df['YY'] == m][f])\n",
    "    ax.set_title(feature_map2[f][0])\n",
    "    ax.boxplot(bl, vert=False, showfliers=False)\n",
    "    fig_name = 'Fig' + str(j) + '.eps'\n",
    "    plt.savefig(fig_name, format='eps', dpi=1200, bbox_inches=\"tight\")\n",
    "    plt.show()\n",
    "    j += 1"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "c8921d79",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.7"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}