104 lines
3.5 KiB
Python
104 lines
3.5 KiB
Python
import pandas as pd
|
||
import os
|
||
from sklearn.metrics import classification_report
|
||
from sklearn.metrics import roc_curve, auc, roc_auc_score
|
||
|
||
|
||
from sklearn.metrics import confusion_matrix
|
||
|
||
import numpy as np
|
||
import pandas as pd
|
||
|
||
|
||
packet_path = "cicids2017/friday-dos.csv"
|
||
packet_label_path = "cicids2017/friday-dos-label.csv"
|
||
|
||
flow = {}
|
||
feature_latitude = 40 + 1 # 第一个元素是label
|
||
feature_ls = []
|
||
|
||
|
||
def wed_get_label(srcIP, dstIP, time):
|
||
# for wednesday
|
||
if time >= 9*60+47 and time <= 10*60+10:
|
||
if (srcIP == "172.16.0.1" and dstIP == "192.168.10.50") or (dstIP == "172.16.0.1" and srcIP == "192.168.10.50"):
|
||
return True
|
||
if time >= 10*60+14 and time <= 10*60+35:
|
||
if (srcIP == "172.16.0.1" and dstIP == "192.168.10.50") or (dstIP == "172.16.0.1" and srcIP == "192.168.10.50"):
|
||
return True
|
||
if time >= 10*60+43 and time <= 11*60+0:
|
||
if (srcIP == "172.16.0.1" and dstIP == "192.168.10.50") or (dstIP == "172.16.0.1" and srcIP == "192.168.10.50"):
|
||
return True
|
||
if time >= 11*60+10 and time <= 11*60+23:
|
||
if (srcIP == "172.16.0.1" and dstIP == "192.168.10.50") or (dstIP == "172.16.0.1" and srcIP == "192.168.10.50"):
|
||
return True
|
||
return False
|
||
|
||
def fri_get_label(srcIP, dstIP, time):
|
||
# for friday
|
||
if time >= 15*60+56 and time <= 16*60+16:
|
||
if (srcIP == "172.16.0.1" and dstIP == "192.168.10.50") or (dstIP == "172.16.0.1" and srcIP == "192.168.10.50"):
|
||
return True
|
||
return False
|
||
|
||
def pre_process(input_path, output_path):
|
||
time_diff = 0 # s
|
||
df = pd.read_csv(input_path)
|
||
for index, row in df.iterrows():
|
||
if index % 20000 == 0:
|
||
print(index)
|
||
srcIP = row["Source"]
|
||
dstIP = row["Destination"]
|
||
time = row["Time"]
|
||
time = time.split(" ")[-1]
|
||
hour = int(time.split(":")[0])
|
||
min = int(time.split(":")[1])
|
||
time = hour * 60+min
|
||
protocol = row["Protocol"]
|
||
length = row["Length"]
|
||
# get label
|
||
label = fri_get_label(srcIP, dstIP, time)
|
||
# key
|
||
key = srcIP+dstIP
|
||
reverse_key = dstIP+srcIP
|
||
|
||
if not flow.__contains__(key) and not flow.__contains__(reverse_key):
|
||
# 创建一个flow
|
||
flow[key] = [label, "-"+protocol]
|
||
elif flow.__contains__(key):
|
||
# key添加到flow里面
|
||
if len(flow[key]) > feature_latitude:
|
||
feature_ls.append(flow.pop(key))
|
||
flow[key] = [label, "-"+protocol]
|
||
flow[key].append("-"+protocol)
|
||
# 只要有一个包是True，那么整个都是True
|
||
flow[key][0] = flow[key][0] or label
|
||
else:
|
||
# reverse key
|
||
if len(flow[reverse_key]) > feature_latitude:
|
||
feature_ls.append(flow.pop(reverse_key))
|
||
flow[reverse_key] = [label, "+"+protocol]
|
||
flow[reverse_key].append("+"+protocol)
|
||
# 只要有一个包是True，那么整个都是True
|
||
flow[reverse_key][0] = flow[reverse_key][0] or label
|
||
|
||
print("字典中剩余个数：%d" % (len(flow)))
|
||
true_num = 0
|
||
false_num = 0
|
||
for k, v in flow.items():
|
||
if v[0] == True:
|
||
true_num += 1
|
||
else:
|
||
false_num += 1
|
||
print("true num:%d" % (true_num))
|
||
print("false num:%d" % (false_num))
|
||
# write to csv file
|
||
total_data = pd.DataFrame(data=feature_ls)
|
||
# print(total_data)
|
||
total_data.to_csv(output_path, index=False,
|
||
encoding="utf-8", sep=',', mode='w', header=True)
|
||
return
|
||
|
||
|
||
pre_process(packet_path, packet_label_path)
|