import pandas as pd from sklearn.model_selection import StratifiedKFold from sklearn.svm import OneClassSVM from sklearn.ensemble import IsolationForest from sklearn.metrics import accuracy_score, recall_score, f1_score, precision_score, confusion_matrix import sys import _pickle as pkl import numpy as np import warnings warnings.filterwarnings('ignore') features_name = [ "Flow Duration", "Total Fwd Packet", "Total Bwd packets", "Total Length of Fwd Packet", "Total Length of Bwd Packet", "Fwd Packet Length Max", "Fwd Packet Length Min", "Fwd Packet Length Mean", "Fwd Packet Length Std", "Bwd Packet Length Max", "Bwd Packet Length Min", "Bwd Packet Length Mean", "Bwd Packet Length Std", "Flow Bytes/s", "Flow Packets/s", "Flow IAT Mean", "Flow IAT Std", "Flow IAT Max", "Flow IAT Min", "Fwd IAT Total", "Fwd IAT Mean", "Fwd IAT Std", "Fwd IAT Max", "Fwd IAT Min", "Bwd IAT Total", "Bwd IAT Mean", "Bwd IAT Std", "Bwd IAT Max", "Bwd IAT Min", "Fwd PSH Flags", "Bwd PSH Flags", "Fwd URG Flags", "Bwd URG Flags", "Fwd Header Length", "Bwd Header Length", "Fwd Packets/s", "Bwd Packets/s", "Packet Length Min", "Packet Length Max", "Packet Length Mean", "Packet Length Std", "Packet Length Variance", "FIN Flag Count", "SYN Flag Count", "RST Flag Count", "PSH Flag Count", "ACK Flag Count", "URG Flag Count", "CWR Flag Count", "ECE Flag Count", "Down/Up Ratio", "Average Packet Size", "Fwd Segment Size Avg", "Bwd Segment Size Avg", "Fwd Bytes/Bulk Avg", "Fwd Packet/Bulk Avg", "Fwd Bulk Rate Avg", "Bwd Bytes/Bulk Avg", "Bwd Packet/Bulk Avg", "Bwd Bulk Rate Avg", "Subflow Fwd Packets", "Subflow Fwd Bytes", "Subflow Bwd Packets", "Subflow Bwd Bytes", "FWD Init Win Bytes", "Bwd Init Win Bytes", "Fwd Act Data Pkts", "Fwd Seg Size Min", "Active Mean", "Active Std", "Active Max", "Active Min", "Idle Mean", "Idle Std", "Idle Max", "Idle Min", ] def print_important_feature(sort_index, num=10): print("top important feature is:") for index in sort_index[:num]: print(features_name[index]) def ocsvm_classifier(train, test, test_ow="ndarray"): X = train.features.tolist() Y = train.label.tolist() test_X = test.features.tolist() # print(len(X), len(Y)) # print(len(X[0])) ocsvm = OneClassSVM(kernel="linear") ocsvm.fit(X, Y) # importance = rf.feature_importances_ # sort_index = np.flipud(importance.argsort()) # print_important_feature(sort_index) pred_ret = ocsvm.predict(test_X) # print(pred_ret) if not isinstance(test_ow, str): ow_X = test_ow.features.tolist() return pred_ret, ocsvm.predict(ow_X) else: return pred_ret def svdd_classifier(train, test, test_ow="ndarray"): X = train.features.tolist() Y = train.label.tolist() test_X = test.features.tolist() # print(len(X), len(Y)) # print(len(X[0])) ocsvm = OneClassSVM(kernel="rbf") ocsvm.fit(X, Y) # importance = rf.feature_importances_ # sort_index = np.flipud(importance.argsort()) # print_important_feature(sort_index) pred_ret = ocsvm.predict(test_X) # print(pred_ret) if not isinstance(test_ow, str): ow_X = test_ow.features.tolist() return pred_ret, ocsvm.predict(ow_X) else: return pred_ret def isolation_forest(train, test, test_ow="ndarray"): X = train.features.tolist() Y = train.label.tolist() test_X = test.features.tolist() # print(len(X), len(Y)) # print(len(X[0])) ifc = IsolationForest() ifc.fit(X, Y) # importance = rf.feature_importances_ # sort_index = np.flipud(importance.argsort()) # print_important_feature(sort_index) pred_ret = ifc.predict(test_X) if not isinstance(test_ow, str): ow_X = test_ow.features.tolist() return pred_ret, ifc.predict(ow_X) else: return pred_ret if __name__ == "__main__": kf = StratifiedKFold(n_splits=5, shuffle=True) doh_dataset = pkl.load(open("./result/doh_features.pkl", "rb")) doh_dataset['label'] = doh_dataset['label'].map(lambda x: 1) for file in ["./result/web_features.pkl", "./result/chat_features.pkl", "./result/email_features.pkl", "./result/voip_features.pkl", "./result/file_features.pkl"]: print(file) web_dataset = pkl.load(open(file, "rb")) web_dataset = web_dataset.sample(min(len(web_dataset), len(doh_dataset) // 5)) web_dataset['label'] = web_dataset['label'].map(lambda x: -1) # cw_file_dataset = pkl.load(open("./result/cw_file_features.pkl", "rb")) # cw_voip_dataset = pkl.load(open("./result/cw_file_features.pkl", "rb")) # ow_doh_dataset = pkl.load(open("./result/ow_doh_features.pkl", "rb")) # ow_web_dataset = pkl.load(open("./result/ow_web_features.pkl", "rb")) print("数据集组成如下：") print(f"封闭数据集中正负样本比例为1:{len(web_dataset) // len(doh_dataset)}，" f"正样本数量为{len(doh_dataset)},负样本数量为{len(web_dataset)}") print("load data suc!") cw_dataset = pd.concat([doh_dataset]) # ow_dataset = pd.concat([ow_web_dataset, ow_doh_dataset]) for clf in [isolation_forest, svdd_classifier, ocsvm_classifier]: classify = clf for k, (train, test) in enumerate(kf.split(cw_dataset, list(cw_dataset.label))): test_dataset = pd.concat([cw_dataset.iloc[test], web_dataset]) predict_results = classify(cw_dataset.iloc[train], test_dataset) gt_Y = test_dataset.label.tolist() precision = precision_score(gt_Y, predict_results, pos_label=0, average=None) recall = recall_score(gt_Y, predict_results, pos_label=0, average=None) f1 = f1_score(gt_Y, predict_results, pos_label=0, average=None) acc = accuracy_score(gt_Y, predict_results) print(confusion_matrix(gt_Y, predict_results)) print("封闭测试集准确率: ", precision, end="\t") print("封闭测试集召回率: ", recall, end="\t") print("封闭测试集f1值: ", f1, end="\t") print("封闭测试集acc: ", acc) break # ow_gt_Y = ow_dataset.label.tolist() # precision = precision_score(ow_gt_Y, ow_predict_result, pos_label=0, average="binary") # recall = recall_score(ow_gt_Y, ow_predict_result, pos_label=0, average="binary") # f1 = f1_score(ow_gt_Y, ow_predict_result, pos_label=0, average="binary") # acc = accuracy_score(ow_gt_Y, ow_predict_result) # print("开放测试集准确率: ", precision, end="\t") # print("开放测试集召回率: ", recall, end="\t") # print("开放测试集f1值: ", f1, end="\t") # print("开放测试集acc: ", acc)