Project+Network+Analysis.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "import tensorflow as tf"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [],
   "source": [
    "import tflearn"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "import pandas as pd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "train_data = pd.read_csv('UNSW_NB15_training-set.csv',index_col='id')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style>\n",
       "    .dataframe thead tr:only-child th {\n",
       "        text-align: right;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: left;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>dur</th>\n",
       "      <th>proto</th>\n",
       "      <th>service</th>\n",
       "      <th>state</th>\n",
       "      <th>spkts</th>\n",
       "      <th>dpkts</th>\n",
       "      <th>sbytes</th>\n",
       "      <th>dbytes</th>\n",
       "      <th>rate</th>\n",
       "      <th>sttl</th>\n",
       "      <th>...</th>\n",
       "      <th>ct_dst_sport_ltm</th>\n",
       "      <th>ct_dst_src_ltm</th>\n",
       "      <th>is_ftp_login</th>\n",
       "      <th>ct_ftp_cmd</th>\n",
       "      <th>ct_flw_http_mthd</th>\n",
       "      <th>ct_src_ltm</th>\n",
       "      <th>ct_srv_dst</th>\n",
       "      <th>is_sm_ips_ports</th>\n",
       "      <th>attack_cat</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>id</th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>0.000011</td>\n",
       "      <td>udp</td>\n",
       "      <td>-</td>\n",
       "      <td>INT</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>496</td>\n",
       "      <td>0</td>\n",
       "      <td>90909.0902</td>\n",
       "      <td>254</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>Normal</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>0.000008</td>\n",
       "      <td>udp</td>\n",
       "      <td>-</td>\n",
       "      <td>INT</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>1762</td>\n",
       "      <td>0</td>\n",
       "      <td>125000.0003</td>\n",
       "      <td>254</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>Normal</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>0.000005</td>\n",
       "      <td>udp</td>\n",
       "      <td>-</td>\n",
       "      <td>INT</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>1068</td>\n",
       "      <td>0</td>\n",
       "      <td>200000.0051</td>\n",
       "      <td>254</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>3</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>3</td>\n",
       "      <td>0</td>\n",
       "      <td>Normal</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>0.000006</td>\n",
       "      <td>udp</td>\n",
       "      <td>-</td>\n",
       "      <td>INT</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>900</td>\n",
       "      <td>0</td>\n",
       "      <td>166666.6608</td>\n",
       "      <td>254</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>3</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2</td>\n",
       "      <td>3</td>\n",
       "      <td>0</td>\n",
       "      <td>Normal</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>0.000010</td>\n",
       "      <td>udp</td>\n",
       "      <td>-</td>\n",
       "      <td>INT</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>2126</td>\n",
       "      <td>0</td>\n",
       "      <td>100000.0025</td>\n",
       "      <td>254</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>3</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2</td>\n",
       "      <td>3</td>\n",
       "      <td>0</td>\n",
       "      <td>Normal</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 44 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "         dur proto service state  spkts  dpkts  sbytes  dbytes         rate  \\\n",
       "id                                                                            \n",
       "1   0.000011   udp       -   INT      2      0     496       0   90909.0902   \n",
       "2   0.000008   udp       -   INT      2      0    1762       0  125000.0003   \n",
       "3   0.000005   udp       -   INT      2      0    1068       0  200000.0051   \n",
       "4   0.000006   udp       -   INT      2      0     900       0  166666.6608   \n",
       "5   0.000010   udp       -   INT      2      0    2126       0  100000.0025   \n",
       "\n",
       "    sttl  ...    ct_dst_sport_ltm  ct_dst_src_ltm  is_ftp_login  ct_ftp_cmd  \\\n",
       "id        ...                                                                 \n",
       "1    254  ...                   1               2             0           0   \n",
       "2    254  ...                   1               2             0           0   \n",
       "3    254  ...                   1               3             0           0   \n",
       "4    254  ...                   1               3             0           0   \n",
       "5    254  ...                   1               3             0           0   \n",
       "\n",
       "    ct_flw_http_mthd  ct_src_ltm  ct_srv_dst  is_sm_ips_ports  attack_cat  \\\n",
       "id                                                                          \n",
       "1                  0           1           2                0      Normal   \n",
       "2                  0           1           2                0      Normal   \n",
       "3                  0           1           3                0      Normal   \n",
       "4                  0           2           3                0      Normal   \n",
       "5                  0           2           3                0      Normal   \n",
       "\n",
       "    label  \n",
       "id         \n",
       "1       0  \n",
       "2       0  \n",
       "3       0  \n",
       "4       0  \n",
       "5       0  \n",
       "\n",
       "[5 rows x 44 columns]"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "train_data.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "array([0, 1])"
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "train_data.label.unique()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "array(['Normal', 'Reconnaissance', 'Backdoor', 'DoS', 'Exploits',\n",
       "       'Analysis', 'Fuzzers', 'Worms', 'Shellcode', 'Generic'], dtype=object)"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "train_data.attack_cat.unique()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "array(['udp', 'arp', 'tcp', 'igmp', 'ospf', 'sctp', 'gre', 'ggp', 'ip',\n",
       "       'ipnip', 'st2', 'argus', 'chaos', 'egp', 'emcon', 'nvp', 'pup',\n",
       "       'xnet', 'mux', 'dcn', 'hmp', 'prm', 'trunk-1', 'trunk-2', 'xns-idp',\n",
       "       'leaf-1', 'leaf-2', 'irtp', 'rdp', 'netblt', 'mfe-nsp', 'merit-inp',\n",
       "       '3pc', 'idpr', 'ddp', 'idpr-cmtp', 'tp++', 'ipv6', 'sdrp',\n",
       "       'ipv6-frag', 'ipv6-route', 'idrp', 'mhrp', 'i-nlsp', 'rvd',\n",
       "       'mobile', 'narp', 'skip', 'tlsp', 'ipv6-no', 'any', 'ipv6-opts',\n",
       "       'cftp', 'sat-expak', 'ippc', 'kryptolan', 'sat-mon', 'cpnx', 'wsn',\n",
       "       'pvp', 'br-sat-mon', 'sun-nd', 'wb-mon', 'vmtp', 'ttp', 'vines',\n",
       "       'nsfnet-igp', 'dgp', 'eigrp', 'tcf', 'sprite-rpc', 'larp', 'mtp',\n",
       "       'ax.25', 'ipip', 'aes-sp3-d', 'micp', 'encap', 'pri-enc', 'gmtp',\n",
       "       'ifmp', 'pnni', 'qnx', 'scps', 'cbt', 'bbn-rcc', 'igp', 'bna',\n",
       "       'swipe', 'visa', 'ipcv', 'cphb', 'iso-tp4', 'wb-expak', 'sep',\n",
       "       'secure-vmtp', 'xtp', 'il', 'rsvp', 'unas', 'fc', 'iso-ip',\n",
       "       'etherip', 'pim', 'aris', 'a/n', 'ipcomp', 'snp', 'compaq-peer',\n",
       "       'ipx-n-ip', 'pgm', 'vrrp', 'l2tp', 'zero', 'ddx', 'iatp', 'stp',\n",
       "       'srp', 'uti', 'sm', 'smp', 'isis', 'ptp', 'fire', 'crtp', 'crudp',\n",
       "       'sccopmce', 'iplt', 'pipe', 'sps', 'ib'], dtype=object)"
      ]
     },
     "execution_count": 10,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "train_data.proto.unique()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "array(['-', 'http', 'ftp', 'ftp-data', 'smtp', 'pop3', 'dns', 'snmp',\n",
       "       'ssl', 'dhcp', 'irc', 'radius', 'ssh'], dtype=object)"
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "train_data.service.unique()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "array(['INT', 'FIN', 'REQ', 'ACC', 'CON', 'RST', 'CLO'], dtype=object)"
      ]
     },
     "execution_count": 12,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "train_data.state.unique()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "<class 'pandas.core.frame.DataFrame'>\n",
      "Int64Index: 82332 entries, 1 to 82332\n",
      "Data columns (total 44 columns):\n",
      "dur                  82332 non-null float64\n",
      "proto                82332 non-null object\n",
      "service              82332 non-null object\n",
      "state                82332 non-null object\n",
      "spkts                82332 non-null int64\n",
      "dpkts                82332 non-null int64\n",
      "sbytes               82332 non-null int64\n",
      "dbytes               82332 non-null int64\n",
      "rate                 82332 non-null float64\n",
      "sttl                 82332 non-null int64\n",
      "dttl                 82332 non-null int64\n",
      "sload                82332 non-null float64\n",
      "dload                82332 non-null float64\n",
      "sloss                82332 non-null int64\n",
      "dloss                82332 non-null int64\n",
      "sinpkt               82332 non-null float64\n",
      "dinpkt               82332 non-null float64\n",
      "sjit                 82332 non-null float64\n",
      "djit                 82332 non-null float64\n",
      "swin                 82332 non-null int64\n",
      "stcpb                82332 non-null int64\n",
      "dtcpb                82332 non-null int64\n",
      "dwin                 82332 non-null int64\n",
      "tcprtt               82332 non-null float64\n",
      "synack               82332 non-null float64\n",
      "ackdat               82332 non-null float64\n",
      "smean                82332 non-null int64\n",
      "dmean                82332 non-null int64\n",
      "trans_depth          82332 non-null int64\n",
      "response_body_len    82332 non-null int64\n",
      "ct_srv_src           82332 non-null int64\n",
      "ct_state_ttl         82332 non-null int64\n",
      "ct_dst_ltm           82332 non-null int64\n",
      "ct_src_dport_ltm     82332 non-null int64\n",
      "ct_dst_sport_ltm     82332 non-null int64\n",
      "ct_dst_src_ltm       82332 non-null int64\n",
      "is_ftp_login         82332 non-null int64\n",
      "ct_ftp_cmd           82332 non-null int64\n",
      "ct_flw_http_mthd     82332 non-null int64\n",
      "ct_src_ltm           82332 non-null int64\n",
      "ct_srv_dst           82332 non-null int64\n",
      "is_sm_ips_ports      82332 non-null int64\n",
      "attack_cat           82332 non-null object\n",
      "label                82332 non-null int64\n",
      "dtypes: float64(11), int64(29), object(4)\n",
      "memory usage: 30.8+ MB\n"
     ]
    }
   ],
   "source": [
    "train_data.info()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [],
   "source": [
    "from sklearn.preprocessing import LabelEncoder\n",
    "for col in ['proto','service','state','attack_cat']:\n",
    "    le = LabelEncoder()\n",
    "    train_data[col] = le.fit_transform(train_data[col])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style>\n",
       "    .dataframe thead tr:only-child th {\n",
       "        text-align: right;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: left;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>dur</th>\n",
       "      <th>proto</th>\n",
       "      <th>service</th>\n",
       "      <th>state</th>\n",
       "      <th>spkts</th>\n",
       "      <th>dpkts</th>\n",
       "      <th>sbytes</th>\n",
       "      <th>dbytes</th>\n",
       "      <th>rate</th>\n",
       "      <th>sttl</th>\n",
       "      <th>...</th>\n",
       "      <th>ct_dst_sport_ltm</th>\n",
       "      <th>ct_dst_src_ltm</th>\n",
       "      <th>is_ftp_login</th>\n",
       "      <th>ct_ftp_cmd</th>\n",
       "      <th>ct_flw_http_mthd</th>\n",
       "      <th>ct_src_ltm</th>\n",
       "      <th>ct_srv_dst</th>\n",
       "      <th>is_sm_ips_ports</th>\n",
       "      <th>attack_cat</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>id</th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>0.000011</td>\n",
       "      <td>117</td>\n",
       "      <td>0</td>\n",
       "      <td>4</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>496</td>\n",
       "      <td>0</td>\n",
       "      <td>90909.0902</td>\n",
       "      <td>254</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>6</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>0.000008</td>\n",
       "      <td>117</td>\n",
       "      <td>0</td>\n",
       "      <td>4</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>1762</td>\n",
       "      <td>0</td>\n",
       "      <td>125000.0003</td>\n",
       "      <td>254</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>6</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>0.000005</td>\n",
       "      <td>117</td>\n",
       "      <td>0</td>\n",
       "      <td>4</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>1068</td>\n",
       "      <td>0</td>\n",
       "      <td>200000.0051</td>\n",
       "      <td>254</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>3</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>3</td>\n",
       "      <td>0</td>\n",
       "      <td>6</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>0.000006</td>\n",
       "      <td>117</td>\n",
       "      <td>0</td>\n",
       "      <td>4</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>900</td>\n",
       "      <td>0</td>\n",
       "      <td>166666.6608</td>\n",
       "      <td>254</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>3</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2</td>\n",
       "      <td>3</td>\n",
       "      <td>0</td>\n",
       "      <td>6</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>0.000010</td>\n",
       "      <td>117</td>\n",
       "      <td>0</td>\n",
       "      <td>4</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>2126</td>\n",
       "      <td>0</td>\n",
       "      <td>100000.0025</td>\n",
       "      <td>254</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>3</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2</td>\n",
       "      <td>3</td>\n",
       "      <td>0</td>\n",
       "      <td>6</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 44 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "         dur  proto  service  state  spkts  dpkts  sbytes  dbytes  \\\n",
       "id                                                                  \n",
       "1   0.000011    117        0      4      2      0     496       0   \n",
       "2   0.000008    117        0      4      2      0    1762       0   \n",
       "3   0.000005    117        0      4      2      0    1068       0   \n",
       "4   0.000006    117        0      4      2      0     900       0   \n",
       "5   0.000010    117        0      4      2      0    2126       0   \n",
       "\n",
       "           rate  sttl  ...    ct_dst_sport_ltm  ct_dst_src_ltm  is_ftp_login  \\\n",
       "id                     ...                                                     \n",
       "1    90909.0902   254  ...                   1               2             0   \n",
       "2   125000.0003   254  ...                   1               2             0   \n",
       "3   200000.0051   254  ...                   1               3             0   \n",
       "4   166666.6608   254  ...                   1               3             0   \n",
       "5   100000.0025   254  ...                   1               3             0   \n",
       "\n",
       "    ct_ftp_cmd  ct_flw_http_mthd  ct_src_ltm  ct_srv_dst  is_sm_ips_ports  \\\n",
       "id                                                                          \n",
       "1            0                 0           1           2                0   \n",
       "2            0                 0           1           2                0   \n",
       "3            0                 0           1           3                0   \n",
       "4            0                 0           2           3                0   \n",
       "5            0                 0           2           3                0   \n",
       "\n",
       "    attack_cat  label  \n",
       "id                     \n",
       "1            6      0  \n",
       "2            6      0  \n",
       "3            6      0  \n",
       "4            6      0  \n",
       "5            6      0  \n",
       "\n",
       "[5 rows x 44 columns]"
      ]
     },
     "execution_count": 16,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "train_data.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "Index(['dur', 'proto', 'service', 'state', 'spkts', 'dpkts', 'sbytes',\n",
       "       'dbytes', 'rate', 'sttl', 'dttl', 'sload', 'dload', 'sloss', 'dloss',\n",
       "       'sinpkt', 'dinpkt', 'sjit', 'djit', 'swin', 'stcpb', 'dtcpb', 'dwin',\n",
       "       'tcprtt', 'synack', 'ackdat', 'smean', 'dmean', 'trans_depth',\n",
       "       'response_body_len', 'ct_srv_src', 'ct_state_ttl', 'ct_dst_ltm',\n",
       "       'ct_src_dport_ltm', 'ct_dst_sport_ltm', 'ct_dst_src_ltm',\n",
       "       'is_ftp_login', 'ct_ftp_cmd', 'ct_flw_http_mthd', 'ct_src_ltm',\n",
       "       'ct_srv_dst', 'is_sm_ips_ports', 'attack_cat', 'label'],\n",
       "      dtype='object')"
      ]
     },
     "execution_count": 17,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "train_data.columns"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "feature_data = train_data[['dur', 'proto', 'service', 'state', 'spkts', 'dpkts', 'sbytes',\n",
    "       'dbytes', 'rate', 'sttl', 'dttl', 'sload', 'dload', 'sloss', 'dloss',\n",
    "       'sinpkt', 'dinpkt', 'sjit', 'djit', 'swin', 'stcpb', 'dtcpb', 'dwin',\n",
    "       'tcprtt', 'synack', 'ackdat', 'smean', 'dmean', 'trans_depth',\n",
    "       'response_body_len', 'ct_srv_src', 'ct_state_ttl', 'ct_dst_ltm',\n",
    "       'ct_src_dport_ltm', 'ct_dst_sport_ltm', 'ct_dst_src_ltm',\n",
    "       'is_ftp_login', 'ct_ftp_cmd', 'ct_flw_http_mthd', 'ct_src_ltm',\n",
    "       'ct_srv_dst', 'is_sm_ips_ports']]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "42"
      ]
     },
     "execution_count": 20,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "len(feature_data.columns.tolist())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 40,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "def dnn_model(num_layers,layer_info):\n",
    "    tf.reset_default_graph()\n",
    "    \n",
    "    net = tflearn.input_data(shape=[None,42])\n",
    "    \n",
    "    for idx,layer in enumerate(range(1,num_layers+1)):\n",
    "        net = tflearn.fully_connected(net,layer_info[idx],activation='ReLU')\n",
    "    \n",
    "    net = tflearn.fully_connected(net,10, activation='softmax')\n",
    "    net = tflearn.regression(net, optimizer='sgd', learning_rate=0.01, loss='categorical_crossentropy')\n",
    "    \n",
    "    model = tflearn.DNN(net)\n",
    "    return model\n",
    "    "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 42,
   "metadata": {},
   "outputs": [],
   "source": [
    "model = dnn_model(2,[64,32])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "array([6, 6, 6, ..., 6, 6, 6])"
      ]
     },
     "execution_count": 24,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "train_data.attack_cat.values"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "from sklearn.preprocessing import OneHotEncoder"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [],
   "source": [
    "ohe = OneHotEncoder()\n",
    "trainY = ohe.fit_transform(train_data.attack_cat.values.reshape(-1,1))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "(82332, 10)"
      ]
     },
     "execution_count": 31,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "trainY.toarray().shape"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 35,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "(82332, 42)"
      ]
     },
     "execution_count": 35,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "feature_data.as_matrix().shape"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 43,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Training Step: 81599  | total loss: \u001b[1m\u001b[32m4.91889\u001b[0m\u001b[0m | time: 2.218s\n",
      "| SGD | epoch: 100 | loss: 4.91889 - acc: 0.5539 -- iter: 81500/81508\n",
      "Training Step: 81600  | total loss: \u001b[1m\u001b[32m4.91866\u001b[0m\u001b[0m | time: 3.232s\n",
      "| SGD | epoch: 100 | loss: 4.91866 - acc: 0.5565 | val_loss: 4.83316 - val_acc: 0.5728 -- iter: 81508/81508\n",
      "--\n"
     ]
    }
   ],
   "source": [
    "model.fit(feature_data.as_matrix(),trainY.toarray(),validation_set=0.01,show_metric=True, batch_size=100, n_epoch=100)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 44,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "model = dnn_model(3,[128,64,32])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 45,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Training Step: 81599  | total loss: \u001b[1m\u001b[32m5.17241\u001b[0m\u001b[0m | time: 3.367s\n",
      "| SGD | epoch: 100 | loss: 5.17241 - acc: 0.6129 -- iter: 81500/81508\n",
      "Training Step: 81600  | total loss: \u001b[1m\u001b[32m5.17646\u001b[0m\u001b[0m | time: 4.385s\n",
      "| SGD | epoch: 100 | loss: 5.17646 - acc: 0.6126 | val_loss: 5.12198 - val_acc: 0.6286 -- iter: 81508/81508\n",
      "--\n"
     ]
    }
   ],
   "source": [
    "model.fit(feature_data.as_matrix(),trainY.toarray(),validation_set=0.01,show_metric=True, batch_size=100, n_epoch=100)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 52,
   "metadata": {},
   "outputs": [],
   "source": [
    "from tflearn.layers.core import input_data, dropout, fully_connected\n",
    "from tflearn.layers.conv import conv_2d, max_pool_2d\n",
    "from tflearn.layers.normalization import local_response_normalization\n",
    "from tflearn.layers.estimator import regression\n",
    "\n",
    "# Building convolutional network\n",
    "network = input_data(shape=[None, 42,1,1], name='input')\n",
    "network = conv_2d(network, 32, 3, activation='relu', regularizer=\"L2\")\n",
    "network = max_pool_2d(network, 2)\n",
    "network = local_response_normalization(network)\n",
    "network = conv_2d(network, 64, 3, activation='relu', regularizer=\"L2\")\n",
    "network = max_pool_2d(network, 2)\n",
    "network = local_response_normalization(network)\n",
    "network = fully_connected(network, 128, activation='tanh')\n",
    "network = dropout(network, 0.8)\n",
    "network = fully_connected(network, 256, activation='tanh')\n",
    "network = dropout(network, 0.8)\n",
    "network = fully_connected(network, 10, activation='softmax')\n",
    "network = regression(network, optimizer='adam', learning_rate=0.01,\n",
    "                     loss='categorical_crossentropy', name='target')\n",
    "\n",
    "# Training\n",
    "model = tflearn.DNN(network)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "ename": "NameError",
     "evalue": "name 'feature_data' is not defined",
     "output_type": "error",
     "traceback": [
      "\u001b[0;31m---------------------------------------------------------------------------\u001b[0m",
      "\u001b[0;31mNameError\u001b[0m                                 Traceback (most recent call last)",
      "\u001b[0;32m<ipython-input-1-fc022cc4d921>\u001b[0m in \u001b[0;36m<module>\u001b[0;34m()\u001b[0m\n\u001b[1;32m      1\u001b[0m \u001b[0;32mimport\u001b[0m \u001b[0mnumpy\u001b[0m \u001b[0;32mas\u001b[0m \u001b[0mnp\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n\u001b[0;32m----> 2\u001b[0;31m \u001b[0mX\u001b[0m \u001b[0;34m=\u001b[0m \u001b[0mfeature_data\u001b[0m\u001b[0;34m.\u001b[0m\u001b[0mas_matrix\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0;34m)\u001b[0m\u001b[0;34m[\u001b[0m\u001b[0;34m:\u001b[0m\u001b[0;34m,\u001b[0m\u001b[0mnp\u001b[0m\u001b[0;34m.\u001b[0m\u001b[0mnewaxis\u001b[0m\u001b[0;34m]\u001b[0m\u001b[0;34m[\u001b[0m\u001b[0;34m:\u001b[0m\u001b[0;34m,\u001b[0m\u001b[0mnp\u001b[0m\u001b[0;34m.\u001b[0m\u001b[0mnewaxis\u001b[0m\u001b[0;34m]\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n\u001b[0m\u001b[1;32m      3\u001b[0m \u001b[0mY\u001b[0m \u001b[0;34m=\u001b[0m \u001b[0mtrainY\u001b[0m\u001b[0;34m.\u001b[0m\u001b[0mtoarray\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0;34m)\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n\u001b[1;32m      4\u001b[0m \u001b[0;31m# Training\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n\u001b[1;32m      5\u001b[0m \u001b[0mmodel\u001b[0m \u001b[0;34m=\u001b[0m \u001b[0mtflearn\u001b[0m\u001b[0;34m.\u001b[0m\u001b[0mDNN\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0mnetwork\u001b[0m\u001b[0;34m,\u001b[0m \u001b[0mtensorboard_verbose\u001b[0m\u001b[0;34m=\u001b[0m\u001b[0;36m0\u001b[0m\u001b[0;34m)\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n",
      "\u001b[0;31mNameError\u001b[0m: name 'feature_data' is not defined"
     ]
    }
   ],
   "source": [
    "import numpy as np\n",
    "X = feature_data.as_matrix()[:,np.newaxis][:,np.newaxis]\n",
    "Y = trainY.toarray()\n",
    "# Training\n",
    "model = tflearn.DNN(network, tensorboard_verbose=0)\n",
    "model.fit({'input': X}, {'target': Y}, validation_set=0.01,show_metric=True, batch_size=100, n_epoch=100)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.6.3"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}