Malware Detection Model.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "b482c128",
   "metadata": {},
   "outputs": [],
   "source": [
    "import os\n",
    "import pandas as pd\n",
    "import numpy as np\n",
    "import pickle\n",
    "# import pefile\n",
    "import sklearn.ensemble as ek\n",
    "from sklearn.model_selection import train_test_split\n",
    "from sklearn import tree, linear_model\n",
    "from sklearn.feature_selection import SelectFromModel\n",
    "import joblib\n",
    "from sklearn.naive_bayes import GaussianNB\n",
    "from sklearn.metrics import confusion_matrix\n",
    "from sklearn.pipeline import make_pipeline\n",
    "from sklearn import preprocessing\n",
    "from sklearn import svm\n",
    "from sklearn.linear_model import LinearRegression"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "ffe75d84",
   "metadata": {},
   "source": [
    "## PE Headers\n",
    "\n",
    "For the PE Headers extraction from the PE files(like exe, dll files) refer ***PE_Header(exe, dll files)/PE-Header.ipynb*** file"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "28031a8e",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Machine</th>\n",
       "      <th>SizeOfOptionalHeader</th>\n",
       "      <th>Characteristics</th>\n",
       "      <th>MajorLinkerVersion</th>\n",
       "      <th>MinorLinkerVersion</th>\n",
       "      <th>SizeOfCode</th>\n",
       "      <th>SizeOfInitializedData</th>\n",
       "      <th>SizeOfUninitializedData</th>\n",
       "      <th>AddressOfEntryPoint</th>\n",
       "      <th>BaseOfCode</th>\n",
       "      <th>BaseOfData</th>\n",
       "      <th>ImageBase</th>\n",
       "      <th>SectionAlignment</th>\n",
       "      <th>FileAlignment</th>\n",
       "      <th>MajorOperatingSystemVersion</th>\n",
       "      <th>legitimate</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>258</td>\n",
       "      <td>9</td>\n",
       "      <td>0</td>\n",
       "      <td>361984</td>\n",
       "      <td>115712</td>\n",
       "      <td>0</td>\n",
       "      <td>6135</td>\n",
       "      <td>4096</td>\n",
       "      <td>372736</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>3330</td>\n",
       "      <td>9</td>\n",
       "      <td>0</td>\n",
       "      <td>130560</td>\n",
       "      <td>19968</td>\n",
       "      <td>0</td>\n",
       "      <td>81778</td>\n",
       "      <td>4096</td>\n",
       "      <td>143360</td>\n",
       "      <td>771751936.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>5</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>3330</td>\n",
       "      <td>9</td>\n",
       "      <td>0</td>\n",
       "      <td>517120</td>\n",
       "      <td>621568</td>\n",
       "      <td>0</td>\n",
       "      <td>350896</td>\n",
       "      <td>4096</td>\n",
       "      <td>811008</td>\n",
       "      <td>771751936.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>5</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>258</td>\n",
       "      <td>9</td>\n",
       "      <td>0</td>\n",
       "      <td>585728</td>\n",
       "      <td>369152</td>\n",
       "      <td>0</td>\n",
       "      <td>451258</td>\n",
       "      <td>4096</td>\n",
       "      <td>798720</td>\n",
       "      <td>771751936.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>5</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>258</td>\n",
       "      <td>9</td>\n",
       "      <td>0</td>\n",
       "      <td>294912</td>\n",
       "      <td>247296</td>\n",
       "      <td>0</td>\n",
       "      <td>217381</td>\n",
       "      <td>4096</td>\n",
       "      <td>536576</td>\n",
       "      <td>771751936.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>5</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>138042</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>258</td>\n",
       "      <td>11</td>\n",
       "      <td>0</td>\n",
       "      <td>205824</td>\n",
       "      <td>223744</td>\n",
       "      <td>0</td>\n",
       "      <td>123291</td>\n",
       "      <td>4096</td>\n",
       "      <td>212992</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>5</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>138043</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>33167</td>\n",
       "      <td>2</td>\n",
       "      <td>25</td>\n",
       "      <td>37888</td>\n",
       "      <td>185344</td>\n",
       "      <td>0</td>\n",
       "      <td>40000</td>\n",
       "      <td>4096</td>\n",
       "      <td>45056</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>138044</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>258</td>\n",
       "      <td>10</td>\n",
       "      <td>0</td>\n",
       "      <td>118272</td>\n",
       "      <td>380416</td>\n",
       "      <td>0</td>\n",
       "      <td>59610</td>\n",
       "      <td>4096</td>\n",
       "      <td>122880</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>5</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>138045</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>33166</td>\n",
       "      <td>2</td>\n",
       "      <td>25</td>\n",
       "      <td>49152</td>\n",
       "      <td>16896</td>\n",
       "      <td>0</td>\n",
       "      <td>51216</td>\n",
       "      <td>4096</td>\n",
       "      <td>53248</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>138046</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>258</td>\n",
       "      <td>11</td>\n",
       "      <td>0</td>\n",
       "      <td>111616</td>\n",
       "      <td>468480</td>\n",
       "      <td>0</td>\n",
       "      <td>22731</td>\n",
       "      <td>4096</td>\n",
       "      <td>118784</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>5</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>138047 rows × 16 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "        Machine  SizeOfOptionalHeader  Characteristics  MajorLinkerVersion  \\\n",
       "0           332                   224              258                   9   \n",
       "1           332                   224             3330                   9   \n",
       "2           332                   224             3330                   9   \n",
       "3           332                   224              258                   9   \n",
       "4           332                   224              258                   9   \n",
       "...         ...                   ...              ...                 ...   \n",
       "138042      332                   224              258                  11   \n",
       "138043      332                   224            33167                   2   \n",
       "138044      332                   224              258                  10   \n",
       "138045      332                   224            33166                   2   \n",
       "138046      332                   224              258                  11   \n",
       "\n",
       "        MinorLinkerVersion  SizeOfCode  SizeOfInitializedData  \\\n",
       "0                        0      361984                 115712   \n",
       "1                        0      130560                  19968   \n",
       "2                        0      517120                 621568   \n",
       "3                        0      585728                 369152   \n",
       "4                        0      294912                 247296   \n",
       "...                    ...         ...                    ...   \n",
       "138042                   0      205824                 223744   \n",
       "138043                  25       37888                 185344   \n",
       "138044                   0      118272                 380416   \n",
       "138045                  25       49152                  16896   \n",
       "138046                   0      111616                 468480   \n",
       "\n",
       "        SizeOfUninitializedData  AddressOfEntryPoint  BaseOfCode  BaseOfData  \\\n",
       "0                             0                 6135        4096      372736   \n",
       "1                             0                81778        4096      143360   \n",
       "2                             0               350896        4096      811008   \n",
       "3                             0               451258        4096      798720   \n",
       "4                             0               217381        4096      536576   \n",
       "...                         ...                  ...         ...         ...   \n",
       "138042                        0               123291        4096      212992   \n",
       "138043                        0                40000        4096       45056   \n",
       "138044                        0                59610        4096      122880   \n",
       "138045                        0                51216        4096       53248   \n",
       "138046                        0                22731        4096      118784   \n",
       "\n",
       "          ImageBase  SectionAlignment  FileAlignment  \\\n",
       "0         4194304.0              4096            512   \n",
       "1       771751936.0              4096            512   \n",
       "2       771751936.0              4096            512   \n",
       "3       771751936.0              4096            512   \n",
       "4       771751936.0              4096            512   \n",
       "...             ...               ...            ...   \n",
       "138042    4194304.0              4096            512   \n",
       "138043    4194304.0              4096            512   \n",
       "138044    4194304.0              4096            512   \n",
       "138045    4194304.0              4096            512   \n",
       "138046    4194304.0              4096            512   \n",
       "\n",
       "        MajorOperatingSystemVersion  legitimate  \n",
       "0                                 0           1  \n",
       "1                                 5           1  \n",
       "2                                 5           1  \n",
       "3                                 5           1  \n",
       "4                                 5           1  \n",
       "...                             ...         ...  \n",
       "138042                            5           0  \n",
       "138043                            1           0  \n",
       "138044                            5           0  \n",
       "138045                            1           0  \n",
       "138046                            5           0  \n",
       "\n",
       "[138047 rows x 16 columns]"
      ]
     },
     "execution_count": 3,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Load the extracted PE Heaaders csv file from the PE files dataset.\n",
    "pe_df = pd.read_csv(r\".\\PE_Header(exe, dll files)\\final_pe_data.csv\")\n",
    "pe_df"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "c273d0ba",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "0    96724\n",
       "1    41323\n",
       "Name: legitimate, dtype: int64"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# lets check class balancedness for the 'legitimate' \n",
    "pe_df['legitimate'].value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "15ccad8d",
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "C:\\Users\\dasar\\AppData\\Local\\Temp\\ipykernel_47936\\3118573282.py:1: FutureWarning: The frame.append method is deprecated and will be removed from pandas in a future version. Use pandas.concat instead.\n",
      "  final_pe_df=pe_df[:20003].append(pe_df[116047:], ignore_index = True)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Machine</th>\n",
       "      <th>SizeOfOptionalHeader</th>\n",
       "      <th>Characteristics</th>\n",
       "      <th>MajorLinkerVersion</th>\n",
       "      <th>MinorLinkerVersion</th>\n",
       "      <th>SizeOfCode</th>\n",
       "      <th>SizeOfInitializedData</th>\n",
       "      <th>SizeOfUninitializedData</th>\n",
       "      <th>AddressOfEntryPoint</th>\n",
       "      <th>BaseOfCode</th>\n",
       "      <th>BaseOfData</th>\n",
       "      <th>ImageBase</th>\n",
       "      <th>SectionAlignment</th>\n",
       "      <th>FileAlignment</th>\n",
       "      <th>MajorOperatingSystemVersion</th>\n",
       "      <th>legitimate</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>258</td>\n",
       "      <td>9</td>\n",
       "      <td>0</td>\n",
       "      <td>361984</td>\n",
       "      <td>115712</td>\n",
       "      <td>0</td>\n",
       "      <td>6135</td>\n",
       "      <td>4096</td>\n",
       "      <td>372736</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>3330</td>\n",
       "      <td>9</td>\n",
       "      <td>0</td>\n",
       "      <td>130560</td>\n",
       "      <td>19968</td>\n",
       "      <td>0</td>\n",
       "      <td>81778</td>\n",
       "      <td>4096</td>\n",
       "      <td>143360</td>\n",
       "      <td>771751936.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>5</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>3330</td>\n",
       "      <td>9</td>\n",
       "      <td>0</td>\n",
       "      <td>517120</td>\n",
       "      <td>621568</td>\n",
       "      <td>0</td>\n",
       "      <td>350896</td>\n",
       "      <td>4096</td>\n",
       "      <td>811008</td>\n",
       "      <td>771751936.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>5</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>258</td>\n",
       "      <td>9</td>\n",
       "      <td>0</td>\n",
       "      <td>585728</td>\n",
       "      <td>369152</td>\n",
       "      <td>0</td>\n",
       "      <td>451258</td>\n",
       "      <td>4096</td>\n",
       "      <td>798720</td>\n",
       "      <td>771751936.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>5</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>258</td>\n",
       "      <td>9</td>\n",
       "      <td>0</td>\n",
       "      <td>294912</td>\n",
       "      <td>247296</td>\n",
       "      <td>0</td>\n",
       "      <td>217381</td>\n",
       "      <td>4096</td>\n",
       "      <td>536576</td>\n",
       "      <td>771751936.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>5</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>41998</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>258</td>\n",
       "      <td>11</td>\n",
       "      <td>0</td>\n",
       "      <td>205824</td>\n",
       "      <td>223744</td>\n",
       "      <td>0</td>\n",
       "      <td>123291</td>\n",
       "      <td>4096</td>\n",
       "      <td>212992</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>5</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>41999</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>33167</td>\n",
       "      <td>2</td>\n",
       "      <td>25</td>\n",
       "      <td>37888</td>\n",
       "      <td>185344</td>\n",
       "      <td>0</td>\n",
       "      <td>40000</td>\n",
       "      <td>4096</td>\n",
       "      <td>45056</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>42000</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>258</td>\n",
       "      <td>10</td>\n",
       "      <td>0</td>\n",
       "      <td>118272</td>\n",
       "      <td>380416</td>\n",
       "      <td>0</td>\n",
       "      <td>59610</td>\n",
       "      <td>4096</td>\n",
       "      <td>122880</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>5</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>42001</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>33166</td>\n",
       "      <td>2</td>\n",
       "      <td>25</td>\n",
       "      <td>49152</td>\n",
       "      <td>16896</td>\n",
       "      <td>0</td>\n",
       "      <td>51216</td>\n",
       "      <td>4096</td>\n",
       "      <td>53248</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>42002</th>\n",
       "      <td>332</td>\n",
       "      <td>224</td>\n",
       "      <td>258</td>\n",
       "      <td>11</td>\n",
       "      <td>0</td>\n",
       "      <td>111616</td>\n",
       "      <td>468480</td>\n",
       "      <td>0</td>\n",
       "      <td>22731</td>\n",
       "      <td>4096</td>\n",
       "      <td>118784</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096</td>\n",
       "      <td>512</td>\n",
       "      <td>5</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>42003 rows × 16 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "       Machine  SizeOfOptionalHeader  Characteristics  MajorLinkerVersion  \\\n",
       "0          332                   224              258                   9   \n",
       "1          332                   224             3330                   9   \n",
       "2          332                   224             3330                   9   \n",
       "3          332                   224              258                   9   \n",
       "4          332                   224              258                   9   \n",
       "...        ...                   ...              ...                 ...   \n",
       "41998      332                   224              258                  11   \n",
       "41999      332                   224            33167                   2   \n",
       "42000      332                   224              258                  10   \n",
       "42001      332                   224            33166                   2   \n",
       "42002      332                   224              258                  11   \n",
       "\n",
       "       MinorLinkerVersion  SizeOfCode  SizeOfInitializedData  \\\n",
       "0                       0      361984                 115712   \n",
       "1                       0      130560                  19968   \n",
       "2                       0      517120                 621568   \n",
       "3                       0      585728                 369152   \n",
       "4                       0      294912                 247296   \n",
       "...                   ...         ...                    ...   \n",
       "41998                   0      205824                 223744   \n",
       "41999                  25       37888                 185344   \n",
       "42000                   0      118272                 380416   \n",
       "42001                  25       49152                  16896   \n",
       "42002                   0      111616                 468480   \n",
       "\n",
       "       SizeOfUninitializedData  AddressOfEntryPoint  BaseOfCode  BaseOfData  \\\n",
       "0                            0                 6135        4096      372736   \n",
       "1                            0                81778        4096      143360   \n",
       "2                            0               350896        4096      811008   \n",
       "3                            0               451258        4096      798720   \n",
       "4                            0               217381        4096      536576   \n",
       "...                        ...                  ...         ...         ...   \n",
       "41998                        0               123291        4096      212992   \n",
       "41999                        0                40000        4096       45056   \n",
       "42000                        0                59610        4096      122880   \n",
       "42001                        0                51216        4096       53248   \n",
       "42002                        0                22731        4096      118784   \n",
       "\n",
       "         ImageBase  SectionAlignment  FileAlignment  \\\n",
       "0        4194304.0              4096            512   \n",
       "1      771751936.0              4096            512   \n",
       "2      771751936.0              4096            512   \n",
       "3      771751936.0              4096            512   \n",
       "4      771751936.0              4096            512   \n",
       "...            ...               ...            ...   \n",
       "41998    4194304.0              4096            512   \n",
       "41999    4194304.0              4096            512   \n",
       "42000    4194304.0              4096            512   \n",
       "42001    4194304.0              4096            512   \n",
       "42002    4194304.0              4096            512   \n",
       "\n",
       "       MajorOperatingSystemVersion  legitimate  \n",
       "0                                0           1  \n",
       "1                                5           1  \n",
       "2                                5           1  \n",
       "3                                5           1  \n",
       "4                                5           1  \n",
       "...                            ...         ...  \n",
       "41998                            5           0  \n",
       "41999                            1           0  \n",
       "42000                            5           0  \n",
       "42001                            1           0  \n",
       "42002                            5           0  \n",
       "\n",
       "[42003 rows x 16 columns]"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# From above csv file, load the part of the dataframe so that it is class balanced.\n",
    "# This way class bias can be managed, reduced with a balanced dataset. \n",
    "final_pe_df=pe_df[:20003].append(pe_df[116047:], ignore_index = True)\n",
    "final_pe_df.reset_index(drop = True, inplace = True )\n",
    "final_pe_df"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "7067509f",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "0    22000\n",
       "1    20003\n",
       "Name: legitimate, dtype: int64"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# check the value counts for all the labels of the 'legitimate' \n",
    "final_pe_df['legitimate'].value_counts()"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "f6e85a79",
   "metadata": {},
   "source": [
    "## N-Grams \n",
    "N-grams are extracted from byte files and asm files. All the extracted features from both file types are merged into a single csv file.\n",
    "  \n",
    "For N-Grams CSV file, all the features extracted are (opcodes are for asm files and bytes for bytes files)\n",
    "1. Byte unigrams\n",
    "2. Opcode unigrams\n",
    "3. Top 300 Byte bigrams\n",
    "4. Top 200 Opcode bigrams\n",
    "5. Top 200 Opcode trigrams\n",
    "6. Top 200 Opcode tetragrams\n",
    "7. Top 200 Image Pixels "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "id": "5ed90fd5",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>0</th>\n",
       "      <th>1</th>\n",
       "      <th>2</th>\n",
       "      <th>3</th>\n",
       "      <th>4</th>\n",
       "      <th>5</th>\n",
       "      <th>6</th>\n",
       "      <th>7</th>\n",
       "      <th>8</th>\n",
       "      <th>9</th>\n",
       "      <th>...</th>\n",
       "      <th>pix190</th>\n",
       "      <th>pix191</th>\n",
       "      <th>pix192</th>\n",
       "      <th>pix193</th>\n",
       "      <th>pix194</th>\n",
       "      <th>pix195</th>\n",
       "      <th>pix196</th>\n",
       "      <th>pix197</th>\n",
       "      <th>pix198</th>\n",
       "      <th>pix199</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>601905</td>\n",
       "      <td>3905</td>\n",
       "      <td>2816</td>\n",
       "      <td>3832</td>\n",
       "      <td>3345</td>\n",
       "      <td>3242</td>\n",
       "      <td>3650</td>\n",
       "      <td>3201</td>\n",
       "      <td>2965</td>\n",
       "      <td>3205</td>\n",
       "      <td>...</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>39755</td>\n",
       "      <td>8337</td>\n",
       "      <td>7249</td>\n",
       "      <td>7186</td>\n",
       "      <td>8663</td>\n",
       "      <td>6844</td>\n",
       "      <td>8420</td>\n",
       "      <td>7589</td>\n",
       "      <td>9291</td>\n",
       "      <td>358</td>\n",
       "      <td>...</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>93506</td>\n",
       "      <td>9542</td>\n",
       "      <td>2568</td>\n",
       "      <td>2438</td>\n",
       "      <td>8925</td>\n",
       "      <td>9330</td>\n",
       "      <td>9007</td>\n",
       "      <td>2342</td>\n",
       "      <td>9107</td>\n",
       "      <td>2457</td>\n",
       "      <td>...</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>21091</td>\n",
       "      <td>1213</td>\n",
       "      <td>726</td>\n",
       "      <td>817</td>\n",
       "      <td>1257</td>\n",
       "      <td>625</td>\n",
       "      <td>550</td>\n",
       "      <td>523</td>\n",
       "      <td>1078</td>\n",
       "      <td>473</td>\n",
       "      <td>...</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>19764</td>\n",
       "      <td>710</td>\n",
       "      <td>302</td>\n",
       "      <td>433</td>\n",
       "      <td>559</td>\n",
       "      <td>410</td>\n",
       "      <td>262</td>\n",
       "      <td>249</td>\n",
       "      <td>422</td>\n",
       "      <td>223</td>\n",
       "      <td>...</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>995</th>\n",
       "      <td>10736</td>\n",
       "      <td>5591</td>\n",
       "      <td>3305</td>\n",
       "      <td>3299</td>\n",
       "      <td>3303</td>\n",
       "      <td>3373</td>\n",
       "      <td>3368</td>\n",
       "      <td>3338</td>\n",
       "      <td>3253</td>\n",
       "      <td>3236</td>\n",
       "      <td>...</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>996</th>\n",
       "      <td>32359</td>\n",
       "      <td>1144</td>\n",
       "      <td>709</td>\n",
       "      <td>988</td>\n",
       "      <td>903</td>\n",
       "      <td>549</td>\n",
       "      <td>490</td>\n",
       "      <td>511</td>\n",
       "      <td>701</td>\n",
       "      <td>744</td>\n",
       "      <td>...</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>997</th>\n",
       "      <td>10411</td>\n",
       "      <td>5534</td>\n",
       "      <td>3196</td>\n",
       "      <td>3277</td>\n",
       "      <td>3103</td>\n",
       "      <td>3287</td>\n",
       "      <td>3251</td>\n",
       "      <td>3265</td>\n",
       "      <td>3200</td>\n",
       "      <td>3291</td>\n",
       "      <td>...</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>998</th>\n",
       "      <td>11304</td>\n",
       "      <td>5525</td>\n",
       "      <td>3272</td>\n",
       "      <td>3300</td>\n",
       "      <td>3243</td>\n",
       "      <td>3214</td>\n",
       "      <td>3236</td>\n",
       "      <td>3244</td>\n",
       "      <td>3172</td>\n",
       "      <td>3276</td>\n",
       "      <td>...</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>999</th>\n",
       "      <td>10501</td>\n",
       "      <td>5425</td>\n",
       "      <td>3258</td>\n",
       "      <td>3404</td>\n",
       "      <td>3331</td>\n",
       "      <td>3324</td>\n",
       "      <td>3198</td>\n",
       "      <td>3191</td>\n",
       "      <td>3291</td>\n",
       "      <td>3278</td>\n",
       "      <td>...</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "      <td>0.031638</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>1000 rows × 1508 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "          0     1     2     3     4     5     6     7     8     9  ...  \\\n",
       "0    601905  3905  2816  3832  3345  3242  3650  3201  2965  3205  ...   \n",
       "1     39755  8337  7249  7186  8663  6844  8420  7589  9291   358  ...   \n",
       "2     93506  9542  2568  2438  8925  9330  9007  2342  9107  2457  ...   \n",
       "3     21091  1213   726   817  1257   625   550   523  1078   473  ...   \n",
       "4     19764   710   302   433   559   410   262   249   422   223  ...   \n",
       "..      ...   ...   ...   ...   ...   ...   ...   ...   ...   ...  ...   \n",
       "995   10736  5591  3305  3299  3303  3373  3368  3338  3253  3236  ...   \n",
       "996   32359  1144   709   988   903   549   490   511   701   744  ...   \n",
       "997   10411  5534  3196  3277  3103  3287  3251  3265  3200  3291  ...   \n",
       "998   11304  5525  3272  3300  3243  3214  3236  3244  3172  3276  ...   \n",
       "999   10501  5425  3258  3404  3331  3324  3198  3191  3291  3278  ...   \n",
       "\n",
       "       pix190    pix191    pix192    pix193    pix194    pix195    pix196  \\\n",
       "0    0.031638  0.031638  0.031638  0.031638  0.031638  0.031638  0.031638   \n",
       "1    0.031638  0.031638  0.031638  0.031638  0.031638  0.031638  0.031638   \n",
       "2    0.031638  0.031638  0.031638  0.031638  0.031638  0.031638  0.031638   \n",
       "3    0.031638  0.031638  0.031638  0.031638  0.031638  0.031638  0.031638   \n",
       "4    0.031638  0.031638  0.031638  0.031638  0.031638  0.031638  0.031638   \n",
       "..        ...       ...       ...       ...       ...       ...       ...   \n",
       "995  0.031638  0.031638  0.031638  0.031638  0.031638  0.031638  0.031638   \n",
       "996  0.031638  0.031638  0.031638  0.031638  0.031638  0.031638  0.031638   \n",
       "997  0.031638  0.031638  0.031638  0.031638  0.031638  0.031638  0.031638   \n",
       "998  0.031638  0.031638  0.031638  0.031638  0.031638  0.031638  0.031638   \n",
       "999  0.031638  0.031638  0.031638  0.031638  0.031638  0.031638  0.031638   \n",
       "\n",
       "       pix197    pix198    pix199  \n",
       "0    0.031638  0.031638  0.031638  \n",
       "1    0.031638  0.031638  0.031638  \n",
       "2    0.031638  0.031638  0.031638  \n",
       "3    0.031638  0.031638  0.031638  \n",
       "4    0.031638  0.031638  0.031638  \n",
       "..        ...       ...       ...  \n",
       "995  0.031638  0.031638  0.031638  \n",
       "996  0.031638  0.031638  0.031638  \n",
       "997  0.031638  0.031638  0.031638  \n",
       "998  0.031638  0.031638  0.031638  \n",
       "999  0.031638  0.031638  0.031638  \n",
       "\n",
       "[1000 rows x 1508 columns]"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Load the Final N-Grams csv file created\n",
    "final_ngrams_df = pd.read_csv(r\".\\Ngrams(byte, asm files)\\final_data.csv\").drop(\"Unnamed: 0\",axis=1)\n",
    "final_ngrams_df"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "e90e87fd",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Rename the column name 'Malware' to 'legitimate' and its values accordingly\n",
    "final_ngrams_df.rename(columns = {'Malware':'legitimate'}, inplace = True)\n",
    "final_ngrams_df['legitimate'].replace({1:0,0:1}, inplace = True)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "5c3cbcd4",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "0      0\n",
       "1      0\n",
       "2      0\n",
       "3      0\n",
       "4      0\n",
       "      ..\n",
       "995    0\n",
       "996    0\n",
       "997    0\n",
       "998    0\n",
       "999    0\n",
       "Name: legitimate, Length: 1000, dtype: int64"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "final_ngrams_df['legitimate']"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "23d7eced",
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "id": "8e3bf4f3",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Merge both the N-grams and PE headers dataframes \n",
    "final_merged_df = pd.concat([final_ngrams_df, final_pe_df], axis=0)\n",
    "\n",
    "# Fill all the empty values with '0'\n",
    "final_merged_df = final_merged_df.fillna(0)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "e04b70fa",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>0</th>\n",
       "      <th>1</th>\n",
       "      <th>2</th>\n",
       "      <th>3</th>\n",
       "      <th>4</th>\n",
       "      <th>5</th>\n",
       "      <th>6</th>\n",
       "      <th>7</th>\n",
       "      <th>8</th>\n",
       "      <th>9</th>\n",
       "      <th>...</th>\n",
       "      <th>SizeOfCode</th>\n",
       "      <th>SizeOfInitializedData</th>\n",
       "      <th>SizeOfUninitializedData</th>\n",
       "      <th>AddressOfEntryPoint</th>\n",
       "      <th>BaseOfCode</th>\n",
       "      <th>BaseOfData</th>\n",
       "      <th>ImageBase</th>\n",
       "      <th>SectionAlignment</th>\n",
       "      <th>FileAlignment</th>\n",
       "      <th>MajorOperatingSystemVersion</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>601905.0</td>\n",
       "      <td>3905.0</td>\n",
       "      <td>2816.0</td>\n",
       "      <td>3832.0</td>\n",
       "      <td>3345.0</td>\n",
       "      <td>3242.0</td>\n",
       "      <td>3650.0</td>\n",
       "      <td>3201.0</td>\n",
       "      <td>2965.0</td>\n",
       "      <td>3205.0</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>39755.0</td>\n",
       "      <td>8337.0</td>\n",
       "      <td>7249.0</td>\n",
       "      <td>7186.0</td>\n",
       "      <td>8663.0</td>\n",
       "      <td>6844.0</td>\n",
       "      <td>8420.0</td>\n",
       "      <td>7589.0</td>\n",
       "      <td>9291.0</td>\n",
       "      <td>358.0</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>93506.0</td>\n",
       "      <td>9542.0</td>\n",
       "      <td>2568.0</td>\n",
       "      <td>2438.0</td>\n",
       "      <td>8925.0</td>\n",
       "      <td>9330.0</td>\n",
       "      <td>9007.0</td>\n",
       "      <td>2342.0</td>\n",
       "      <td>9107.0</td>\n",
       "      <td>2457.0</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>21091.0</td>\n",
       "      <td>1213.0</td>\n",
       "      <td>726.0</td>\n",
       "      <td>817.0</td>\n",
       "      <td>1257.0</td>\n",
       "      <td>625.0</td>\n",
       "      <td>550.0</td>\n",
       "      <td>523.0</td>\n",
       "      <td>1078.0</td>\n",
       "      <td>473.0</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>19764.0</td>\n",
       "      <td>710.0</td>\n",
       "      <td>302.0</td>\n",
       "      <td>433.0</td>\n",
       "      <td>559.0</td>\n",
       "      <td>410.0</td>\n",
       "      <td>262.0</td>\n",
       "      <td>249.0</td>\n",
       "      <td>422.0</td>\n",
       "      <td>223.0</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>42998</th>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>205824.0</td>\n",
       "      <td>223744.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>123291.0</td>\n",
       "      <td>4096.0</td>\n",
       "      <td>212992.0</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096.0</td>\n",
       "      <td>512.0</td>\n",
       "      <td>5.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>42999</th>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>37888.0</td>\n",
       "      <td>185344.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>40000.0</td>\n",
       "      <td>4096.0</td>\n",
       "      <td>45056.0</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096.0</td>\n",
       "      <td>512.0</td>\n",
       "      <td>1.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>43000</th>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>118272.0</td>\n",
       "      <td>380416.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>59610.0</td>\n",
       "      <td>4096.0</td>\n",
       "      <td>122880.0</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096.0</td>\n",
       "      <td>512.0</td>\n",
       "      <td>5.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>43001</th>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>49152.0</td>\n",
       "      <td>16896.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>51216.0</td>\n",
       "      <td>4096.0</td>\n",
       "      <td>53248.0</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096.0</td>\n",
       "      <td>512.0</td>\n",
       "      <td>1.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>43002</th>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>111616.0</td>\n",
       "      <td>468480.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>22731.0</td>\n",
       "      <td>4096.0</td>\n",
       "      <td>118784.0</td>\n",
       "      <td>4194304.0</td>\n",
       "      <td>4096.0</td>\n",
       "      <td>512.0</td>\n",
       "      <td>5.0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>43003 rows × 1523 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "              0       1       2       3       4       5       6       7  \\\n",
       "0      601905.0  3905.0  2816.0  3832.0  3345.0  3242.0  3650.0  3201.0   \n",
       "1       39755.0  8337.0  7249.0  7186.0  8663.0  6844.0  8420.0  7589.0   \n",
       "2       93506.0  9542.0  2568.0  2438.0  8925.0  9330.0  9007.0  2342.0   \n",
       "3       21091.0  1213.0   726.0   817.0  1257.0   625.0   550.0   523.0   \n",
       "4       19764.0   710.0   302.0   433.0   559.0   410.0   262.0   249.0   \n",
       "...         ...     ...     ...     ...     ...     ...     ...     ...   \n",
       "42998       0.0     0.0     0.0     0.0     0.0     0.0     0.0     0.0   \n",
       "42999       0.0     0.0     0.0     0.0     0.0     0.0     0.0     0.0   \n",
       "43000       0.0     0.0     0.0     0.0     0.0     0.0     0.0     0.0   \n",
       "43001       0.0     0.0     0.0     0.0     0.0     0.0     0.0     0.0   \n",
       "43002       0.0     0.0     0.0     0.0     0.0     0.0     0.0     0.0   \n",
       "\n",
       "            8       9  ...  SizeOfCode  SizeOfInitializedData  \\\n",
       "0      2965.0  3205.0  ...         0.0                    0.0   \n",
       "1      9291.0   358.0  ...         0.0                    0.0   \n",
       "2      9107.0  2457.0  ...         0.0                    0.0   \n",
       "3      1078.0   473.0  ...         0.0                    0.0   \n",
       "4       422.0   223.0  ...         0.0                    0.0   \n",
       "...       ...     ...  ...         ...                    ...   \n",
       "42998     0.0     0.0  ...    205824.0               223744.0   \n",
       "42999     0.0     0.0  ...     37888.0               185344.0   \n",
       "43000     0.0     0.0  ...    118272.0               380416.0   \n",
       "43001     0.0     0.0  ...     49152.0                16896.0   \n",
       "43002     0.0     0.0  ...    111616.0               468480.0   \n",
       "\n",
       "       SizeOfUninitializedData  AddressOfEntryPoint  BaseOfCode  BaseOfData  \\\n",
       "0                          0.0                  0.0         0.0         0.0   \n",
       "1                          0.0                  0.0         0.0         0.0   \n",
       "2                          0.0                  0.0         0.0         0.0   \n",
       "3                          0.0                  0.0         0.0         0.0   \n",
       "4                          0.0                  0.0         0.0         0.0   \n",
       "...                        ...                  ...         ...         ...   \n",
       "42998                      0.0             123291.0      4096.0    212992.0   \n",
       "42999                      0.0              40000.0      4096.0     45056.0   \n",
       "43000                      0.0              59610.0      4096.0    122880.0   \n",
       "43001                      0.0              51216.0      4096.0     53248.0   \n",
       "43002                      0.0              22731.0      4096.0    118784.0   \n",
       "\n",
       "       ImageBase  SectionAlignment  FileAlignment  MajorOperatingSystemVersion  \n",
       "0            0.0               0.0            0.0                          0.0  \n",
       "1            0.0               0.0            0.0                          0.0  \n",
       "2            0.0               0.0            0.0                          0.0  \n",
       "3            0.0               0.0            0.0                          0.0  \n",
       "4            0.0               0.0            0.0                          0.0  \n",
       "...          ...               ...            ...                          ...  \n",
       "42998  4194304.0            4096.0          512.0                          5.0  \n",
       "42999  4194304.0            4096.0          512.0                          1.0  \n",
       "43000  4194304.0            4096.0          512.0                          5.0  \n",
       "43001  4194304.0            4096.0          512.0                          1.0  \n",
       "43002  4194304.0            4096.0          512.0                          5.0  \n",
       "\n",
       "[43003 rows x 1523 columns]"
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "final_merged_df.reset_index(drop = True, inplace = True)\n",
    "final_merged_df"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "id": "8fe9bf72",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Save the dataframe into a csv file \n",
    "final_merged_df.to_csv(r'.\\finalData_Merged.csv', index = False)"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "742dfb4b",
   "metadata": {},
   "source": [
    "# Classification"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "id": "bcd5337b",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "array([[ 3.32761640e+01,  1.25532536e+00,  2.68716310e-01, ...,\n",
       "        -2.19844504e-01, -6.79794147e-01, -3.99111027e+00],\n",
       "       [ 2.12922075e+00,  2.75112802e+00,  7.36141544e-01, ...,\n",
       "        -2.19844504e-01, -6.79794147e-01, -3.99111027e+00],\n",
       "       [ 5.10739267e+00,  3.15781624e+00,  2.42566646e-01, ...,\n",
       "        -2.19844504e-01, -6.79794147e-01, -3.99111027e+00],\n",
       "       [ 1.09510789e+00,  3.46773747e-01,  4.83421295e-02, ...,\n",
       "        -2.19844504e-01, -6.79794147e-01, -3.99111027e+00],\n",
       "       [ 1.02158304e+00,  1.77010946e-01,  3.63464037e-03, ...,\n",
       "        -2.19844504e-01, -6.79794147e-01, -3.99111027e+00]])"
      ]
     },
     "execution_count": 13,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "from sklearn import preprocessing\n",
    "\n",
    "# drop the 'legitimate' column (the column values to predict) and assign them to labels\n",
    "X = final_merged_df.drop(['legitimate'],axis = 1).values\n",
    "labels = final_merged_df['legitimate'].values\n",
    "\n",
    "# Normalize the data\n",
    "X = preprocessing.StandardScaler().fit(X).transform(X)\n",
    "X[0:5]"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "210e515e",
   "metadata": {},
   "source": [
    "# Train Test Split"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "id": "1633a21c",
   "metadata": {},
   "outputs": [],
   "source": [
    "from sklearn.model_selection import train_test_split\n",
    "X_train, X_test, y_train, y_test = train_test_split( final_merged_df, labels, test_size=0.3, random_state=4)"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "14e9ea2c",
   "metadata": {},
   "source": [
    "# Random Forest"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "id": "6098f7b8",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "RandomForestClassifier(n_estimators=50)"
      ]
     },
     "execution_count": 15,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "from sklearn.ensemble import RandomForestClassifier\n",
    "RF_model = RandomForestClassifier(n_estimators=50)\n",
    "RF_model.fit(X_train,y_train)"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "06c77ef0",
   "metadata": {},
   "source": [
    "# K Nearest Neighbor(KNN)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "id": "d0708ff2",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Best k-value is:  1\n"
     ]
    }
   ],
   "source": [
    "from sklearn.neighbors import KNeighborsClassifier\n",
    "from sklearn import metrics\n",
    "Ks = 10\n",
    "mean_acc = np.zeros((Ks-1))\n",
    "std_acc  = np.zeros((Ks-1))\n",
    "\n",
    "for n in range(1,Ks):\n",
    "    \n",
    "    #Train Model and Predict  \n",
    "    neigh         = KNeighborsClassifier(n_neighbors = n).fit(X_train, y_train)\n",
    "    knn_yhat      = neigh.predict(X_test)\n",
    "    mean_acc[n-1] = metrics.accuracy_score(y_test, knn_yhat)\n",
    "\n",
    "    \n",
    "    std_acc[n-1]=np.std(knn_yhat == y_test)/np.sqrt(knn_yhat.shape[0])\n",
    "k = mean_acc.argmax()+1\n",
    "print(\"Best k-value is: \",k)\n",
    "KNN_model = KNeighborsClassifier(n_neighbors = k).fit(X_train,y_train)\n",
    "#knn_yhat  = KNN_model.predict(X_test)"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "e6462344",
   "metadata": {},
   "source": [
    "# Decision Tree"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "id": "585706be",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "DecisionTreeClassifier(criterion='entropy', max_depth=4)"
      ]
     },
     "execution_count": 17,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "from sklearn.tree import DecisionTreeClassifier\n",
    "DT_model = DecisionTreeClassifier(criterion=\"entropy\", max_depth = 4)\n",
    "DT_model.fit( X_train,y_train)"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "0f5ee57b",
   "metadata": {},
   "source": [
    "# SVM"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "id": "71bd38c5",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "SVC()"
      ]
     },
     "execution_count": 18,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "from sklearn import svm\n",
    "SVM_model = svm.SVC(kernel='rbf')\n",
    "SVM_model.fit(X_train, y_train)"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "0ca6fa76",
   "metadata": {},
   "source": [
    "# Logistic Regression"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "id": "fad47f92",
   "metadata": {},
   "outputs": [],
   "source": [
    "from sklearn.linear_model import LogisticRegression\n",
    "from sklearn.metrics import confusion_matrix\n",
    "LR_model = LogisticRegression(C=0.01, solver='liblinear').fit(X_train,y_train)"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "c31cab31",
   "metadata": {},
   "source": [
    "# Gradient Boosting"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "id": "58f1346a",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "GradientBoostingClassifier(n_estimators=50)"
      ]
     },
     "execution_count": 20,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "from sklearn.ensemble import GradientBoostingClassifier\n",
    "GB_model= GradientBoostingClassifier(n_estimators=50)\n",
    "GB_model.fit(X_train,y_train)"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "43d02640",
   "metadata": {},
   "source": [
    "# Model Evaluation Using Test Set"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "id": "ef8f3e03",
   "metadata": {},
   "outputs": [],
   "source": [
    "from sklearn.metrics import jaccard_score\n",
    "from sklearn.metrics import f1_score\n",
    "from sklearn.metrics import log_loss"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "id": "40fba0bb",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Random Forest Jaccard index: 0.999671\n",
      "Random Forest F1-score: 0.999845\n",
      "Accuracy of Random Forest classifier is: %.6f 0.999844973257887\n"
     ]
    }
   ],
   "source": [
    "RF_yhat = RF_model.predict(X_test)\n",
    "print(\"Random Forest Jaccard index: %.6f\" % jaccard_score(y_test, RF_yhat))\n",
    "print(\"Random Forest F1-score: %.6f\" % f1_score(y_test, RF_yhat, average='weighted') )\n",
    "print(\"Accuracy of Random Forest classifier is: %.6f\", RF_model.score(X_test,y_test)) "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "id": "76ed582d",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "KNN Jaccard index: 0.955809\n",
      "KNN F1-score: 0.978685\n",
      "Accuracy of KNN classifier is: %.6f 0.9786838229594605\n"
     ]
    }
   ],
   "source": [
    "knn_yhat = KNN_model.predict(X_test)\n",
    "print(\"KNN Jaccard index: %.6f\" % jaccard_score(y_test, knn_yhat))\n",
    "print(\"KNN F1-score: %.6f\" % f1_score(y_test, knn_yhat, average='weighted') )\n",
    "print(\"Accuracy of KNN classifier is: %.6f\", KNN_model.score(X_test, y_test)) "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "id": "d8508d9b",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "array([[6822,    2],\n",
       "       [   0, 6077]], dtype=int64)"
      ]
     },
     "execution_count": 24,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "from sklearn.metrics import confusion_matrix\n",
    "result= RF_model.predict(X_test)\n",
    "conf_mat= confusion_matrix(y_test,result)\n",
    "conf_mat"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "c494d6df",
   "metadata": {},
   "source": [
    "## Random Forest Gave the best results, 99.965120 Accuracy"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "id": "74e468f1",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "DT Jaccard index: 1.000000\n",
      "DT F1-score: 1.000000\n",
      "Accuracy of Decision Tree classifier is: %.6f 1.0\n",
      "SVM Jaccard index: 0.000000\n",
      "SVM F1-score: 0.365989\n",
      "Accuracy of SVM classifier is: %.6f 0.5289512440896055\n",
      "GB Jaccard index: 1.000000\n",
      "GB F1-score: 1.000000\n",
      "Accuracy of Gradient Boosting classifier is %.6f: 1.0\n",
      "LR Jaccard index: 0.482761\n",
      "LR F1-score: 0.353126\n",
      "LR LogLoss: 0.611195\n",
      "Accuracy of Logistic Regression classifier is: %.6f 0.4953104410510813\n"
     ]
    }
   ],
   "source": [
    "'''\n",
    "# Decision Tree\n",
    "DT_yhat = DT_model.predict(X_test)\n",
    "print(\"DT Jaccard index: %.6f\" % jaccard_score(y_test, DT_yhat))\n",
    "print(\"DT F1-score: %.6f\" % f1_score(y_test, DT_yhat, average='weighted') )\n",
    "print(\"Accuracy of Decision Tree classifier is: %.6f\", DT_model.score(X_test,y_test))\n",
    "\n",
    "# Gradient Boosting\n",
    "GB_yhat = GB_model.predict(X_test)\n",
    "print(\"GB Jaccard index: %.6f\" % jaccard_score(y_test, GB_yhat))\n",
    "print(\"GB F1-score: %.6f\" % f1_score(y_test, GB_yhat, average='weighted'))\n",
    "print(\"Accuracy of Gradient Boosting classifier is %.6f:\", GB_model.score(X_test,y_test))    \n",
    "\n",
    "# SVM\n",
    "SVM_yhat = SVM_model.predict(X_test)\n",
    "print(\"SVM Jaccard index: %.6f\" % jaccard_score(y_test, SVM_yhat))\n",
    "print(\"SVM F1-score: %.6f\" % f1_score(y_test, SVM_yhat, average='weighted'))\n",
    "print(\"Accuracy of SVM classifier is: %.6f\", SVM_model.score(X_test,y_test))  \n",
    "\n",
    "# Logistic Regression\n",
    "LR_yhat = LR_model.predict(X_test)\n",
    "LR_yhat_prob = LR_model.predict_proba(X_test)\n",
    "print(\"LR Jaccard index: %.6f\" % jaccard_score(y_test, LR_yhat))\n",
    "print(\"LR F1-score: %.6f\" % f1_score(y_test, LR_yhat, average='weighted') )\n",
    "print(\"LR LogLoss: %.6f\" % log_loss(y_test, LR_yhat_prob))\n",
    "print(\"Accuracy of Logistic Regression classifier is: %.6f\", LR_model.score(X_test,y_test)) \n",
    "'''"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 33,
   "id": "4697736c",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "SVM Jaccard index: 0.000000\n",
      "SVM F1-score: 0.365989\n",
      "Accuracy of SVM classifier is: %.6f 0.5289512440896055\n",
      "LR Jaccard index: 0.482761\n",
      "LR F1-score: 0.353126\n",
      "LR LogLoss: 0.611195\n",
      "Accuracy of Logistic Regression classifier is: %.6f 0.4953104410510813\n"
     ]
    }
   ],
   "source": [
    "# SVM\n",
    "SVM_yhat = SVM_model.predict(X_test)\n",
    "print(\"SVM Jaccard index: %.6f\" % jaccard_score(y_test, SVM_yhat))\n",
    "print(\"SVM F1-score: %.6f\" % f1_score(y_test, SVM_yhat, average='weighted'))\n",
    "print(\"Accuracy of SVM classifier is: %.6f\", SVM_model.score(X_test,y_test))  \n",
    "\n",
    "# Logistic Regression\n",
    "LR_yhat = LR_model.predict(X_test)\n",
    "LR_yhat_prob = LR_model.predict_proba(X_test)\n",
    "print(\"LR Jaccard index: %.6f\" % jaccard_score(y_test, LR_yhat))\n",
    "print(\"LR F1-score: %.6f\" % f1_score(y_test, LR_yhat, average='weighted') )\n",
    "print(\"LR LogLoss: %.6f\" % log_loss(y_test, LR_yhat_prob))\n",
    "print(\"Accuracy of Logistic Regression classifier is: %.6f\", LR_model.score(X_test,y_test)) "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 32,
   "id": "633e8440",
   "metadata": {},
   "outputs": [],
   "source": [
    "import joblib\n",
    "joblib.dump(RF_model, 'RF_model.pkl')\n",
    "joblib.dump(KNN_model, 'KNN_model.pkl')\n",
    "# joblib.dump(LR_model, 'LR_model.pkl')\n",
    "# joblib.dump(SVM_model, 'SVM_model.pkl')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "276493b8",
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "c2dc6191",
   "metadata": {},
   "outputs": [],
   "source": [
    "def evaluationMetrics(model, modelName):\n",
    "    yhat = model.predict(X_test)\n",
    "    print(f\"Evaluation Metrics For {modelName}: \")\n",
    "    print(\"Jaccard index: %.6f\" % jaccard_score(y_test, yhat))\n",
    "    print(\"F1-score: %.6f\" % f1_score(y_test, yhat, average='weighted'))\n",
    "    print(\"Accuracy: %.6f\\n\", SVM_model.score(X_test,y_test))\n",
    "\n",
    "import joblib\n",
    "def saveModel(model, modelName):\n",
    "    joblib.dump(model, f'{modelName}.pkl')"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.2"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}