MalwareDetection.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# 1. Introdution :\n",
    "\n",
    "A computer worm is a self-replicating malware that duplicates itself to spread to uninfected computers. Worms often use parts of an operating system that are automatic and invisible to the user[1]. Today, there is a proliferation of internet worms. In order to defend against this threat, many companies use  network intrusion detection systems(NIDS). NIDS typically detect worms by scanning packets to see whether specific byte sequences, known as signatures, match the signature of known attacks[2]. This approach means that a worm can not be detected until a signature is created. Therefore, it is difficult to detect new attacks. In this report, we propose a machine learning approach to detect worms in real-time.\n",
    "\n",
    "# 2. Related Work :\n",
    "\n",
    "In this section, we present a table listing the different research publications that attempt to solve the same problem. (see the accompanying file : MalwareDetection_LiteratureReview.xlsx).\n",
    "\n",
    "\n",
    "# 3. Description of the Dataset used :\n",
    "\n",
    "We have collected the CTU-13 dataset from [3], which was collected from the CTU University(Czech Republic, 2011) network. This dataset consists in thirteen captures (called scenarios) of different botnet samples. On each scenario, a specific malware was executed and the following features were extracted : Start Time, Duration, Protocole, Source IP address, Source Port, Direction,Destination IP address, Destination Port, State, SToS, DTos,Total Packets, Total Bytes, Source Bytes. We used 70% of the CTU-Malware-Capture-Botnet-50 (Scenario 9) dataset for training and 30% for testing.   \n",
    "\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "import pandas as pd\n",
    "from sklearn.model_selection import train_test_split\n",
    "\n",
    "dataFrame = pd.read_csv('CTU-Malware-Capture-Botnet-50_Scenario_9/capture20110817.csv')\n",
    "\n",
    "y = dataFrame['Label']\n",
    "\n",
    "listOfFeaturesToDrop = [\n",
    "\n",
    "\t\t'StartTime',\n",
    "\t\t'Dur',\n",
    "\t\t'Proto',\n",
    "\t\t'SrcAddr',\n",
    "\t\t'Sport',\n",
    "\t\t'DstAddr',\n",
    "\t\t'Dport',\n",
    "\t\t'State',\n",
    "\t\t'Label'\n",
    "\n",
    "\t]\n",
    "\n",
    "\t\n",
    "X = dataFrame.drop(listOfFeaturesToDrop, axis=1)  #create copy of dataframe\n",
    "\n",
    "X_train, X_test, y_train, y_test = train_test_split(X, y,test_size=0.3)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# 4. Libraries used:\n",
    "\n",
    "## 4.1 Pandas (0.23.4) : \n",
    "\n",
    "pandas is an open source, BSD-licensed library providing high-performance, easy-to-use data structures and data analysis tools for the Python programming language.[4]\n",
    "\n",
    "## 4.2 Numpy (1.15.4) :\n",
    "\n",
    "NumPy is the fundamental package for scientific computing with Python. It contains among other things: a powerful N-dimensional array object sophisticated (broadcasting) functions tools for integrating C/C++ and Fortran code\n",
    "useful linear algebra, Fourier transform, and random number capabilities. [5]\n",
    "\n",
    "## 4.3 Matplotlib (2.1.1) :\n",
    "\n",
    "Matplotlib is a Python 2D plotting library which produces publication quality figures in a variety of hardcopy formats and interactive environments across platforms. Matplotlib can be used in Python scripts, the Python and IPython shells, the Jupyter notebook, web application servers, and four graphical user interface toolkits. [6]\n",
    "\n",
    "## 4.4 Scikit-learn (0.20.0) :\n",
    "\n",
    "Scikit-learn (formerly scikits.learn) is a free software machine learning library for the Python programming language. It features various classification, regression and clustering algorithms including support vector machines, random forests, gradient boosting, k-means and DBSCAN, and is designed to interoperate with the Python numerical and scientific libraries NumPy and SciPy. [7]\n",
    "\n",
    "## 4.5 Scipy (1.1.0) : \n",
    "\n",
    "SciPy (pronounced “Sigh Pie”) is a Python-based ecosystem of open-source software for mathematics, science, and engineering. In particular, these are some of the core packages. [8]\n",
    "\n",
    "## 4.6 Imbalanced-learn (0.4.3) :\n",
    "\n",
    "Imbalanced-learn is a python package offering a number of re-sampling techniques commonly used in datasets showing strong between-class imbalance. It is compatible with scikit-learn and is part of scikit-learn-contrib projects. [9]\n",
    "    \n",
    "# 5. Model training : \n",
    "\n",
    "## 5.1 Data cleansing : \n",
    "\n",
    "In this part of the projet, we have first removed columns 'sTos', 'dTos' and 'Dir' from the dataset used (CTU-Malware-Capture-Botnet-50, Scenario 9 [3]). Then, we have removed any row which contained one or more NaN values. Next, we have removed any row which contained an incorrect source or destination port. Finally, we have converted the remaining columns to the appropriate types."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "def preprocessData(dataFrame):\n",
    "\n",
    "\t'''\n",
    "\tThis function is used to perform\n",
    "\tthe necessary operations to \n",
    "\tconvert the raw data into a\n",
    "\tclean data set.\n",
    "\n",
    "\t'''\n",
    "\n",
    "\n",
    "\tdp.deleteColumn(dataFrame,'sTos')\n",
    "\tdp.deleteColumn(dataFrame,'dTos')\n",
    "\tdp.deleteColumn(dataFrame,'Dir')\n",
    "\t\n",
    "\n",
    "\tdp.deleteNullRow(dataFrame,'Sport')\n",
    "\tdp.deleteNullRow(dataFrame,'Dport')\n",
    "\n",
    "\n",
    "\tdp.deleteRowWhere(dataFrame,'Sport','x')\n",
    "\tdp.deleteRowWhere(dataFrame,'Dport','x')\n",
    "\n",
    "\n",
    "\tdp.convertColumnToInt32(dataFrame,'Sport')\n",
    "\tdp.convertColumnToInt32(dataFrame,'Dport')\n",
    "\n",
    "\n",
    "\tdp.convertColumnToTimeStamp(dataFrame,'StartTime')\n",
    "\n",
    "\tdp.convertColumnToFloat16(dataFrame,'Dur')\n",
    "\tdp.convertColumnToInt16(dataFrame,'TotPkts')\n",
    "\n",
    "\t\n",
    "\tdp.replaceColumn(dataFrame,'Label')\n",
    "\n",
    "\t\n",
    "\treturn dataFrame"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## 5.2 Data discretization : \n",
    "\n",
    "In this part, we have added to the dataset columns 'Sport_Dis', 'Dport_Dis', 'Proto_Dis' and'State_Dis'. The first two columns are used to partition columns 'Sport' and 'Dport' values to nominal intervals (0-1023(WELLKNOWN_PORTNUMBER),1024-49151(REGISTERED_PORTNUMBER),49152-65535(DYNAMIC_PORTNUMBER)) and the two other ones are used to convert columns 'Proto' and 'State' values to nominal values."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "def discretizeData(dataFrame):\n",
    "\n",
    "\t'''\n",
    "\t\tThis function is used to perform\n",
    "\t\tthe necessary operations to \n",
    "\t\treduce the number of values in \n",
    "\t\tthe data set.\n",
    "\n",
    "\t'''\n",
    "\n",
    "\tdd.bucketingPortNumber(dataFrame,'Sport_Dis','Sport')\n",
    "\tdd.bucketingPortNumber(dataFrame,'Dport_Dis','Dport')\n",
    "\n",
    "\tdd.labelEncoder8(dataFrame,'Proto_Dis','Proto')\n",
    "\tdd.labelEncoder16(dataFrame,'State_Dis','State')\n",
    "\n",
    "\treturn dataFrame"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## 5.3 Feature Generation : \n",
    "\n",
    "Based on the requirements document, we have generated the following features :\n",
    "\n",
    "## 5.3.1 Connection-based features : \n",
    "\n",
    "(Using a rolling window for the previous n netflows when a given source or destination address appears in the traffic)\n",
    "\n",
    "- For any of the flow records that SRCADDRESS has appeared within the last n flow records, average the bytes (A_TotBytes_S)\n",
    "- For any of the flow records that SRCADDRESS has appeared within the last n flow records, average the packets (A_TotPkts_S)\n",
    "- Number of apperance of SRCADDRESS in the last n/10 netflows (Nbr_App_S)\n",
    "- For any of the flow records that SRCADDRESS has appeared within the last n flow records, count the distinct source ports (Dct_Sport_S)\n",
    "- For any of the flow records that SRCADDRESS has appeared within the last n flow records, count the distinct destination ports (Dct_Dport_S)\n",
    "- For any of the flow records that SRCADDRESS has appeared within the last n flow records, count the distinct source ips (Dct_SrcAddr_S)\n",
    "\n",
    "\n",
    "\n",
    "- For any of the flow records that DSTADDRESS has appeared within the last n flow records, average the bytes (A_TotBytes_D)\n",
    "- For any of the flow records that DSTADDRESS has appeared within the last n flow records, average the packets (A_TotPkts_D)\n",
    "- Number of apperance of DSTADDRESS in the last n/10 netflows (Nbr_App_D)\n",
    "- For any of the flow records that DSTADDRESS has appeared within the last n flow records, count the distinct source ports (Dct_Sport_D)\n",
    "- For any of the flow records that DSTADDRESS has appeared within the last n flow records, count the distinct destination ports (Dct_Dport_D)\n",
    "- For any of the flow records that DSTADDRESS has appeared within the last n flow records, count the distinct destination ips (Dct_DstAddr_D)\n",
    "\n",
    "\n",
    "## 5.3.2 Time-based features : \n",
    "\n",
    "(Using a rolling window for the n previous minutes when a given source or destination address appears in the traffic). \n",
    "\n",
    "\n",
    "- For any of the flow records that SRCADDRESS has appeared within the last n minutes, average the bytes (A_TotBytes_S)\n",
    "- For any of the flow records that SRCADDRESS has appeared within the last n minutes, average the packets (A_TotPkts_S)\n",
    "- For any of the flow records that SRCADDRESS has appeared within the last n minutes, count the distinct source ports (Dct_Sport_S)\n",
    "- For any of the flow records that SRCADDRESS has appeared within the last n minutes, count the distinct source ips (Dct_SrcAddr_S)\n",
    "- Number of apperance of SRCADDRESS  within the last n/10 minutes (Nbr_App_S)\n",
    "\n",
    "\n",
    "\n",
    "- For any of the flow records that DSTADDRESS has appeared within the last n minutes, average the bytes (A_TotBytes_D)\n",
    "- For any of the flow records that DSTADDRESS has appeared within the last n minutes, average the packets (A_TotPkts_D)\n",
    "- For any of the flow records that DSTADDRESS has appeared within the last n minutes, count the distinct source ports (Dct_Sport_D)\n",
    "- For any of the flow records that DSTADDRESS has appeared within the last n minutes, count the distinct destination ips (Dct_DstAddr_D)\n",
    "- Number of apperance of DSTADDRESS  within the last n/10 minutes (Nbr_App_D)\n",
    "\n",
    "\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "def generateSrcAddrFeaturesConnectionBased(dataFrame, srcAddr, windowSize):\n",
    "\n",
    "    '''\n",
    "\n",
    "        this function is used to generate connection-based features using\n",
    "        the given source ip address and window size\n",
    "\n",
    "\n",
    "    '''\n",
    "\n",
    "    srcAddr_dis = dd.labelEncoder32(dataFrame,srcAddr,'SrcAddr_Dis','SrcAddr')\n",
    "\n",
    "    #print(\"DIS (SrcAddr) : \", srcAddr_dis)\n",
    "\n",
    "    dataFrame['A_TotBytes_S'] = dataFrame['TotBytes'].rolling(windowSize).mean()     #Average TotBytes\n",
    "    dataFrame['A_SrcBytes_S'] = dataFrame['SrcBytes'].rolling(windowSize).mean()     #Average SrcBytes\n",
    "    dataFrame['A_TotPkts_S'] = dataFrame['TotPkts'].rolling(windowSize).mean()       #Average TotPkts\n",
    "\n",
    "\n",
    "    dataFrame['Dct_Sport_S'] = dataFrame['Sport'].rolling(windowSize).apply(lambda x: len(np.unique(x)), raw = False) #Disctinct Source ports\n",
    "    dataFrame['Dct_Dport_S'] = dataFrame['Dport'].rolling(windowSize).apply(lambda x: len(np.unique(x)), raw = False) #Disctinct Destination ports\n",
    "\n",
    "    dataFrame['Dct_SrcAddr_S'] = dataFrame['SrcAddr_Dis'].rolling(windowSize).apply(lambda x: len(np.unique(x)), raw = False) #Disctinct SrcAddr\n",
    "\n",
    "\n",
    "    dataFrame['Nbr_App_S'] = dataFrame['SrcAddr_Dis'].rolling((windowSize//10)).apply(lambda x: np.count_nonzero(np.where(x == srcAddr_dis)), raw = False) #number of apperance of SrcAddr in (windowSize/10) netflows\n",
    "\n",
    "\n",
    "    dp.deleteNullRow(dataFrame,'A_TotBytes_S')\n",
    "\n",
    "\n",
    "    #print(dataFrame.shape[0])\n",
    "\n",
    "    return dataFrame\n",
    "\n",
    "\n",
    "def generateDstAddrFeaturesConnectionBased(dataFrame,dstAddr, windowSize):\n",
    "\n",
    "    '''\n",
    "\n",
    "        this function is used to generate connection-based features using\n",
    "        the given destination ip address and window size\n",
    "\n",
    "\n",
    "    '''\n",
    "\n",
    "\n",
    "\n",
    "    dstAddr_dis = dd.labelEncoder32(dataFrame,dstAddr,'DstAddr_Dis','DstAddr')\n",
    "\n",
    "    #print(\"DIS (DstAddr) : \", dstAddr_dis)\n",
    "\n",
    "    dataFrame['A_TotBytes_D'] = dataFrame['TotBytes'].rolling(windowSize).mean()\n",
    "    dataFrame['A_SrcBytes_D'] = dataFrame['SrcBytes'].rolling(windowSize).mean()\n",
    "    dataFrame['A_TotPkts_D'] =  dataFrame['TotPkts'].rolling(windowSize).mean()\n",
    "\n",
    "\n",
    "    dataFrame['Dct_Sport_D'] = dataFrame['Sport'].rolling(windowSize).apply(lambda x: len(np.unique(x)), raw = False)\n",
    "    dataFrame['Dct_Dport_D'] = dataFrame['Dport'].rolling(windowSize).apply(lambda x: len(np.unique(x)), raw = False)\n",
    "\n",
    "    dataFrame['Dct_DstAddr_D'] = dataFrame['DstAddr_Dis'].rolling(windowSize).apply(lambda x: len(np.unique(x)), raw = False)\n",
    "\n",
    "    dataFrame['Nbr_App_D'] = dataFrame['DstAddr_Dis'].rolling((windowSize//10)).apply(lambda x: np.count_nonzero(np.where(x == dstAddr_dis)), raw = False)\n",
    "\n",
    "\n",
    "    dp.deleteNullRow(dataFrame,'A_TotBytes_D')\n",
    "\n",
    "\n",
    "   # print(dataFrame.shape[0])\n",
    "\n",
    "    return dataFrame\n",
    "\n",
    "\n",
    "\n",
    "def generateSrcAddrFeaturesTimeBased(dataFrame, srcAddr, time):\n",
    "\n",
    "\n",
    "    '''\n",
    "\n",
    "        this function is used to generate time-based features using\n",
    "        the given source ip address and time\n",
    "\n",
    "\n",
    "    '''\n",
    "\n",
    "\n",
    "\n",
    "    time = time * 60  #convert to minutes\n",
    "    time = str(time) + 's'\n",
    "\n",
    "    dataFrame['timeStampIndex'] = pd.to_datetime(dataFrame['StartTime'])   #used to create the rolling window based on minutes\n",
    "\n",
    "    dataFrame.set_index('timeStampIndex', inplace=True)\n",
    "\n",
    "    srcAddr_dis = dd.labelEncoder32(dataFrame,srcAddr,'SrcAddr_Dis','SrcAddr')\n",
    "\n",
    "    #print(\"DIS (SrcAddr) : \", srcAddr_dis)\n",
    "\n",
    "\n",
    "    dataFrame['A_TotBytes_S'] = dataFrame['TotBytes'].rolling(time).mean()\n",
    "    dataFrame['A_SrcBytes_S'] = dataFrame['SrcBytes'].rolling(time).mean()\n",
    "    dataFrame['A_TotPkts_S'] =  dataFrame['TotPkts'].rolling(time).mean()\n",
    "\n",
    "\n",
    "    dataFrame['Dct_Sport_S'] = dataFrame['Sport'].rolling(time).apply(lambda x: len(np.unique(x)), raw = False)\n",
    "    #dataFrame['Distinct_Dport (DstAddr)'] = dataFrame['Dport'].rolling(time).apply(lambda x: len(np.unique(x)), raw = False) #Not listed in the specification document\n",
    "\n",
    "    dataFrame['Dct_SrcAddr_S'] = dataFrame['SrcAddr_Dis'].rolling(time).apply(lambda x: len(np.unique(x)), raw = False)\n",
    "\n",
    "\n",
    "    dataFrame['Nbr_App_S'] = dataFrame['SrcAddr_Dis'].rolling(time).apply(lambda x: np.count_nonzero(np.where(x == srcAddr_dis)), raw = False)\n",
    "\n",
    "\n",
    "    dP.deleteNullRow(dataFrame,'A_TotBytes_S')\n",
    "\n",
    "\n",
    "    #print(dataFrame.shape[0])\n",
    "\n",
    "    return dataFrame\n",
    "\n",
    "\n",
    "\n",
    "def generateDstAddrFeaturesTimeBased(dataFrame, srcAddr, time):\n",
    "\n",
    "\n",
    "    '''\n",
    "\n",
    "        this function is used to generate time-based features using\n",
    "        the given destination ip address and time\n",
    "\n",
    "\n",
    "    '''\n",
    "\n",
    "\n",
    "\n",
    "    time = time * 60  #convert to minutes\n",
    "    time = str(time) + 's'\n",
    "\n",
    "    dataFrame['timeStampIndex'] = pd.to_datetime(dataFrame['StartTime'])   #used to create the rolling window based on minutes\n",
    "\n",
    "    dataFrame.set_index('timeStampIndex', inplace=True)\n",
    "\n",
    "    dstAddr_dis = dd.labelEncoder32(dataFrame,dstAddr,'DstAddr_Dis','DstAddr')\n",
    "\n",
    "\n",
    "    dataFrame['A_TotBytes_D'] = dataFrame['TotBytes'].rolling(time).mean()\n",
    "    dataFrame['A_SrcBytes_D'] = dataFrame['SrcBytes'].rolling(time).mean()\n",
    "    dataFrame['A_TotPkts_D'] =  dataFrame['TotPkts'].rolling(time).mean()\n",
    "\n",
    "\n",
    "    dataFrame['Dct_Sport_D'] = dataFrame['Sport'].rolling(time).apply(lambda x: len(np.unique(x)), raw = False)\n",
    "    #dataFrame['Distinct_Dport (DstAddr)'] = dataFrame['Dport'].rolling(time).apply(lambda x: len(np.unique(x)), raw = False) #Not listed in the specification document\n",
    "\n",
    "    dataFrame['Dct_DstAddr_D'] = dataFrame['DstAddr_Dis'].rolling(time).apply(lambda x: len(np.unique(x)), raw = False)\n",
    "\n",
    "\n",
    "    dataFrame['Nbr_App_D'] = dataFrame['DstAddr_Dis'].rolling(time).apply(lambda x: np.count_nonzero(np.where(x == srcAddr_dis)), raw = False)\n",
    "\n",
    "\n",
    "    dP.deleteNullRow(dataFrame,'A_TotBytes_D')\n",
    "\n",
    "\n",
    "    #print(dataFrame.shape[0])\n",
    "\n",
    "    return dataFrame\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## 5.4 Model execution and results : \n",
    "\n",
    "#### Gradient boosting :\n",
    "Gradient boosting is a machine learning technique for regression and classification problems, which produces a prediction model in the form of an ensemble of weak prediction models, typically decision trees. It builds the model in a stage-wise fashion like other boosting methods do, and it generalizes them by allowing optimization of an arbitrary differentiable loss function. [10]\n",
    "\n",
    "\n",
    "For our expirement, we used the gradient boosting classifier to create the model and the results are shown in table 1 and 2.\n",
    "\n",
    "- table 1 : Accuracy rate, Detection rate and True Positive (Without Oversampling) \n",
    "\n",
    "Accuracy of the GBM on test set (Without Oversampling): 0.985\n",
    "              precision    recall  f1-score   support\n",
    "\n",
    "           0       0.99      1.00      0.99     71041\n",
    "           1       0.83      0.37      0.51      1524\n",
    "\n",
    "   micro avg       0.99      0.99      0.99     72565\n",
    "   macro avg       0.91      0.68      0.75     72565\n",
    "weighted avg       0.98      0.99      0.98     72565\n",
    "\n",
    "\n",
    "\n",
    "- table 2 : Accuracy rate, Detection rate and True Positive (Oversampling)\n",
    "\n",
    "Accuracy of the GBM on test set (Over Sampling): 0.924\n",
    "              precision    recall  f1-score   support\n",
    "\n",
    "           0       1.00      0.92      0.96     71094\n",
    "           1       0.20      0.94      0.33      1471\n",
    "\n",
    "   micro avg       0.92      0.92      0.92     72565\n",
    "   macro avg       0.60      0.93      0.65     72565\n",
    "weighted avg       0.98      0.92      0.95     72565\n",
    "\n",
    "\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "def createModel(dataFrame):\n",
    "\t\n",
    "\t'''\n",
    "\t\tThis function is used to create \n",
    "\t\ta machine learning model using \n",
    "\t\tthe gradient boost classifier\n",
    "\n",
    "\t'''\n",
    "\t\n",
    "\ty = dataFrame['Label']\n",
    "\n",
    "\tlistOfFeaturesToDrop = [\n",
    "\n",
    "\t\t\t'StartTime',\n",
    "\t\t\t'Dur',\n",
    "\t\t\t'Proto',\n",
    "\t\t\t'SrcAddr',\n",
    "\t\t\t'SrcAddr_Dis',\n",
    "\t\t\t'Sport',\n",
    "\t\t\t'DstAddr',\n",
    "\t\t\t'DstAddr_Dis',\n",
    "\t\t\t'Dport',\n",
    "\t\t\t'State',\n",
    "\t\t\t'Label'\n",
    "\n",
    "\t\t]\n",
    "\n",
    "\t\n",
    "\tX = dataFrame.drop(listOfFeaturesToDrop, axis=1)  #create copy of dataframe\n",
    "\n",
    "\tX_train, X_test, y_train, y_test = train_test_split(X, y,test_size=0.3)\n",
    "\n",
    "\tsm = SMOTE(random_state=12, ratio = 1.0)\n",
    "\n",
    "\tX_train_res, y_train_res = sm.fit_sample(X_train, y_train)\n",
    "\n",
    "\tmodel = GradientBoostingClassifier()\n",
    "\n",
    "\tmodel.fit(X_train_res, y_train_res)\n",
    "\n",
    "\n",
    "\tsaveModel(model, 'trainedModel.sav')  \n",
    "\n",
    "\n",
    "\tpredictors=list(X_train)\n",
    "\n",
    "\n",
    "\tprint('Accuracy of the GBM on test set (Over Sampling): {:.3f}'.format(model.score(X_test, y_test)))\n",
    "\tpred=model.predict(X_test)\n",
    "\tprint(classification_report(y_test, pred))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## 6. Conclusion and Future Work :\n",
    "\n",
    "Machine learning techniques show promising results in the worm detection problem. In this experiment, our model consisted of preprocessing, feature engineering and classification techniques. We have investigated the optimal configuration for the gradient boosting technique and demonstrated that tuning certain parameters greatly affects the classifier performance. Our next experiment will consist of using a classifier other than the gradient boosting and comparing the results with the ones we have now.  \n",
    "\n",
    "## 7. References :\n",
    "\n",
    "[1] What is computer worm? - Definition from WhatIs.com. (n.d.). Retrieved from https://searchsecurity.techtarget.com/definition/worm\n",
    "[2] O. Sharma, M. Girolami, and J. Sventek, “Detecting worm variants using machine\n",
    "learning,” in Proc. ACM CoNEXT Conf., New York, NY, USA: ACM, Dec. 2007, pp.\n",
    "1–12.\n",
    "[3] García, S.; Grill, M.; Stiborek, J.; Zunino, A. An Empirical Comparison of Botnet Detection\n",
    "Methods. Comput. Secur. 2014, 45, 100–123.\n",
    "[4] Python Data Analysis Library. (n.d.). Retrieved from https://pandas.pydata.org/\n",
    "[5] NumPy. (n.d.). Retrieved from http://www.numpy.org/\n",
    "[6] Matplotlib. (n.d.). Retrieved from https://matplotlib.org/\n",
    "[7] Scikit-learn. (n.d.). Retrieved from https://scikit-learn.org/stable/\n",
    "[8] SciPy.org. (n.d.). Retrieved from https://www.scipy.org/\n",
    "[9] Imbalanced-learn. (n.d.). Retrieved from https://pypi.org/project/imbalanced-learn/\n",
    "[10] Grover, P. (2017, December 09). Gradient Boosting from scratch – ML Review – Medium. Retrieved from https://medium.com/mlreview/gradient-boosting-from-scratch-1e317ae4587d\n",
    "[11] Siddiqui, M., Wang, M.C. and Lee, J. (2009) Detecting Internet Worms Using Data Mining Techniques. Journal of\n",
    "Systemics, Cybernetics and Informatics, 6, 48-53.\n",
    "[12] S. Yang, J. P. Song, H. Rajamani, T. W. Cho, Y. Zhang, and R. Mooney, “Fast and\n",
    "effective worm fingerprinting via machine learning,” in Proc. of the 3rd IEEE\n",
    "International Conference on Autonomic Computing (ICAC), Dublin, Ireland, Jun. 2006. \n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.6.6"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}