Anomal_E_cicids2017.ipynb

{
  "cells": [
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "Hjc3iIihKLn-"
      },
      "outputs": [],
      "source": [
        "import pandas as pd\n",
        "import numpy as np\n",
        "import torch\n",
        "from sklearn import preprocessing\n",
        "from dgl.data import DGLDataset\n",
        "import dgl\n",
        "import time\n",
        "import networkx as nx\n",
        "import category_encoders as ce\n",
        "import torch.nn as nn\n",
        "import torch.nn.functional as F\n",
        "import dgl.function as fn\n",
        "import torch\n",
        "import tqdm\n",
        "import math\n",
        "\n",
        "from typing import *\n",
        "from sklearn.preprocessing import StandardScaler, Normalizer\n",
        "import socket\n",
        "import struct\n",
        "import random\n",
        "from sklearn.model_selection import train_test_split"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "SvWHb_BpKsLq"
      },
      "outputs": [],
      "source": [
        "file_name = \"NF-CSE-CIC-IDS2018-v2.csv\"\n",
        "data = pd.read_csv(file_name)"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/",
          "height": 488
        },
        "id": "fqly1y-LMwYS",
        "outputId": "18cca6c8-8a93-46c4-ffa1-9d21ebe843b0"
      },
      "outputs": [
        {
          "data": {
            "text/plain": [
              "0    16635567\n",
              "1     2258141\n",
              "Name: Label, dtype: int64"
            ]
          },
          "execution_count": 3,
          "metadata": {},
          "output_type": "execute_result"
        }
      ],
      "source": [
        "data.Label.value_counts()"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "3t4OREvSM33h"
      },
      "outputs": [],
      "source": [
        "data.rename(columns=lambda x: x.strip(), inplace=True)\n",
        "data['IPV4_SRC_ADDR'] = data[\"IPV4_SRC_ADDR\"].apply(str)\n",
        "data['L4_SRC_PORT'] = data[\"L4_SRC_PORT\"].apply(str)\n",
        "data['IPV4_DST_ADDR'] = data[\"IPV4_DST_ADDR\"].apply(str)\n",
        "data['L4_DST_PORT'] = data[\"L4_DST_PORT\"].apply(str)"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "bTtHq0XqNXxI"
      },
      "outputs": [],
      "source": [
        "data.drop(columns=[\"L4_SRC_PORT\", \"L4_DST_PORT\"], inplace=True)"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "KUNIP-8zNkn9",
        "outputId": "34de637f-b644-4249-c3fd-cd19bb3bbde2"
      },
      "outputs": [
        {
          "data": {
            "text/plain": [
              "array(['SSH-Bruteforce', 'Benign', 'DDoS attacks-LOIC-HTTP',\n",
              "       'DDOS attack-HOIC', 'DoS attacks-Slowloris', 'DoS attacks-Hulk',\n",
              "       'FTP-BruteForce', 'Infilteration', 'Bot', 'DoS attacks-GoldenEye',\n",
              "       'Brute Force -Web', 'DoS attacks-SlowHTTPTest', 'SQL Injection',\n",
              "       'DDOS attack-LOIC-UDP', 'Brute Force -XSS'], dtype=object)"
            ]
          },
          "execution_count": 6,
          "metadata": {},
          "output_type": "execute_result"
        }
      ],
      "source": [
        "data.Attack.unique()"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "AlPa58fVN7gB"
      },
      "outputs": [],
      "source": [
        "data = data.groupby(by='Attack').sample(frac=0.1, random_state=13)"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/",
          "height": 458
        },
        "id": "lcfAP6ViOp-J",
        "outputId": "3641324e-a78b-46bb-c3a4-8af04a7f9449"
      },
      "outputs": [
        {
          "data": {
            "text/html": [
              "<div>\n",
              "<style scoped>\n",
              "    .dataframe tbody tr th:only-of-type {\n",
              "        vertical-align: middle;\n",
              "    }\n",
              "\n",
              "    .dataframe tbody tr th {\n",
              "        vertical-align: top;\n",
              "    }\n",
              "\n",
              "    .dataframe thead th {\n",
              "        text-align: right;\n",
              "    }\n",
              "</style>\n",
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>IPV4_SRC_ADDR</th>\n",
              "      <th>IPV4_DST_ADDR</th>\n",
              "      <th>PROTOCOL</th>\n",
              "      <th>L7_PROTO</th>\n",
              "      <th>IN_BYTES</th>\n",
              "      <th>IN_PKTS</th>\n",
              "      <th>OUT_BYTES</th>\n",
              "      <th>OUT_PKTS</th>\n",
              "      <th>TCP_FLAGS</th>\n",
              "      <th>CLIENT_TCP_FLAGS</th>\n",
              "      <th>...</th>\n",
              "      <th>NUM_PKTS_1024_TO_1514_BYTES</th>\n",
              "      <th>TCP_WIN_MAX_IN</th>\n",
              "      <th>TCP_WIN_MAX_OUT</th>\n",
              "      <th>ICMP_TYPE</th>\n",
              "      <th>ICMP_IPV4_TYPE</th>\n",
              "      <th>DNS_QUERY_ID</th>\n",
              "      <th>DNS_QUERY_TYPE</th>\n",
              "      <th>DNS_TTL_ANSWER</th>\n",
              "      <th>FTP_COMMAND_RET_CODE</th>\n",
              "      <th>Label</th>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>Attack</th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "      <th></th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>Benign</th>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>...</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "      <td>1663557</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>Bot</th>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>...</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "      <td>14310</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>Brute Force -Web</th>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>...</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "      <td>214</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>Brute Force -XSS</th>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>...</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "      <td>93</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>DDOS attack-HOIC</th>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>...</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "      <td>108086</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>DDOS attack-LOIC-UDP</th>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>...</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "      <td>211</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>DDoS attacks-LOIC-HTTP</th>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>...</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "      <td>30730</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>DoS attacks-GoldenEye</th>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>...</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "      <td>2772</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>DoS attacks-Hulk</th>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>...</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "      <td>43265</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>DoS attacks-SlowHTTPTest</th>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>...</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "      <td>1412</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>DoS attacks-Slowloris</th>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>...</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "      <td>951</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>FTP-BruteForce</th>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>...</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "      <td>2593</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>Infilteration</th>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>...</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "      <td>11636</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>SQL Injection</th>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>...</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "      <td>43</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>SSH-Bruteforce</th>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>...</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "      <td>9498</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>\n",
              "<p>15 rows × 42 columns</p>\n",
              "</div>"
            ],
            "text/plain": [
              "                          IPV4_SRC_ADDR  IPV4_DST_ADDR  PROTOCOL  L7_PROTO  \\\n",
              "Attack                                                                       \n",
              "Benign                          1663557        1663557   1663557   1663557   \n",
              "Bot                               14310          14310     14310     14310   \n",
              "Brute Force -Web                    214            214       214       214   \n",
              "Brute Force -XSS                     93             93        93        93   \n",
              "DDOS attack-HOIC                 108086         108086    108086    108086   \n",
              "DDOS attack-LOIC-UDP                211            211       211       211   \n",
              "DDoS attacks-LOIC-HTTP            30730          30730     30730     30730   \n",
              "DoS attacks-GoldenEye              2772           2772      2772      2772   \n",
              "DoS attacks-Hulk                  43265          43265     43265     43265   \n",
              "DoS attacks-SlowHTTPTest           1412           1412      1412      1412   \n",
              "DoS attacks-Slowloris               951            951       951       951   \n",
              "FTP-BruteForce                     2593           2593      2593      2593   \n",
              "Infilteration                     11636          11636     11636     11636   \n",
              "SQL Injection                        43             43        43        43   \n",
              "SSH-Bruteforce                     9498           9498      9498      9498   \n",
              "\n",
              "                          IN_BYTES  IN_PKTS  OUT_BYTES  OUT_PKTS  TCP_FLAGS  \\\n",
              "Attack                                                                        \n",
              "Benign                     1663557  1663557    1663557   1663557    1663557   \n",
              "Bot                          14310    14310      14310     14310      14310   \n",
              "Brute Force -Web               214      214        214       214        214   \n",
              "Brute Force -XSS                93       93         93        93         93   \n",
              "DDOS attack-HOIC            108086   108086     108086    108086     108086   \n",
              "DDOS attack-LOIC-UDP           211      211        211       211        211   \n",
              "DDoS attacks-LOIC-HTTP       30730    30730      30730     30730      30730   \n",
              "DoS attacks-GoldenEye         2772     2772       2772      2772       2772   \n",
              "DoS attacks-Hulk             43265    43265      43265     43265      43265   \n",
              "DoS attacks-SlowHTTPTest      1412     1412       1412      1412       1412   \n",
              "DoS attacks-Slowloris          951      951        951       951        951   \n",
              "FTP-BruteForce                2593     2593       2593      2593       2593   \n",
              "Infilteration                11636    11636      11636     11636      11636   \n",
              "SQL Injection                   43       43         43        43         43   \n",
              "SSH-Bruteforce                9498     9498       9498      9498       9498   \n",
              "\n",
              "                          CLIENT_TCP_FLAGS  ...  NUM_PKTS_1024_TO_1514_BYTES  \\\n",
              "Attack                                      ...                                \n",
              "Benign                             1663557  ...                      1663557   \n",
              "Bot                                  14310  ...                        14310   \n",
              "Brute Force -Web                       214  ...                          214   \n",
              "Brute Force -XSS                        93  ...                           93   \n",
              "DDOS attack-HOIC                    108086  ...                       108086   \n",
              "DDOS attack-LOIC-UDP                   211  ...                          211   \n",
              "DDoS attacks-LOIC-HTTP               30730  ...                        30730   \n",
              "DoS attacks-GoldenEye                 2772  ...                         2772   \n",
              "DoS attacks-Hulk                     43265  ...                        43265   \n",
              "DoS attacks-SlowHTTPTest              1412  ...                         1412   \n",
              "DoS attacks-Slowloris                  951  ...                          951   \n",
              "FTP-BruteForce                        2593  ...                         2593   \n",
              "Infilteration                        11636  ...                        11636   \n",
              "SQL Injection                           43  ...                           43   \n",
              "SSH-Bruteforce                        9498  ...                         9498   \n",
              "\n",
              "                          TCP_WIN_MAX_IN  TCP_WIN_MAX_OUT  ICMP_TYPE  \\\n",
              "Attack                                                                 \n",
              "Benign                           1663557          1663557    1663557   \n",
              "Bot                                14310            14310      14310   \n",
              "Brute Force -Web                     214              214        214   \n",
              "Brute Force -XSS                      93               93         93   \n",
              "DDOS attack-HOIC                  108086           108086     108086   \n",
              "DDOS attack-LOIC-UDP                 211              211        211   \n",
              "DDoS attacks-LOIC-HTTP             30730            30730      30730   \n",
              "DoS attacks-GoldenEye               2772             2772       2772   \n",
              "DoS attacks-Hulk                   43265            43265      43265   \n",
              "DoS attacks-SlowHTTPTest            1412             1412       1412   \n",
              "DoS attacks-Slowloris                951              951        951   \n",
              "FTP-BruteForce                      2593             2593       2593   \n",
              "Infilteration                      11636            11636      11636   \n",
              "SQL Injection                         43               43         43   \n",
              "SSH-Bruteforce                      9498             9498       9498   \n",
              "\n",
              "                          ICMP_IPV4_TYPE  DNS_QUERY_ID  DNS_QUERY_TYPE  \\\n",
              "Attack                                                                   \n",
              "Benign                           1663557       1663557         1663557   \n",
              "Bot                                14310         14310           14310   \n",
              "Brute Force -Web                     214           214             214   \n",
              "Brute Force -XSS                      93            93              93   \n",
              "DDOS attack-HOIC                  108086        108086          108086   \n",
              "DDOS attack-LOIC-UDP                 211           211             211   \n",
              "DDoS attacks-LOIC-HTTP             30730         30730           30730   \n",
              "DoS attacks-GoldenEye               2772          2772            2772   \n",
              "DoS attacks-Hulk                   43265         43265           43265   \n",
              "DoS attacks-SlowHTTPTest            1412          1412            1412   \n",
              "DoS attacks-Slowloris                951           951             951   \n",
              "FTP-BruteForce                      2593          2593            2593   \n",
              "Infilteration                      11636         11636           11636   \n",
              "SQL Injection                         43            43              43   \n",
              "SSH-Bruteforce                      9498          9498            9498   \n",
              "\n",
              "                          DNS_TTL_ANSWER  FTP_COMMAND_RET_CODE    Label  \n",
              "Attack                                                                   \n",
              "Benign                           1663557               1663557  1663557  \n",
              "Bot                                14310                 14310    14310  \n",
              "Brute Force -Web                     214                   214      214  \n",
              "Brute Force -XSS                      93                    93       93  \n",
              "DDOS attack-HOIC                  108086                108086   108086  \n",
              "DDOS attack-LOIC-UDP                 211                   211      211  \n",
              "DDoS attacks-LOIC-HTTP             30730                 30730    30730  \n",
              "DoS attacks-GoldenEye               2772                  2772     2772  \n",
              "DoS attacks-Hulk                   43265                 43265    43265  \n",
              "DoS attacks-SlowHTTPTest            1412                  1412     1412  \n",
              "DoS attacks-Slowloris                951                   951      951  \n",
              "FTP-BruteForce                      2593                  2593     2593  \n",
              "Infilteration                      11636                 11636    11636  \n",
              "SQL Injection                         43                    43       43  \n",
              "SSH-Bruteforce                      9498                  9498     9498  \n",
              "\n",
              "[15 rows x 42 columns]"
            ]
          },
          "execution_count": 8,
          "metadata": {},
          "output_type": "execute_result"
        }
      ],
      "source": [
        "data.groupby(by=\"Attack\").count()"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "FqRx5xCPOuv8"
      },
      "outputs": [],
      "source": [
        "X = data.drop(columns=[\"Attack\", \"Label\"])\n",
        "y = data[[\"Attack\", \"Label\"]]\n",
        "\n",
        "X_train, X_test, y_train, y_test = train_test_split(\n",
        "        X, y, test_size=0.3, random_state=13, stratify=y)"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "bPfakXplPGGx"
      },
      "outputs": [],
      "source": [
        "encoder = ce.TargetEncoder(cols=['TCP_FLAGS','L7_PROTO','PROTOCOL',\n",
        "                                  'CLIENT_TCP_FLAGS','SERVER_TCP_FLAGS','ICMP_TYPE',\n",
        "                                  'ICMP_IPV4_TYPE','DNS_QUERY_ID','DNS_QUERY_TYPE',\n",
        "                                  'FTP_COMMAND_RET_CODE'])\n",
        "encoder.fit(X_train, y_train.Label)\n",
        "\n",
        "# Transform on training set\n",
        "X_train = encoder.transform(X_train)\n",
        "\n",
        "# Transform on testing set\n",
        "X_test = encoder.transform(X_test)"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "ibyOfV-8PouK"
      },
      "outputs": [],
      "source": [
        "X_train.replace([np.inf, -np.inf], np.nan, inplace=True)\n",
        "X_test.replace([np.inf, -np.inf], np.nan, inplace=True)\n",
        "X_train.fillna(0, inplace=True)\n",
        "X_test.fillna(0, inplace=True)"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "asDnsSIWPee0"
      },
      "outputs": [],
      "source": [
        "scaler = Normalizer()\n",
        "cols_to_norm = list(set(list(X_train.iloc[:, 2:].columns))) # Ignore first two as the represents IP addresses\n",
        "scaler.fit(X_train[cols_to_norm])\n",
        "\n",
        "# Transform on training set\n",
        "X_train[cols_to_norm] = scaler.transform(X_train[cols_to_norm])\n",
        "X_train['h'] = X_train.iloc[:, 2:].values.tolist()\n",
        "\n",
        "# Transform on testing set\n",
        "X_test[cols_to_norm] = scaler.transform(X_test[cols_to_norm])\n",
        "X_test['h'] = X_test.iloc[:, 2:].values.tolist()\n",
        "\n",
        "train = pd.concat([X_train, y_train], axis=1)\n",
        "test = pd.concat([X_test, y_test], axis=1)"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/",
          "height": 357
        },
        "id": "hErQbsnrPluV",
        "outputId": "c4dbe223-89d5-48f5-800d-16512a77e66c"
      },
      "outputs": [
        {
          "data": {
            "text/html": [
              "<div>\n",
              "<style scoped>\n",
              "    .dataframe tbody tr th:only-of-type {\n",
              "        vertical-align: middle;\n",
              "    }\n",
              "\n",
              "    .dataframe tbody tr th {\n",
              "        vertical-align: top;\n",
              "    }\n",
              "\n",
              "    .dataframe thead th {\n",
              "        text-align: right;\n",
              "    }\n",
              "</style>\n",
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>IPV4_SRC_ADDR</th>\n",
              "      <th>IPV4_DST_ADDR</th>\n",
              "      <th>PROTOCOL</th>\n",
              "      <th>L7_PROTO</th>\n",
              "      <th>IN_BYTES</th>\n",
              "      <th>IN_PKTS</th>\n",
              "      <th>OUT_BYTES</th>\n",
              "      <th>OUT_PKTS</th>\n",
              "      <th>TCP_FLAGS</th>\n",
              "      <th>CLIENT_TCP_FLAGS</th>\n",
              "      <th>...</th>\n",
              "      <th>NUM_PKTS_1024_TO_1514_BYTES</th>\n",
              "      <th>TCP_WIN_MAX_IN</th>\n",
              "      <th>TCP_WIN_MAX_OUT</th>\n",
              "      <th>ICMP_TYPE</th>\n",
              "      <th>ICMP_IPV4_TYPE</th>\n",
              "      <th>DNS_QUERY_ID</th>\n",
              "      <th>DNS_QUERY_TYPE</th>\n",
              "      <th>DNS_TTL_ANSWER</th>\n",
              "      <th>FTP_COMMAND_RET_CODE</th>\n",
              "      <th>h</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>10660988</th>\n",
              "      <td>172.31.66.109</td>\n",
              "      <td>172.31.0.2</td>\n",
              "      <td>1.401126e-08</td>\n",
              "      <td>1.108397e-08</td>\n",
              "      <td>0.000078</td>\n",
              "      <td>1.237078e-06</td>\n",
              "      <td>0.000098</td>\n",
              "      <td>1.237078e-06</td>\n",
              "      <td>1.405050e-08</td>\n",
              "      <td>1.405050e-08</td>\n",
              "      <td>...</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>1.458031e-07</td>\n",
              "      <td>1.458029e-07</td>\n",
              "      <td>1.347021e-10</td>\n",
              "      <td>1.109630e-08</td>\n",
              "      <td>0.000074</td>\n",
              "      <td>1.478535e-07</td>\n",
              "      <td>[1.4011259652278748e-08, 1.108397479973663e-08...</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>15147714</th>\n",
              "      <td>172.31.66.68</td>\n",
              "      <td>172.31.0.2</td>\n",
              "      <td>1.245158e-08</td>\n",
              "      <td>1.008341e-08</td>\n",
              "      <td>0.000079</td>\n",
              "      <td>1.099371e-06</td>\n",
              "      <td>0.000097</td>\n",
              "      <td>1.099371e-06</td>\n",
              "      <td>1.248645e-08</td>\n",
              "      <td>1.248645e-08</td>\n",
              "      <td>...</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>1.295728e-07</td>\n",
              "      <td>1.295727e-07</td>\n",
              "      <td>4.406332e-11</td>\n",
              "      <td>9.861101e-09</td>\n",
              "      <td>0.000066</td>\n",
              "      <td>1.313950e-07</td>\n",
              "      <td>[1.2451577640895502e-08, 1.0083409899455216e-0...</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9587672</th>\n",
              "      <td>172.31.64.28</td>\n",
              "      <td>172.31.0.2</td>\n",
              "      <td>1.552131e-08</td>\n",
              "      <td>1.227854e-08</td>\n",
              "      <td>0.000077</td>\n",
              "      <td>1.370403e-06</td>\n",
              "      <td>0.000099</td>\n",
              "      <td>1.370403e-06</td>\n",
              "      <td>1.556478e-08</td>\n",
              "      <td>1.556478e-08</td>\n",
              "      <td>...</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>1.615169e-07</td>\n",
              "      <td>1.615167e-07</td>\n",
              "      <td>7.435637e-12</td>\n",
              "      <td>1.229219e-08</td>\n",
              "      <td>0.000082</td>\n",
              "      <td>1.637882e-07</td>\n",
              "      <td>[1.5521310572476826e-08, 1.2278540225056721e-0...</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7746586</th>\n",
              "      <td>172.31.67.18</td>\n",
              "      <td>172.31.0.2</td>\n",
              "      <td>7.552795e-09</td>\n",
              "      <td>5.974837e-09</td>\n",
              "      <td>0.000045</td>\n",
              "      <td>6.668492e-07</td>\n",
              "      <td>0.000086</td>\n",
              "      <td>6.668492e-07</td>\n",
              "      <td>7.573948e-09</td>\n",
              "      <td>7.573948e-09</td>\n",
              "      <td>...</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>7.859541e-08</td>\n",
              "      <td>7.859535e-08</td>\n",
              "      <td>1.331115e-12</td>\n",
              "      <td>5.883835e-09</td>\n",
              "      <td>0.000040</td>\n",
              "      <td>7.970069e-08</td>\n",
              "      <td>[7.55279530717907e-09, 5.974837018934749e-09, ...</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>693958</th>\n",
              "      <td>172.31.67.31</td>\n",
              "      <td>172.31.0.2</td>\n",
              "      <td>3.657431e-09</td>\n",
              "      <td>2.893307e-09</td>\n",
              "      <td>0.000049</td>\n",
              "      <td>6.458418e-07</td>\n",
              "      <td>0.000115</td>\n",
              "      <td>6.458418e-07</td>\n",
              "      <td>3.667675e-09</td>\n",
              "      <td>3.667675e-09</td>\n",
              "      <td>...</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>3.805972e-08</td>\n",
              "      <td>3.805969e-08</td>\n",
              "      <td>4.762408e-12</td>\n",
              "      <td>2.896524e-09</td>\n",
              "      <td>0.000010</td>\n",
              "      <td>3.859495e-08</td>\n",
              "      <td>[3.6574312874776492e-09, 2.893307042209973e-09...</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>\n",
              "<p>5 rows × 42 columns</p>\n",
              "</div>"
            ],
            "text/plain": [
              "          IPV4_SRC_ADDR IPV4_DST_ADDR      PROTOCOL      L7_PROTO  IN_BYTES  \\\n",
              "10660988  172.31.66.109    172.31.0.2  1.401126e-08  1.108397e-08  0.000078   \n",
              "15147714   172.31.66.68    172.31.0.2  1.245158e-08  1.008341e-08  0.000079   \n",
              "9587672    172.31.64.28    172.31.0.2  1.552131e-08  1.227854e-08  0.000077   \n",
              "7746586    172.31.67.18    172.31.0.2  7.552795e-09  5.974837e-09  0.000045   \n",
              "693958     172.31.67.31    172.31.0.2  3.657431e-09  2.893307e-09  0.000049   \n",
              "\n",
              "               IN_PKTS  OUT_BYTES      OUT_PKTS     TCP_FLAGS  \\\n",
              "10660988  1.237078e-06   0.000098  1.237078e-06  1.405050e-08   \n",
              "15147714  1.099371e-06   0.000097  1.099371e-06  1.248645e-08   \n",
              "9587672   1.370403e-06   0.000099  1.370403e-06  1.556478e-08   \n",
              "7746586   6.668492e-07   0.000086  6.668492e-07  7.573948e-09   \n",
              "693958    6.458418e-07   0.000115  6.458418e-07  3.667675e-09   \n",
              "\n",
              "          CLIENT_TCP_FLAGS  ...  NUM_PKTS_1024_TO_1514_BYTES  TCP_WIN_MAX_IN  \\\n",
              "10660988      1.405050e-08  ...                          0.0             0.0   \n",
              "15147714      1.248645e-08  ...                          0.0             0.0   \n",
              "9587672       1.556478e-08  ...                          0.0             0.0   \n",
              "7746586       7.573948e-09  ...                          0.0             0.0   \n",
              "693958        3.667675e-09  ...                          0.0             0.0   \n",
              "\n",
              "          TCP_WIN_MAX_OUT     ICMP_TYPE  ICMP_IPV4_TYPE  DNS_QUERY_ID  \\\n",
              "10660988              0.0  1.458031e-07    1.458029e-07  1.347021e-10   \n",
              "15147714              0.0  1.295728e-07    1.295727e-07  4.406332e-11   \n",
              "9587672               0.0  1.615169e-07    1.615167e-07  7.435637e-12   \n",
              "7746586               0.0  7.859541e-08    7.859535e-08  1.331115e-12   \n",
              "693958                0.0  3.805972e-08    3.805969e-08  4.762408e-12   \n",
              "\n",
              "          DNS_QUERY_TYPE  DNS_TTL_ANSWER  FTP_COMMAND_RET_CODE  \\\n",
              "10660988    1.109630e-08        0.000074          1.478535e-07   \n",
              "15147714    9.861101e-09        0.000066          1.313950e-07   \n",
              "9587672     1.229219e-08        0.000082          1.637882e-07   \n",
              "7746586     5.883835e-09        0.000040          7.970069e-08   \n",
              "693958      2.896524e-09        0.000010          3.859495e-08   \n",
              "\n",
              "                                                          h  \n",
              "10660988  [1.4011259652278748e-08, 1.108397479973663e-08...  \n",
              "15147714  [1.2451577640895502e-08, 1.0083409899455216e-0...  \n",
              "9587672   [1.5521310572476826e-08, 1.2278540225056721e-0...  \n",
              "7746586   [7.55279530717907e-09, 5.974837018934749e-09, ...  \n",
              "693958    [3.6574312874776492e-09, 2.893307042209973e-09...  \n",
              "\n",
              "[5 rows x 42 columns]"
            ]
          },
          "execution_count": 13,
          "metadata": {},
          "output_type": "execute_result"
        }
      ],
      "source": [
        "X_train.head()"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "d_tLtK4WPtrF"
      },
      "outputs": [],
      "source": [
        "lab_enc = preprocessing.LabelEncoder()\n",
        "lab_enc.fit(data[\"Attack\"])\n",
        "\n",
        "# Transform on training set\n",
        "train[\"Attack\"] = lab_enc.transform(train[\"Attack\"])\n",
        "\n",
        "# Transform on testing set\n",
        "test[\"Attack\"] = lab_enc.transform(test[\"Attack\"])"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "8yaicjecP1fZ"
      },
      "outputs": [],
      "source": [
        "# Training graph\n",
        "\n",
        "train_g = nx.from_pandas_edgelist(train, \"IPV4_SRC_ADDR\", \"IPV4_DST_ADDR\",\n",
        "            [\"h\", \"Label\", \"Attack\"], create_using=nx.MultiGraph())\n",
        "\n",
        "train_g = train_g.to_directed()\n",
        "train_g = dgl.from_networkx(train_g, edge_attrs=['h', 'Attack', 'Label'])\n",
        "nfeat_weight = torch.ones([train_g.number_of_nodes(),\n",
        "train_g.edata['h'].shape[1]])\n",
        "train_g.ndata['h'] = nfeat_weight\n",
        "\n",
        "# Testing graph\n",
        "test_g = nx.from_pandas_edgelist(test, \"IPV4_SRC_ADDR\", \"IPV4_DST_ADDR\",\n",
        "            [\"h\", \"Label\", \"Attack\"], create_using=nx.MultiGraph())\n",
        "\n",
        "test_g = test_g.to_directed()\n",
        "test_g = dgl.from_networkx(test_g, edge_attrs=['h', 'Attack', 'Label'])\n",
        "nfeat_weight = torch.ones([test_g.number_of_nodes(),\n",
        "test_g.edata['h'].shape[1]])\n",
        "test_g.ndata['h'] = nfeat_weight"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "PUV6DgJ9QRaP"
      },
      "outputs": [],
      "source": [
        "import torch.nn as nn\n",
        "import torch.nn.functional as F\n",
        "import dgl.function as fn\n",
        "import tqdm\n",
        "import gc\n",
        "\n",
        "class SAGELayer(nn.Module):\n",
        "    def __init__(self, ndim_in, edims, ndim_out, activation):\n",
        "      super(SAGELayer, self).__init__()\n",
        "      self.W_apply = nn.Linear(ndim_in + edims , ndim_out)\n",
        "      self.activation = F.relu\n",
        "      self.W_edge = nn.Linear(128 * 2, 256)\n",
        "      self.reset_parameters()\n",
        "\n",
        "    def reset_parameters(self):\n",
        "      gain = nn.init.calculate_gain('relu')\n",
        "      nn.init.xavier_uniform_(self.W_apply.weight, gain=gain)\n",
        "\n",
        "    def message_func(self, edges):\n",
        "      return {'m':  edges.data['h']}\n",
        "\n",
        "    def forward(self, g_dgl, nfeats, efeats):\n",
        "      with g_dgl.local_scope():\n",
        "        g = g_dgl\n",
        "        g.ndata['h'] = nfeats\n",
        "        g.edata['h'] = efeats\n",
        "        g.update_all(self.message_func, fn.mean('m', 'h_neigh'))\n",
        "        g.ndata['h'] = F.relu(self.W_apply(torch.cat([g.ndata['h'], g.ndata['h_neigh']], 2)))\n",
        "\n",
        "        # Compute edge embeddings\n",
        "        u, v = g.edges()\n",
        "        edge = self.W_edge(torch.cat((g.srcdata['h'][u], g.dstdata['h'][v]), 2))\n",
        "        return g.ndata['h'], edge"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "_xo-3K4QRGqc"
      },
      "outputs": [],
      "source": [
        "class SAGE(nn.Module):\n",
        "    def __init__(self, ndim_in, ndim_out, edim,  activation):\n",
        "      super(SAGE, self).__init__()\n",
        "      self.layers = nn.ModuleList()\n",
        "      self.layers.append(SAGELayer(ndim_in, edim, 128, F.relu))\n",
        "\n",
        "    def forward(self, g, nfeats, efeats, corrupt=False):\n",
        "      if corrupt:\n",
        "        e_perm = torch.randperm(g.number_of_edges())\n",
        "        #n_perm = torch.randperm(g.number_of_nodes())\n",
        "        efeats = efeats[e_perm]\n",
        "        #nfeats = nfeats[n_perm]\n",
        "      for i, layer in enumerate(self.layers):\n",
        "        #nfeats = layer(g, nfeats, efeats)\n",
        "        nfeats, e_feats = layer(g, nfeats, efeats)\n",
        "      #return nfeats.sum(1)\n",
        "      return nfeats.sum(1), e_feats.sum(1)"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "6uuxRtLuRJQL"
      },
      "outputs": [],
      "source": [
        "class Discriminator(nn.Module):\n",
        "    def __init__(self, n_hidden):\n",
        "      super(Discriminator, self).__init__()\n",
        "      self.weight = nn.Parameter(torch.Tensor(n_hidden, n_hidden))\n",
        "      self.reset_parameters()\n",
        "\n",
        "    def uniform(self, size, tensor):\n",
        "      bound = 1.0 / math.sqrt(size)\n",
        "      if tensor is not None:\n",
        "        tensor.data.uniform_(-bound, bound)\n",
        "\n",
        "    def reset_parameters(self):\n",
        "      size = self.weight.size(0)\n",
        "      self.uniform(size, self.weight)\n",
        "\n",
        "    def forward(self, features, summary):\n",
        "      features = torch.matmul(features, torch.matmul(self.weight, summary))\n",
        "      return features"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "ZPbVjlCyRUco"
      },
      "outputs": [],
      "source": [
        "class DGI(nn.Module):\n",
        "    def __init__(self, ndim_in, ndim_out, edim, activation):\n",
        "      super(DGI, self).__init__()\n",
        "      self.encoder = SAGE(ndim_in, ndim_out, edim,  F.relu)\n",
        "      #self.discriminator = Discriminator(128)\n",
        "      self.discriminator = Discriminator(256)\n",
        "      self.loss = nn.BCEWithLogitsLoss()\n",
        "\n",
        "    def forward(self, g, n_features, e_features):\n",
        "      positive = self.encoder(g, n_features, e_features, corrupt=False)\n",
        "      negative = self.encoder(g, n_features, e_features, corrupt=True)\n",
        "      self.loss = nn.BCEWithLogitsLoss()\n",
        "\n",
        "    def forward(self, g, n_features, e_features):\n",
        "      positive = self.encoder(g, n_features, e_features, corrupt=False)\n",
        "      negative = self.encoder(g, n_features, e_features, corrupt=True)\n",
        "\n",
        "      positive = positive[1]\n",
        "      negative = negative[1]\n",
        "\n",
        "      summary = torch.sigmoid(positive.mean(dim=0))\n",
        "\n",
        "      positive = self.discriminator(positive, summary)\n",
        "      negative = self.discriminator(negative, summary)\n",
        "\n",
        "      l1 = self.loss(positive, torch.ones_like(positive))\n",
        "      l2 = self.loss(negative, torch.zeros_like(negative))\n",
        "\n",
        "      return l1 + l2"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "sKnfpWFMR19u"
      },
      "outputs": [],
      "source": [
        "ndim_in = train_g.ndata['h'].shape[1]\n",
        "hidden_features = 128\n",
        "ndim_out = 128\n",
        "num_layers = 1\n",
        "edim = train_g.edata['h'].shape[1]\n",
        "learning_rate = 1e-3\n",
        "epochs = 4000"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "aSl_9qY8SbA0"
      },
      "outputs": [],
      "source": [
        "dgi = DGI(ndim_in,\n",
        "    ndim_out,\n",
        "    edim,\n",
        "    F.relu)\n",
        "\n",
        "dgi_optimizer = torch.optim.Adam(dgi.parameters(),\n",
        "                lr=1e-3,\n",
        "                weight_decay=0.)"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "9K6_cOiWSdJA"
      },
      "outputs": [],
      "source": [
        "# Format node and edge features for E-GraphSAGE\n",
        "train_g.ndata['h'] = torch.reshape(train_g.ndata['h'],\n",
        "                                   (train_g.ndata['h'].shape[0], 1,\n",
        "                                    train_g.ndata['h'].shape[1]))\n",
        "\n",
        "train_g.edata['h'] = torch.reshape(train_g.edata['h'],\n",
        "                                   (train_g.edata['h'].shape[0], 1,\n",
        "                                    train_g.edata['h'].shape[1]))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "O44auIyWSexg"
      },
      "outputs": [],
      "source": [
        "# Convert to GPU\n",
        "train_g = train_g"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "gZtafIdxSheN"
      },
      "outputs": [],
      "source": [
        "# cnt_wait = 0\n",
        "# best = 1e9\n",
        "# best_t = 0\n",
        "# dur = []\n",
        "# node_features = train_g.ndata['h']\n",
        "# edge_features = train_g.edata['h']\n",
        "\n",
        "# for epoch in range(epochs):\n",
        "#     dgi.train()\n",
        "#     if epoch >= 3:\n",
        "#         t0 = time.time()\n",
        "\n",
        "#     dgi_optimizer.zero_grad()\n",
        "#     loss = dgi(train_g, node_features, edge_features)\n",
        "#     loss.backward()\n",
        "#     dgi_optimizer.step()\n",
        "\n",
        "#     if loss < best:\n",
        "#         best = loss\n",
        "#         best_t = epoch\n",
        "#         cnt_wait = 0\n",
        "#         torch.save(dgi.state_dict(), 'best_dgi.pkl')\n",
        "#     else:\n",
        "#         cnt_wait += 1\n",
        "\n",
        "#   # if cnt_wait == patience:\n",
        "#   #     print('Early stopping!')\n",
        "#   #     break\n",
        "\n",
        "#     if epoch >= 3:\n",
        "#         dur.append(time.time() - t0)\n",
        "\n",
        "#     if epoch % 50 == 0:\n",
        "\n",
        "#         print(\"Epoch {:05d} | Time(s) {:.4f} | Loss {:.4f} | \"\n",
        "#             \"ETputs(KTEPS) {:.2f}\".format(epoch, np.mean(dur),\n",
        "#               loss.item(),\n",
        "#               train_g.num_edges() / np.mean(dur) / 1000))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "RZ2HAQDAF-4c",
        "outputId": "79b6374d-390e-4571-df1d-ee46792480f7"
      },
      "outputs": [
        {
          "data": {
            "text/plain": [
              "<All keys matched successfully>"
            ]
          },
          "execution_count": 25,
          "metadata": {},
          "output_type": "execute_result"
        }
      ],
      "source": [
        "dgi.load_state_dict(torch.load('best_dgi.pkl'))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "6Ek16GkRStKP"
      },
      "outputs": [],
      "source": [
        "training_emb = dgi.encoder(train_g, train_g.ndata['h'], train_g.edata['h'])[1]\n",
        "training_emb = training_emb.detach().cpu().numpy()"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "-FwaBlOdS4ep"
      },
      "outputs": [],
      "source": [
        "test_g.ndata['h'] = torch.reshape(test_g.ndata['h'],\n",
        "                                   (test_g.ndata['h'].shape[0], 1,\n",
        "                                    test_g.ndata['h'].shape[1]))\n",
        "\n",
        "\n",
        "\n",
        "test_g.edata['h'] = torch.reshape(test_g.edata['h'],\n",
        "                                   (test_g.edata['h'].shape[0], 1,\n",
        "                                    test_g.edata['h'].shape[1]))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "SBa-rdivS6cQ"
      },
      "outputs": [],
      "source": [
        "# Convert to GPU\n",
        "test_g = test_g"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "W12WLjslS-kx"
      },
      "outputs": [],
      "source": [
        "testing_emb = dgi.encoder(test_g, test_g.ndata['h'], test_g.edata['h'])[1]\n",
        "testing_emb = testing_emb.detach().cpu().numpy()"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "ERsOAMjeS_D8"
      },
      "outputs": [],
      "source": [
        "df_train = pd.DataFrame(training_emb, )\n",
        "df_train[\"Attack\"] = lab_enc.inverse_transform(\n",
        "        train_g.edata['Attack'].detach().cpu().numpy())\n",
        "df_train[\"Label\"] = train_g.edata['Label'].detach().cpu().numpy()\n",
        "\n",
        "df_test = pd.DataFrame(testing_emb, )\n",
        "df_test[\"Attack\"] = lab_enc.inverse_transform(\n",
        "        test_g.edata['Attack'].detach().cpu().numpy())\n",
        "df_test[\"Label\"] = test_g.edata['Label'].detach().cpu().numpy()"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/",
          "height": 488
        },
        "id": "B8p79H9dat5T",
        "outputId": "0d6e82d8-5d02-49eb-a16f-d44e52ea3dff"
      },
      "outputs": [
        {
          "data": {
            "text/html": [
              "<div>\n",
              "<style scoped>\n",
              "    .dataframe tbody tr th:only-of-type {\n",
              "        vertical-align: middle;\n",
              "    }\n",
              "\n",
              "    .dataframe tbody tr th {\n",
              "        vertical-align: top;\n",
              "    }\n",
              "\n",
              "    .dataframe thead th {\n",
              "        text-align: right;\n",
              "    }\n",
              "</style>\n",
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>0</th>\n",
              "      <th>1</th>\n",
              "      <th>2</th>\n",
              "      <th>3</th>\n",
              "      <th>4</th>\n",
              "      <th>5</th>\n",
              "      <th>6</th>\n",
              "      <th>7</th>\n",
              "      <th>8</th>\n",
              "      <th>9</th>\n",
              "      <th>...</th>\n",
              "      <th>248</th>\n",
              "      <th>249</th>\n",
              "      <th>250</th>\n",
              "      <th>251</th>\n",
              "      <th>252</th>\n",
              "      <th>253</th>\n",
              "      <th>254</th>\n",
              "      <th>255</th>\n",
              "      <th>Attack</th>\n",
              "      <th>Label</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0.106326</td>\n",
              "      <td>0.002315</td>\n",
              "      <td>-0.000980</td>\n",
              "      <td>-0.022264</td>\n",
              "      <td>0.045113</td>\n",
              "      <td>0.029210</td>\n",
              "      <td>0.038371</td>\n",
              "      <td>-0.002847</td>\n",
              "      <td>-0.040849</td>\n",
              "      <td>0.057440</td>\n",
              "      <td>...</td>\n",
              "      <td>0.046839</td>\n",
              "      <td>0.001730</td>\n",
              "      <td>0.012890</td>\n",
              "      <td>-0.099413</td>\n",
              "      <td>0.043458</td>\n",
              "      <td>0.072058</td>\n",
              "      <td>0.035648</td>\n",
              "      <td>0.047931</td>\n",
              "      <td>Benign</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0.106326</td>\n",
              "      <td>0.002315</td>\n",
              "      <td>-0.000980</td>\n",
              "      <td>-0.022264</td>\n",
              "      <td>0.045113</td>\n",
              "      <td>0.029210</td>\n",
              "      <td>0.038371</td>\n",
              "      <td>-0.002847</td>\n",
              "      <td>-0.040849</td>\n",
              "      <td>0.057440</td>\n",
              "      <td>...</td>\n",
              "      <td>0.046839</td>\n",
              "      <td>0.001730</td>\n",
              "      <td>0.012890</td>\n",
              "      <td>-0.099413</td>\n",
              "      <td>0.043458</td>\n",
              "      <td>0.072058</td>\n",
              "      <td>0.035648</td>\n",
              "      <td>0.047931</td>\n",
              "      <td>Benign</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0.106326</td>\n",
              "      <td>0.002315</td>\n",
              "      <td>-0.000980</td>\n",
              "      <td>-0.022264</td>\n",
              "      <td>0.045113</td>\n",
              "      <td>0.029210</td>\n",
              "      <td>0.038371</td>\n",
              "      <td>-0.002847</td>\n",
              "      <td>-0.040849</td>\n",
              "      <td>0.057440</td>\n",
              "      <td>...</td>\n",
              "      <td>0.046839</td>\n",
              "      <td>0.001730</td>\n",
              "      <td>0.012890</td>\n",
              "      <td>-0.099413</td>\n",
              "      <td>0.043458</td>\n",
              "      <td>0.072058</td>\n",
              "      <td>0.035648</td>\n",
              "      <td>0.047931</td>\n",
              "      <td>Benign</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0.106326</td>\n",
              "      <td>0.002315</td>\n",
              "      <td>-0.000980</td>\n",
              "      <td>-0.022264</td>\n",
              "      <td>0.045113</td>\n",
              "      <td>0.029210</td>\n",
              "      <td>0.038371</td>\n",
              "      <td>-0.002847</td>\n",
              "      <td>-0.040849</td>\n",
              "      <td>0.057440</td>\n",
              "      <td>...</td>\n",
              "      <td>0.046839</td>\n",
              "      <td>0.001730</td>\n",
              "      <td>0.012890</td>\n",
              "      <td>-0.099413</td>\n",
              "      <td>0.043458</td>\n",
              "      <td>0.072058</td>\n",
              "      <td>0.035648</td>\n",
              "      <td>0.047931</td>\n",
              "      <td>Benign</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0.106326</td>\n",
              "      <td>0.002315</td>\n",
              "      <td>-0.000980</td>\n",
              "      <td>-0.022264</td>\n",
              "      <td>0.045113</td>\n",
              "      <td>0.029210</td>\n",
              "      <td>0.038371</td>\n",
              "      <td>-0.002847</td>\n",
              "      <td>-0.040849</td>\n",
              "      <td>0.057440</td>\n",
              "      <td>...</td>\n",
              "      <td>0.046839</td>\n",
              "      <td>0.001730</td>\n",
              "      <td>0.012890</td>\n",
              "      <td>-0.099413</td>\n",
              "      <td>0.043458</td>\n",
              "      <td>0.072058</td>\n",
              "      <td>0.035648</td>\n",
              "      <td>0.047931</td>\n",
              "      <td>Benign</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>...</th>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "      <td>...</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2641549</th>\n",
              "      <td>0.123069</td>\n",
              "      <td>0.026578</td>\n",
              "      <td>-0.009467</td>\n",
              "      <td>0.007449</td>\n",
              "      <td>0.056632</td>\n",
              "      <td>0.034634</td>\n",
              "      <td>0.045075</td>\n",
              "      <td>-0.007112</td>\n",
              "      <td>-0.050270</td>\n",
              "      <td>0.071016</td>\n",
              "      <td>...</td>\n",
              "      <td>0.054894</td>\n",
              "      <td>-0.003832</td>\n",
              "      <td>-0.008389</td>\n",
              "      <td>-0.097075</td>\n",
              "      <td>0.057076</td>\n",
              "      <td>0.087696</td>\n",
              "      <td>0.034345</td>\n",
              "      <td>0.045828</td>\n",
              "      <td>Benign</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2641550</th>\n",
              "      <td>0.146425</td>\n",
              "      <td>0.022692</td>\n",
              "      <td>-0.004799</td>\n",
              "      <td>0.044749</td>\n",
              "      <td>0.055015</td>\n",
              "      <td>0.036507</td>\n",
              "      <td>0.058755</td>\n",
              "      <td>-0.027695</td>\n",
              "      <td>-0.030468</td>\n",
              "      <td>0.092988</td>\n",
              "      <td>...</td>\n",
              "      <td>0.026060</td>\n",
              "      <td>-0.017071</td>\n",
              "      <td>-0.058810</td>\n",
              "      <td>-0.093998</td>\n",
              "      <td>0.085114</td>\n",
              "      <td>0.140869</td>\n",
              "      <td>0.067376</td>\n",
              "      <td>0.048734</td>\n",
              "      <td>Benign</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2641551</th>\n",
              "      <td>0.140820</td>\n",
              "      <td>0.066262</td>\n",
              "      <td>-0.041707</td>\n",
              "      <td>0.046161</td>\n",
              "      <td>0.078733</td>\n",
              "      <td>0.042034</td>\n",
              "      <td>0.057938</td>\n",
              "      <td>-0.020710</td>\n",
              "      <td>-0.051066</td>\n",
              "      <td>0.092359</td>\n",
              "      <td>...</td>\n",
              "      <td>0.037817</td>\n",
              "      <td>-0.008337</td>\n",
              "      <td>-0.050818</td>\n",
              "      <td>-0.079956</td>\n",
              "      <td>0.083160</td>\n",
              "      <td>0.120430</td>\n",
              "      <td>0.043901</td>\n",
              "      <td>0.045791</td>\n",
              "      <td>Benign</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2641552</th>\n",
              "      <td>0.147100</td>\n",
              "      <td>0.046359</td>\n",
              "      <td>-0.023473</td>\n",
              "      <td>0.045124</td>\n",
              "      <td>0.067559</td>\n",
              "      <td>0.038634</td>\n",
              "      <td>0.062342</td>\n",
              "      <td>-0.026802</td>\n",
              "      <td>-0.040660</td>\n",
              "      <td>0.093196</td>\n",
              "      <td>...</td>\n",
              "      <td>0.026881</td>\n",
              "      <td>-0.011808</td>\n",
              "      <td>-0.052880</td>\n",
              "      <td>-0.089512</td>\n",
              "      <td>0.086857</td>\n",
              "      <td>0.129162</td>\n",
              "      <td>0.059013</td>\n",
              "      <td>0.048242</td>\n",
              "      <td>Benign</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2641553</th>\n",
              "      <td>0.120551</td>\n",
              "      <td>0.014205</td>\n",
              "      <td>0.000140</td>\n",
              "      <td>0.006714</td>\n",
              "      <td>0.049474</td>\n",
              "      <td>0.035017</td>\n",
              "      <td>0.038650</td>\n",
              "      <td>-0.003520</td>\n",
              "      <td>-0.046015</td>\n",
              "      <td>0.072768</td>\n",
              "      <td>...</td>\n",
              "      <td>0.058093</td>\n",
              "      <td>-0.005793</td>\n",
              "      <td>-0.013011</td>\n",
              "      <td>-0.097319</td>\n",
              "      <td>0.056328</td>\n",
              "      <td>0.098719</td>\n",
              "      <td>0.035121</td>\n",
              "      <td>0.046355</td>\n",
              "      <td>Benign</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>\n",
              "<p>2641554 rows × 258 columns</p>\n",
              "</div>"
            ],
            "text/plain": [
              "                0         1         2         3         4         5         6  \\\n",
              "0        0.106326  0.002315 -0.000980 -0.022264  0.045113  0.029210  0.038371   \n",
              "1        0.106326  0.002315 -0.000980 -0.022264  0.045113  0.029210  0.038371   \n",
              "2        0.106326  0.002315 -0.000980 -0.022264  0.045113  0.029210  0.038371   \n",
              "3        0.106326  0.002315 -0.000980 -0.022264  0.045113  0.029210  0.038371   \n",
              "4        0.106326  0.002315 -0.000980 -0.022264  0.045113  0.029210  0.038371   \n",
              "...           ...       ...       ...       ...       ...       ...       ...   \n",
              "2641549  0.123069  0.026578 -0.009467  0.007449  0.056632  0.034634  0.045075   \n",
              "2641550  0.146425  0.022692 -0.004799  0.044749  0.055015  0.036507  0.058755   \n",
              "2641551  0.140820  0.066262 -0.041707  0.046161  0.078733  0.042034  0.057938   \n",
              "2641552  0.147100  0.046359 -0.023473  0.045124  0.067559  0.038634  0.062342   \n",
              "2641553  0.120551  0.014205  0.000140  0.006714  0.049474  0.035017  0.038650   \n",
              "\n",
              "                7         8         9  ...       248       249       250  \\\n",
              "0       -0.002847 -0.040849  0.057440  ...  0.046839  0.001730  0.012890   \n",
              "1       -0.002847 -0.040849  0.057440  ...  0.046839  0.001730  0.012890   \n",
              "2       -0.002847 -0.040849  0.057440  ...  0.046839  0.001730  0.012890   \n",
              "3       -0.002847 -0.040849  0.057440  ...  0.046839  0.001730  0.012890   \n",
              "4       -0.002847 -0.040849  0.057440  ...  0.046839  0.001730  0.012890   \n",
              "...           ...       ...       ...  ...       ...       ...       ...   \n",
              "2641549 -0.007112 -0.050270  0.071016  ...  0.054894 -0.003832 -0.008389   \n",
              "2641550 -0.027695 -0.030468  0.092988  ...  0.026060 -0.017071 -0.058810   \n",
              "2641551 -0.020710 -0.051066  0.092359  ...  0.037817 -0.008337 -0.050818   \n",
              "2641552 -0.026802 -0.040660  0.093196  ...  0.026881 -0.011808 -0.052880   \n",
              "2641553 -0.003520 -0.046015  0.072768  ...  0.058093 -0.005793 -0.013011   \n",
              "\n",
              "              251       252       253       254       255  Attack  Label  \n",
              "0       -0.099413  0.043458  0.072058  0.035648  0.047931  Benign      0  \n",
              "1       -0.099413  0.043458  0.072058  0.035648  0.047931  Benign      0  \n",
              "2       -0.099413  0.043458  0.072058  0.035648  0.047931  Benign      0  \n",
              "3       -0.099413  0.043458  0.072058  0.035648  0.047931  Benign      0  \n",
              "4       -0.099413  0.043458  0.072058  0.035648  0.047931  Benign      0  \n",
              "...           ...       ...       ...       ...       ...     ...    ...  \n",
              "2641549 -0.097075  0.057076  0.087696  0.034345  0.045828  Benign      0  \n",
              "2641550 -0.093998  0.085114  0.140869  0.067376  0.048734  Benign      0  \n",
              "2641551 -0.079956  0.083160  0.120430  0.043901  0.045791  Benign      0  \n",
              "2641552 -0.089512  0.086857  0.129162  0.059013  0.048242  Benign      0  \n",
              "2641553 -0.097319  0.056328  0.098719  0.035121  0.046355  Benign      0  \n",
              "\n",
              "[2641554 rows x 258 columns]"
            ]
          },
          "execution_count": 31,
          "metadata": {},
          "output_type": "execute_result"
        }
      ],
      "source": [
        "df_train"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "7ScEk1y_TzzX"
      },
      "source": [
        "# Embeddings CBLOF  Embeddings"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "ZYABKzdrTGas"
      },
      "outputs": [],
      "source": [
        "import torch\n",
        "import dgl\n",
        "import numpy as np\n",
        "import pandas as pd\n",
        "import torch.optim as optim\n",
        "import time\n",
        "import seaborn as sns\n",
        "import matplotlib.pyplot as plt\n",
        "from sklearn.model_selection import train_test_split\n",
        "from sklearn.metrics import classification_report, f1_score\n",
        "from sklearn.ensemble import IsolationForest\n",
        "import gc\n",
        "\n",
        "from tqdm import tqdm\n",
        "import itertools"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "RkFS_-dcTJeK"
      },
      "outputs": [],
      "source": [
        "benign_train_samples = df_train[df_train.Label == 0].drop(columns=[\"Label\", \"Attack\"])\n",
        "normal_train_samples = df_train.drop(columns=[\"Label\", \"Attack\"])\n",
        "\n",
        "train_labels = df_train[\"Label\"]\n",
        "test_labels = df_test[\"Label\"]\n",
        "\n",
        "test_samples = df_test.drop(columns=[\"Label\", \"Attack\"])"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "62BUDLtO4mla"
      },
      "outputs": [],
      "source": [
        "contamination = [0.001, 0.01, 0.04, 0.05, 0.1, 0.2]"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "2i48uLj74mla",
        "outputId": "a0dd33ee-824d-4328-a960-e656e3aaf0ea"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 36/36 [5:30:26<00:00, 550.74s/it]  \n"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "{'n_estimators': 5, 'con': 0.001}\n",
            "0.944374438967276\n",
            "              precision    recall  f1-score   support\n",
            "\n",
            "           0     0.9770    0.9989    0.9878    996643\n",
            "           1     0.9899    0.8267    0.9010    135488\n",
            "\n",
            "    accuracy                         0.9783   1132131\n",
            "   macro avg     0.9834    0.9128    0.9444   1132131\n",
            "weighted avg     0.9785    0.9783    0.9774   1132131\n",
            "\n"
          ]
        }
      ],
      "source": [
        "from pyod.models.cblof import CBLOF\n",
        "n_est = [2,3,5,7,9,10]\n",
        "params = list(itertools.product(n_est, contamination))\n",
        "score = -1\n",
        "bs = None\n",
        "for n_est, con in tqdm(params):\n",
        "    \n",
        "    clf_if = CBLOF(n_clusters=n_est, contamination=con)\n",
        "    clf_if.fit(benign_train_samples)\n",
        "    y_pred = clf_if.predict(test_samples)\n",
        "    test_pred = y_pred\n",
        "\n",
        "    f1 = f1_score(test_labels, test_pred, average='macro')\n",
        "\n",
        "    if f1 > score:\n",
        "        score = f1\n",
        "        best_params = {'n_estimators': n_est,\n",
        "                       \"con\": con\n",
        "                }\n",
        "        bs = test_pred\n",
        "    del clf_if\n",
        "    gc.collect()\n",
        "\n",
        "\n",
        "print(best_params)\n",
        "print(score)\n",
        "print(classification_report(test_labels, bs, digits=4))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "rK-Rng9q4mla",
        "outputId": "1796db22-cfb8-4bf8-9004-6420c08c3399"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 36/36 [5:34:38<00:00, 557.74s/it]  \n"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "{'n_estimators': 2, 'con': 0.1}\n",
            "0.9437829594960284\n",
            "              precision    recall  f1-score   support\n",
            "\n",
            "           0     0.9769    0.9986    0.9876    996643\n",
            "           1     0.9874    0.8267    0.8999    135488\n",
            "\n",
            "    accuracy                         0.9780   1132131\n",
            "   macro avg     0.9822    0.9126    0.9438   1132131\n",
            "weighted avg     0.9782    0.9780    0.9771   1132131\n",
            "\n"
          ]
        }
      ],
      "source": [
        "n_est = [2,3,5,7,9,10]\n",
        "contamination = [0.001, 0.01, 0.04, 0.05, 0.1, 0.2]\n",
        "params = list(itertools.product(n_est, contamination))\n",
        "score = -1\n",
        "bs = None\n",
        "for n_est, con in tqdm(params):\n",
        "    \n",
        "    clf_if = CBLOF(n_clusters=n_est, contamination=con)\n",
        "    clf_if.fit(normal_train_samples)\n",
        "    y_pred = clf_if.predict(test_samples)\n",
        "    test_pred = y_pred\n",
        "\n",
        "    f1 = f1_score(test_labels, test_pred, average='macro')\n",
        "\n",
        "    if f1 > score:\n",
        "        score = f1\n",
        "        best_params = {'n_estimators': n_est,\n",
        "                       \"con\": con\n",
        "                }\n",
        "        bs = test_pred\n",
        "    del clf_if\n",
        "    gc.collect()\n",
        "\n",
        "\n",
        "print(best_params)\n",
        "print(score)\n",
        "print(classification_report(test_labels, bs, digits=4))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "tHSOcEhH4mlb"
      },
      "outputs": [],
      "source": [
        "###  CBLOF RAW"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "A--j-9Cu4mlb"
      },
      "outputs": [],
      "source": []
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "-D3nCuXX4mlb"
      },
      "outputs": [],
      "source": [
        "df_raw_train = pd.concat([X_train.drop(columns=[\"IPV4_SRC_ADDR\",\"IPV4_DST_ADDR\", \"h\"]), y_train], axis=1)\n",
        "df_raw_test = pd.concat([X_test.drop(columns=[\"IPV4_SRC_ADDR\",\"IPV4_DST_ADDR\", \"h\"]), y_test], axis=1)"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "8Zr57GFE4mlb"
      },
      "outputs": [],
      "source": [
        "raw_benign_train_samples = df_raw_train[df_raw_train.Label == 0].drop(columns=[\"Label\", \"Attack\"])\n",
        "raw_normal_train_samples = df_raw_train.drop(columns=[\"Label\", \"Attack\"])\n",
        "\n",
        "raw_train_labels = df_raw_train[\"Label\"]\n",
        "raw_test_labels = df_raw_test[\"Label\"]\n",
        "\n",
        "raw_test_samples = df_raw_test.drop(columns=[\"Label\", \"Attack\"])"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "u_l1Vz8S4mlb",
        "outputId": "c1b8d03c-7105-42d9-f49a-bba4ff4905a7"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "  3%|▎         | 1/36 [00:13<07:58, 13.68s/it]"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "2\n"
          ]
        },
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "\r",
            "  6%|▌         | 2/36 [00:27<07:56, 14.02s/it]"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "2\n"
          ]
        },
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "\r",
            "  8%|▊         | 3/36 [00:47<09:03, 16.48s/it]"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "2\n"
          ]
        },
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "\r",
            " 11%|█         | 4/36 [01:05<09:08, 17.13s/it]"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "2\n"
          ]
        },
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "\r",
            " 14%|█▍        | 5/36 [01:19<08:21, 16.17s/it]"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "2\n"
          ]
        },
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "\r",
            " 17%|█▋        | 6/36 [01:34<07:52, 15.74s/it]"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "2\n"
          ]
        },
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 36/36 [20:22<00:00, 33.97s/it]\n"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "{'n_estimators': 9, 'con': 0.04}\n",
            "0.8741086740526474\n",
            "              precision    recall  f1-score   support\n",
            "\n",
            "           0     0.9762    0.9600    0.9681    499068\n",
            "           1     0.7377    0.8278    0.7801     67744\n",
            "\n",
            "    accuracy                         0.9442    566812\n",
            "   macro avg     0.8570    0.8939    0.8741    566812\n",
            "weighted avg     0.9477    0.9442    0.9456    566812\n",
            "\n"
          ]
        }
      ],
      "source": [
        "from pyod.models.cblof import CBLOF\n",
        "\n",
        "n_est = [2,3,5,7,9,10]\n",
        "contamination = [0.001, 0.01, 0.04, 0.05, 0.1, 0.2]\n",
        "params = list(itertools.product(n_est, contamination))\n",
        "score = -1\n",
        "bs = None\n",
        "for n_est, con in tqdm(params):\n",
        "    \n",
        "    try:\n",
        "        clf_b = CBLOF(n_clusters=n_est, contamination=con)\n",
        "        clf_b.fit(raw_benign_train_samples)\n",
        "    except ValueError as e:\n",
        "        print(n_est)\n",
        "        continue  \n",
        "   \n",
        "    y_pred = clf_b.predict(raw_test_samples)\n",
        "    test_pred = y_pred\n",
        "\n",
        "    f1 = f1_score(raw_test_labels, test_pred, average='macro')\n",
        "\n",
        "    if f1 > score:\n",
        "        score = f1\n",
        "        best_params = {'n_estimators': n_est,\n",
        "                        \"con\": con\n",
        "                }\n",
        "        bs = test_pred\n",
        "    del clf_b\n",
        "    gc.collect()\n",
        "\n",
        "  \n",
        "\n",
        "print(best_params)\n",
        "print(score)\n",
        "print(classification_report(raw_test_labels, bs, digits=4))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "H-_InJ1-4mlc",
        "outputId": "e22139e6-d1cf-46e1-adf3-f0dc9b499244"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 36/36 [20:42<00:00, 34.51s/it]\n"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "benign only\n",
            "{'n_estimators': 2}\n",
            "0.8618432811826696\n",
            "              precision    recall  f1-score   support\n",
            "\n",
            "           0     0.9591    0.9806    0.9697    499068\n",
            "           1     0.8287    0.6916    0.7540     67744\n",
            "\n",
            "    accuracy                         0.9461    566812\n",
            "   macro avg     0.8939    0.8361    0.8618    566812\n",
            "weighted avg     0.9435    0.9461    0.9439    566812\n",
            "\n"
          ]
        }
      ],
      "source": [
        "n_est = [2,3,5,7,9,10]\n",
        "contamination = [0.001, 0.01, 0.04, 0.05, 0.1, 0.2]\n",
        "params = list(itertools.product(n_est, contamination))\n",
        "score = -1\n",
        "bs = None\n",
        "for n_est, con in tqdm(params):\n",
        "    \n",
        "    try:\n",
        "        clf_if = CBLOF(n_clusters=n_est, contamination=con)\n",
        "        clf_if.fit(raw_normal_train_samples)\n",
        "    except ValueError as e:\n",
        "        print(n_est)\n",
        "        continue  \n",
        "    \n",
        "    y_pred = clf_if.predict(raw_test_samples)\n",
        "    test_pred = y_pred\n",
        "\n",
        "    f1 = f1_score(raw_test_labels, test_pred, average='macro')\n",
        "\n",
        "    if f1 > score:\n",
        "        score = f1\n",
        "        best_params = {'n_estimators': n_est\n",
        "                }\n",
        "        bs = test_pred\n",
        "    del clf_if\n",
        "    gc.collect()\n",
        "\n",
        "        \n",
        "\n",
        "print(\"benign only\")\n",
        "print(best_params)\n",
        "print(score)\n",
        "print(classification_report(raw_test_labels, bs, digits=4))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "GneWZNtq4mlc"
      },
      "outputs": [],
      "source": []
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "nd0-H7UT4mlc"
      },
      "outputs": [],
      "source": [
        "# HBOS  Embeddings"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "a34ZbzAX4mld"
      },
      "outputs": [],
      "source": [
        "benign_train_samples = df_train[df_train.Label == 0].drop(columns=[\"Label\", \"Attack\"])\n",
        "normal_train_samples = df_train.drop(columns=[\"Label\", \"Attack\"])\n",
        "\n",
        "train_labels = df_train[\"Label\"]\n",
        "test_labels = df_test[\"Label\"]\n",
        "\n",
        "test_samples = df_test.drop(columns=[\"Label\", \"Attack\"])"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "sDquxErU4mld"
      },
      "outputs": [],
      "source": [
        "contamination = [0.001, 0.01, 0.04, 0.05, 0.1, 0.2]"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "SG5Hcs9r4mld"
      },
      "outputs": [],
      "source": []
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "xLBIT-Rc4mld",
        "outputId": "8162929e-4879-40e2-a040-afc57eafe7c5"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 36/36 [19:29<00:00, 32.49s/it]\n"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "{'n_estimators': 5, 'con': 0.01}\n",
            "0.945069359337394\n",
            "              precision    recall  f1-score   support\n",
            "\n",
            "           0     0.9845    0.9897    0.9871    996643\n",
            "           1     0.9213    0.8855    0.9030    135488\n",
            "\n",
            "    accuracy                         0.9772   1132131\n",
            "   macro avg     0.9529    0.9376    0.9451   1132131\n",
            "weighted avg     0.9769    0.9772    0.9770   1132131\n",
            "\n"
          ]
        }
      ],
      "source": [
        "from pyod.models.hbos import HBOS\n",
        "\n",
        "n_est = [5,10,15,20,25,30]\n",
        "params = list(itertools.product(n_est, contamination))\n",
        "score = -1\n",
        "bs = None\n",
        "for n_est, con in tqdm(params):\n",
        "    \n",
        "    clf_if = HBOS(n_bins=n_est, contamination=con)\n",
        "    clf_if.fit(benign_train_samples)\n",
        "    y_pred = clf_if.predict(test_samples)\n",
        "    test_pred = y_pred\n",
        "\n",
        "    f1 = f1_score(test_labels, test_pred, average='macro')\n",
        "\n",
        "    if f1 > score:\n",
        "        score = f1\n",
        "        best_params = {'n_estimators': n_est,\n",
        "                       \"con\": con\n",
        "                }\n",
        "        bs = test_pred\n",
        "    del clf_if\n",
        "    gc.collect()\n",
        "\n",
        "\n",
        "print(best_params)\n",
        "print(score)\n",
        "print(classification_report(test_labels, bs, digits=4))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "MDcX0mma4mld",
        "outputId": "a2b64cfc-d413-4ba0-9f24-b4935343c315"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 36/36 [21:10<00:00, 35.28s/it]\n"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "{'n_estimators': 5, 'con': 0.1}\n",
            "0.9189314026948445\n",
            "              precision    recall  f1-score   support\n",
            "\n",
            "           0     0.9705    0.9945    0.9824    996643\n",
            "           1     0.9503    0.7779    0.8555    135488\n",
            "\n",
            "    accuracy                         0.9686   1132131\n",
            "   macro avg     0.9604    0.8862    0.9189   1132131\n",
            "weighted avg     0.9681    0.9686    0.9672   1132131\n",
            "\n"
          ]
        }
      ],
      "source": [
        "n_est = [5,10,15,20,25,30]\n",
        "contamination = [0.001, 0.01, 0.04, 0.05, 0.1, 0.2]\n",
        "params = list(itertools.product(n_est, contamination))\n",
        "score = -1\n",
        "bs = None\n",
        "for n_est, con in tqdm(params):\n",
        "    \n",
        "    clf_if = HBOS(n_bins=n_est, contamination=con)\n",
        "    clf_if.fit(normal_train_samples)\n",
        "    y_pred = clf_if.predict(test_samples)\n",
        "    test_pred = y_pred\n",
        "\n",
        "    f1 = f1_score(test_labels, test_pred, average='macro')\n",
        "\n",
        "    if f1 > score:\n",
        "        score = f1\n",
        "        best_params = {'n_estimators': n_est,\n",
        "                       \"con\": con\n",
        "                }\n",
        "        bs = test_pred\n",
        "    del clf_if\n",
        "    gc.collect()\n",
        "\n",
        "\n",
        "print(best_params)\n",
        "print(score)\n",
        "print(classification_report(test_labels, bs, digits=4))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "wRUOrQqB4mle"
      },
      "outputs": [],
      "source": [
        "##  HBOS  RAw"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "9sZfAnER4mle",
        "outputId": "6e9cb145-8540-4aa7-8ed1-fc9aca495b07"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 36/36 [02:09<00:00,  3.59s/it]\n"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "{'n_estimators': 30, 'con': 0.04}\n",
            "0.8627757960209628\n",
            "              precision    recall  f1-score   support\n",
            "\n",
            "           0     0.9715    0.9601    0.9658    499068\n",
            "           1     0.7294    0.7928    0.7598     67744\n",
            "\n",
            "    accuracy                         0.9401    566812\n",
            "   macro avg     0.8505    0.8765    0.8628    566812\n",
            "weighted avg     0.9426    0.9401    0.9412    566812\n",
            "\n"
          ]
        }
      ],
      "source": [
        "from pyod.models.cblof import CBLOF\n",
        "\n",
        "n_est = [5,10,15,20,25,30]\n",
        "contamination = [0.001, 0.01, 0.04, 0.05, 0.1, 0.2]\n",
        "params = list(itertools.product(n_est, contamination))\n",
        "score = -1\n",
        "bs = None\n",
        "for n_est, con in tqdm(params):\n",
        "    \n",
        "    try:\n",
        "        clf_b = HBOS(n_bins=n_est, contamination=con)\n",
        "        clf_b.fit(raw_benign_train_samples)\n",
        "    except ValueError as e:\n",
        "        print(n_est)\n",
        "        continue  \n",
        "   \n",
        "    y_pred = clf_b.predict(raw_test_samples)\n",
        "    test_pred = y_pred\n",
        "\n",
        "    f1 = f1_score(raw_test_labels, test_pred, average='macro')\n",
        "\n",
        "    if f1 > score:\n",
        "        score = f1\n",
        "        best_params = {'n_estimators': n_est,\n",
        "                        \"con\": con\n",
        "                }\n",
        "        bs = test_pred\n",
        "    del clf_b\n",
        "    gc.collect()\n",
        "\n",
        "  \n",
        "\n",
        "print(best_params)\n",
        "print(score)\n",
        "print(classification_report(raw_test_labels, bs, digits=4))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "z5A-gLN34mle",
        "outputId": "8a6dfd26-a45b-4ce3-8d85-1b61652e7f90"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 36/36 [02:14<00:00,  3.74s/it]\n"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "benign only\n",
            "{'n_estimators': 5}\n",
            "0.7882018992795334\n",
            "              precision    recall  f1-score   support\n",
            "\n",
            "           0     0.9766    0.8943    0.9337    499068\n",
            "           1     0.5197    0.8422    0.6427     67744\n",
            "\n",
            "    accuracy                         0.8881    566812\n",
            "   macro avg     0.7481    0.8683    0.7882    566812\n",
            "weighted avg     0.9220    0.8881    0.8989    566812\n",
            "\n"
          ]
        }
      ],
      "source": [
        "n_est = [5,10,15,20,25,30]\n",
        "contamination = [0.001, 0.01, 0.04, 0.05, 0.1, 0.2]\n",
        "params = list(itertools.product(n_est, contamination))\n",
        "score = -1\n",
        "bs = None\n",
        "for n_est, con in tqdm(params):\n",
        "    \n",
        "    try:\n",
        "        clf_if = HBOS(n_bins=n_est, contamination=con)\n",
        "        clf_if.fit(raw_normal_train_samples)\n",
        "    except ValueError as e:\n",
        "        print(n_est)\n",
        "        continue  \n",
        "    \n",
        "    y_pred = clf_if.predict(raw_test_samples)\n",
        "    test_pred = y_pred\n",
        "\n",
        "    f1 = f1_score(raw_test_labels, test_pred, average='macro')\n",
        "\n",
        "    if f1 > score:\n",
        "        score = f1\n",
        "        best_params = {'n_estimators': n_est\n",
        "                }\n",
        "        bs = test_pred\n",
        "    del clf_if\n",
        "    gc.collect()\n",
        "\n",
        "        \n",
        "\n",
        "print(\"benign only\")\n",
        "print(best_params)\n",
        "print(score)\n",
        "print(classification_report(raw_test_labels, bs, digits=4))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "Z0ZCfgyi4mle"
      },
      "outputs": [],
      "source": []
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "UbDOqrcy4mle"
      },
      "outputs": [],
      "source": [
        "##  PCA  Emb"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "YDCu7S6i4mle"
      },
      "outputs": [],
      "source": []
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "Nga82Fw_4mle",
        "outputId": "0fe52043-af21-45c1-a404-040ab5845efc"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 36/36 [29:47<00:00, 49.66s/it]\n"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "{'n_estimators': 10, 'con': 0.001}\n",
            "0.9442956641768174\n",
            "              precision    recall  f1-score   support\n",
            "\n",
            "           0     0.9770    0.9988    0.9878    996643\n",
            "           1     0.9896    0.8267    0.9008    135488\n",
            "\n",
            "    accuracy                         0.9782   1132131\n",
            "   macro avg     0.9833    0.9127    0.9443   1132131\n",
            "weighted avg     0.9785    0.9782    0.9774   1132131\n",
            "\n"
          ]
        }
      ],
      "source": [
        "from pyod.models.pca import PCA\n",
        "n_est = [5,10,15,20,25,30]\n",
        "cont = [0.001, 0.01, 0.04, 0.05, 0.1, 0.2]\n",
        "params = list(itertools.product(n_est, cont))\n",
        "score = -1\n",
        "bs = None\n",
        "\n",
        "for n_est, con in tqdm(params):\n",
        "    clf_if = PCA(n_components=n_est, contamination=con)\n",
        "    clf_if.fit(benign_train_samples)\n",
        "    y_pred = clf_if.predict(test_samples)\n",
        "    test_pred = y_pred\n",
        "\n",
        "    f1 = f1_score(test_labels, test_pred, average='macro')\n",
        "\n",
        "    if f1 > score:\n",
        "        score = f1\n",
        "        best_params = {'n_estimators': n_est,\n",
        "                       \"con\": con\n",
        "                }\n",
        "        bs = test_pred\n",
        "    del clf_if\n",
        "    gc.collect()\n",
        "\n",
        "\n",
        "print(best_params)\n",
        "print(score)\n",
        "print(classification_report(test_labels, bs, digits=4))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "sg6AcAUW4mlf",
        "outputId": "a9949458-96cf-44dc-b4f6-c73458cb2719"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 36/36 [32:26<00:00, 54.07s/it]\n"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "{'n_estimators': 10, 'con': 0.1}\n",
            "0.9256946497974641\n",
            "              precision    recall  f1-score   support\n",
            "\n",
            "           0     0.9723    0.9955    0.9838    996643\n",
            "           1     0.9598    0.7916    0.8676    135488\n",
            "\n",
            "    accuracy                         0.9711   1132131\n",
            "   macro avg     0.9661    0.8935    0.9257   1132131\n",
            "weighted avg     0.9708    0.9711    0.9699   1132131\n",
            "\n"
          ]
        }
      ],
      "source": [
        "n_est = [5,10,15,20,25,30]\n",
        "cont = [0.001, 0.01, 0.04, 0.05, 0.1, 0.2]\n",
        "params = list(itertools.product(n_est, cont))\n",
        "score = -1\n",
        "bs = None\n",
        "\n",
        "for n_est, con in tqdm(params):\n",
        "    clf_if = PCA(n_components=n_est, contamination=con)\n",
        "    clf_if.fit(normal_train_samples)\n",
        "    y_pred = clf_if.predict(test_samples)\n",
        "    test_pred = y_pred\n",
        "\n",
        "    f1 = f1_score(test_labels, test_pred, average='macro')\n",
        "\n",
        "    if f1 > score:\n",
        "        score = f1\n",
        "        best_params = {'n_estimators': n_est,\n",
        "                       \"con\": con\n",
        "                }\n",
        "        bs = test_pred\n",
        "    del clf_if\n",
        "    gc.collect()\n",
        "\n",
        "\n",
        "print(best_params)\n",
        "print(score)\n",
        "print(classification_report(test_labels, bs, digits=4))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "JSoyZpDu4mlf"
      },
      "outputs": [],
      "source": [
        "##  PCA  RAw"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "3hKgicW14mlf",
        "outputId": "16c93b66-4eac-4d40-d5ce-96f3b3a5b3bb"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 36/36 [07:28<00:00, 12.47s/it]\n"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "{'n_estimators': 20, 'con': 0.1}\n",
            "0.7684270275042566\n",
            "              precision    recall  f1-score   support\n",
            "\n",
            "           0     0.9639    0.9009    0.9313    499068\n",
            "           1     0.5071    0.7513    0.6055     67744\n",
            "\n",
            "    accuracy                         0.8830    566812\n",
            "   macro avg     0.7355    0.8261    0.7684    566812\n",
            "weighted avg     0.9093    0.8830    0.8924    566812\n",
            "\n"
          ]
        }
      ],
      "source": [
        "n_est = [5,10,15,20,25,30]\n",
        "cont = [0.001, 0.01, 0.04, 0.05, 0.1, 0.2]\n",
        "params = list(itertools.product(n_est, cont))\n",
        "score = -1\n",
        "bs = None\n",
        "\n",
        "for n_est, con in tqdm(params):\n",
        "    clf_if = PCA(n_components=n_est, contamination=con)\n",
        "    clf_if.fit(raw_benign_train_samples)\n",
        "   \n",
        "    y_pred = clf_if.predict(raw_test_samples)\n",
        "    test_pred = y_pred\n",
        "\n",
        "    f1 = f1_score(raw_test_labels, test_pred, average='macro')\n",
        "\n",
        "    if f1 > score:\n",
        "        score = f1\n",
        "        best_params = {'n_estimators': n_est,\n",
        "                        \"con\": con\n",
        "                }\n",
        "        bs = test_pred\n",
        "    del clf_if\n",
        "    gc.collect()\n",
        "\n",
        "  \n",
        "\n",
        "print(best_params)\n",
        "print(score)\n",
        "print(classification_report(raw_test_labels, bs, digits=4))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "nAdfwnlP4mlf",
        "outputId": "ddc9c2b4-a3b6-4ab6-cc74-7ed93ca23d22"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 36/36 [08:04<00:00, 13.46s/it]\n"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "benign only\n",
            "{'n_estimators': 10}\n",
            "0.7376147683157477\n",
            "              precision    recall  f1-score   support\n",
            "\n",
            "           0     0.9622    0.8744    0.9162    499068\n",
            "           1     0.4466    0.7471    0.5590     67744\n",
            "\n",
            "    accuracy                         0.8591    566812\n",
            "   macro avg     0.7044    0.8107    0.7376    566812\n",
            "weighted avg     0.9006    0.8591    0.8735    566812\n",
            "\n"
          ]
        }
      ],
      "source": [
        "n_est = [5,10,15,20,25,30]\n",
        "cont = [0.001, 0.01, 0.04, 0.05, 0.1, 0.2]\n",
        "params = list(itertools.product(n_est, cont))\n",
        "score = -1\n",
        "bs = None\n",
        "\n",
        "for n_est, con in tqdm(params):\n",
        "    clf_if = PCA(n_components=n_est, contamination=con)\n",
        "    clf_if.fit(raw_normal_train_samples)\n",
        "\n",
        "    y_pred = clf_if.predict(raw_test_samples)\n",
        "    test_pred = y_pred\n",
        "\n",
        "    f1 = f1_score(raw_test_labels, test_pred, average='macro')\n",
        "\n",
        "    if f1 > score:\n",
        "        score = f1\n",
        "        best_params = {'n_estimators': n_est\n",
        "                }\n",
        "        bs = test_pred\n",
        "    del clf_if\n",
        "    gc.collect()\n",
        "\n",
        "        \n",
        "\n",
        "print(\"benign only\")\n",
        "print(best_params)\n",
        "print(score)\n",
        "print(classification_report(raw_test_labels, bs, digits=4))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "ZdfI45oD4mlg"
      },
      "outputs": [],
      "source": []
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "WSNV8IRT4mlg"
      },
      "outputs": [],
      "source": []
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "yi8SO3tL4mlg"
      },
      "outputs": [],
      "source": [
        "##  IF  Emb"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "9D0m4vb04mlg",
        "outputId": "bd5a55e6-ac70-4943-9b28-92474b5fb9e9"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 24/24 [3:09:47<00:00, 474.46s/it]  \n"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "{'n_estimators': 20, 'con': 0.001}\n",
            "0.9538863735449246\n",
            "              precision    recall  f1-score   support\n",
            "\n",
            "           0     0.9805    0.9992    0.9897    996643\n",
            "           1     0.9928    0.8538    0.9180    135488\n",
            "\n",
            "    accuracy                         0.9818   1132131\n",
            "   macro avg     0.9866    0.9265    0.9539   1132131\n",
            "weighted avg     0.9820    0.9818    0.9812   1132131\n",
            "\n"
          ]
        }
      ],
      "source": [
        "from sklearn.ensemble import IsolationForest\n",
        "n_est = [20, 50, 100, 150]\n",
        "cont = [0.001, 0.01, 0.04, 0.05, 0.1, 0.2]\n",
        "params = list(itertools.product(n_est, cont))\n",
        "score = -1\n",
        "bs = None\n",
        "\n",
        "for n_est, con in tqdm(params):\n",
        "    clf_if = IsolationForest(n_estimators=n_est, contamination=con)\n",
        "    clf_if.fit(benign_train_samples)\n",
        "    y_pred = clf_if.predict(test_samples)\n",
        "    test_pred = list(map(lambda x : 0 if x == 1 else 1, y_pred))\n",
        "\n",
        "    f1 = f1_score(test_labels, test_pred, average='macro')\n",
        "\n",
        "    if f1 > score:\n",
        "        score = f1\n",
        "        best_params = {'n_estimators': n_est,\n",
        "                       \"con\": con\n",
        "                }\n",
        "        bs = test_pred\n",
        "    del clf_if\n",
        "    gc.collect()\n",
        "\n",
        "\n",
        "print(best_params)\n",
        "print(score)\n",
        "print(classification_report(test_labels, bs, digits=4))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "NCj-3u4t4mlg",
        "outputId": "5f6b1720-9662-4704-ba96-dd57ee32a900"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 24/24 [3:31:56<00:00, 529.86s/it]  \n"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "{'n_estimators': 50, 'con': 0.2}\n",
            "0.8110535459623227\n",
            "              precision    recall  f1-score   support\n",
            "\n",
            "           0     0.9878    0.8952    0.9392    996643\n",
            "           1     0.5436    0.9184    0.6829    135488\n",
            "\n",
            "    accuracy                         0.8979   1132131\n",
            "   macro avg     0.7657    0.9068    0.8111   1132131\n",
            "weighted avg     0.9346    0.8979    0.9085   1132131\n",
            "\n"
          ]
        }
      ],
      "source": [
        "from sklearn.ensemble import IsolationForest\n",
        "\n",
        "n_est = [20, 50, 100, 150]\n",
        "cont = [0.001, 0.01, 0.04, 0.05, 0.1, 0.2]\n",
        "params = list(itertools.product(n_est, cont))\n",
        "score = -1\n",
        "bs = None\n",
        "\n",
        "for n_est, con in tqdm(params):\n",
        "    clf_if = IsolationForest(n_estimators=n_est, contamination=con)\n",
        "    clf_if.fit(normal_train_samples)\n",
        "    y_pred = clf_if.predict(test_samples)\n",
        "    test_pred = list(map(lambda x : 0 if x == 1 else 1, y_pred))\n",
        "\n",
        "    f1 = f1_score(test_labels, test_pred, average='macro')\n",
        "\n",
        "    if f1 > score:\n",
        "        score = f1\n",
        "        best_params = {'n_estimators': n_est,\n",
        "                       \"con\": con\n",
        "                }\n",
        "        bs = test_pred\n",
        "    del clf_if\n",
        "    gc.collect()\n",
        "\n",
        "\n",
        "print(best_params)\n",
        "print(score)\n",
        "print(classification_report(test_labels, bs, digits=4))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "iOIn_Kr44mlg"
      },
      "outputs": [],
      "source": [
        "##  IF  Raw"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "E_60yAo34mlg",
        "outputId": "354e56cd-ee22-4538-ba6f-43c1d67eb648"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 24/24 [19:12<00:00, 48.03s/it]\n"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "{'n_estimators': 20, 'con': 0.05}\n",
            "0.8176793439704795\n",
            "              precision    recall  f1-score   support\n",
            "\n",
            "           0     0.9599    0.9494    0.9547    499068\n",
            "           1     0.6553    0.7082    0.6807     67744\n",
            "\n",
            "    accuracy                         0.9206    566812\n",
            "   macro avg     0.8076    0.8288    0.8177    566812\n",
            "weighted avg     0.9235    0.9206    0.9219    566812\n",
            "\n"
          ]
        }
      ],
      "source": [
        "from sklearn.ensemble import IsolationForest\n",
        "\n",
        "n_est = [20, 50, 100, 150]\n",
        "cont = [0.001, 0.01, 0.04, 0.05, 0.1, 0.2]\n",
        "params = list(itertools.product(n_est, cont))\n",
        "score = -1\n",
        "bs = None\n",
        "\n",
        "for n_est, con in tqdm(params):\n",
        "    clf_if = IsolationForest(n_estimators=n_est, contamination=con)\n",
        "    clf_if.fit(raw_benign_train_samples.to_numpy())\n",
        "   \n",
        "    y_pred = clf_if.predict(raw_test_samples.to_numpy())\n",
        "    test_pred = list(map(lambda x : 0 if x == 1 else 1, y_pred))\n",
        "\n",
        "    f1 = f1_score(raw_test_labels, test_pred, average='macro')\n",
        "\n",
        "    if f1 > score:\n",
        "        score = f1\n",
        "        best_params = {'n_estimators': n_est,\n",
        "                        \"con\": con\n",
        "                }\n",
        "        bs = test_pred\n",
        "    del clf_if\n",
        "    gc.collect()\n",
        "\n",
        "  \n",
        "\n",
        "print(best_params)\n",
        "print(score)\n",
        "print(classification_report(raw_test_labels, bs, digits=4))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "5xNKBA7X4mlh",
        "outputId": "cd0ee1c5-5394-4e2b-efde-1f58bf922282"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 24/24 [20:38<00:00, 51.60s/it]\n"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "benign only\n",
            "{'n_estimators': 100}\n",
            "0.7409370706714709\n",
            "              precision    recall  f1-score   support\n",
            "\n",
            "           0     0.9633    0.8755    0.9173    499068\n",
            "           1     0.4512    0.7539    0.5646     67744\n",
            "\n",
            "    accuracy                         0.8610    566812\n",
            "   macro avg     0.7072    0.8147    0.7409    566812\n",
            "weighted avg     0.9021    0.8610    0.8751    566812\n",
            "\n"
          ]
        }
      ],
      "source": [
        "n_est = [20, 50, 100, 150]\n",
        "cont = [0.001, 0.01, 0.04, 0.05, 0.1, 0.2]\n",
        "params = list(itertools.product(n_est, cont))\n",
        "score = -1\n",
        "bs = None\n",
        "\n",
        "for n_est, con in tqdm(params):\n",
        "    clf_if = IsolationForest(n_estimators=n_est, contamination=con)\n",
        "    clf_if.fit(raw_normal_train_samples.to_numpy())\n",
        "\n",
        "    y_pred = clf_if.predict(raw_test_samples.to_numpy())\n",
        "    test_pred = list(map(lambda x : 0 if x == 1 else 1, y_pred))\n",
        "\n",
        "    f1 = f1_score(raw_test_labels, test_pred, average='macro')\n",
        "\n",
        "    if f1 > score:\n",
        "        score = f1\n",
        "        best_params = {'n_estimators': n_est\n",
        "                }\n",
        "        bs = test_pred\n",
        "    del clf_if\n",
        "    gc.collect()\n",
        "\n",
        "        \n",
        "\n",
        "print(\"benign only\")\n",
        "print(best_params)\n",
        "print(score)\n",
        "print(classification_report(raw_test_labels, bs, digits=4))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "HYBqJ8y14mlh"
      },
      "outputs": [],
      "source": []
    }
  ],
  "metadata": {
    "accelerator": "GPU",
    "colab": {
      "provenance": []
    },
    "kernelspec": {
      "display_name": "Python 3",
      "language": "python",
      "name": "python3"
    },
    "language_info": {
      "codemirror_mode": {
        "name": "ipython",
        "version": 3
      },
      "file_extension": ".py",
      "mimetype": "text/x-python",
      "name": "python",
      "nbconvert_exporter": "python",
      "pygments_lexer": "ipython3",
      "version": "3.8.8"
    }
  },
  "nbformat": 4,
  "nbformat_minor": 0
}