ids_classifiers.ipynb

{
  "nbformat": 4,
  "nbformat_minor": 0,
  "metadata": {
    "colab": {
      "name": "cicids_classifiers.ipynb",
      "provenance": [],
      "collapsed_sections": [],
      "authorship_tag": "ABX9TyMPvuZynOcEHc88L0xhoJSB",
      "include_colab_link": true
    },
    "kernelspec": {
      "name": "python3",
      "display_name": "Python 3"
    }
  },
  "cells": [
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "view-in-github",
        "colab_type": "text"
      },
      "source": [
        "<a href=\"https://colab.research.google.com/github/r-dube/CICIDS/blob/main/cicids_classifiers.ipynb\" target=\"_parent\"><img src=\"https://colab.research.google.com/assets/colab-badge.svg\" alt=\"Open In Colab\"/></a>"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "NFWTUL3GCHsG"
      },
      "source": [
        "# Load the top modules that are used in multiple places\n",
        "import numpy as np\n",
        "import pandas as pd"
      ],
      "execution_count": 14,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "rrnTamUHDzxI"
      },
      "source": [
        "# Some global variables to drive the script\n",
        "# data_url is the location of the data\n",
        "# Data is not loaded from a local file\n",
        "# Data is loaded from a prepocessed dataset\n",
        "data_url=\"https://raw.githubusercontent.com/r-dube/CICIDS/main/MachineLearningCVE/processed/bal-cicids2017.csv\""
      ],
      "execution_count": 15,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "bYEbuZO0MHyf"
      },
      "source": [
        "# Column name mapping from original data to compact form\n",
        "# All the X** are features and the YY is the label\n",
        "feature_map = {\n",
        " ' Destination Port' : 'X1',\n",
        " ' Flow Duration' : 'X2', \n",
        " ' Total Fwd Packets' : 'X3', \n",
        " ' Total Backward Packets' : 'X4', \n",
        " 'Total Length of Fwd Packets' : 'X5', \n",
        " ' Total Length of Bwd Packets' : 'X6', \n",
        " ' Fwd Packet Length Max' : 'X7', \n",
        " ' Fwd Packet Length Min' : 'X8', \n",
        " ' Fwd Packet Length Mean' : 'X9', \n",
        " ' Fwd Packet Length Std' : 'X10', \n",
        " 'Bwd Packet Length Max' : 'X11', \n",
        " ' Bwd Packet Length Min' : 'X12', \n",
        " ' Bwd Packet Length Mean' : 'X13', \n",
        " ' Bwd Packet Length Std' : 'X14', \n",
        " 'Flow Bytes/s' : 'X15', \n",
        " ' Flow Packets/s' : 'X16', \n",
        " ' Flow IAT Mean' : 'X17', \n",
        " ' Flow IAT Std' : 'X18', \n",
        " ' Flow IAT Max' : 'X19', \n",
        " ' Flow IAT Min' : 'X20', \n",
        " 'Fwd IAT Total' : 'X21', \n",
        " ' Fwd IAT Mean' : 'X22', \n",
        " ' Fwd IAT Std' : 'X23', \n",
        " ' Fwd IAT Max' : 'X24', \n",
        " ' Fwd IAT Min' : 'X25', \n",
        " 'Bwd IAT Total' : 'X26', \n",
        " ' Bwd IAT Mean' : 'X27', \n",
        " ' Bwd IAT Std' : 'X28', \n",
        " ' Bwd IAT Max' : 'X29', \n",
        " ' Bwd IAT Min' : 'X30', \n",
        " 'Fwd PSH Flags' : 'X31', \n",
        " ' Bwd PSH Flags' : 'X32', \n",
        " ' Fwd URG Flags' : 'X33', \n",
        " ' Bwd URG Flags' : 'X34', \n",
        " ' Fwd Header Length' : 'X35', \n",
        " ' Bwd Header Length' : 'X36', \n",
        " 'Fwd Packets/s' : 'X37', \n",
        " ' Bwd Packets/s' : 'X38', \n",
        " ' Min Packet Length' : 'X39', \n",
        " ' Max Packet Length' : 'X40', \n",
        " ' Packet Length Mean' : 'X41', \n",
        " ' Packet Length Std' : 'X42', \n",
        " ' Packet Length Variance' : 'X43', \n",
        " 'FIN Flag Count' : 'X44', \n",
        " ' SYN Flag Count' : 'X45', \n",
        " ' RST Flag Count' : 'X46', \n",
        " ' PSH Flag Count' : 'X47', \n",
        " ' ACK Flag Count' : 'X48', \n",
        " ' URG Flag Count' : 'X49', \n",
        " ' CWE Flag Count' : 'X50', \n",
        " ' ECE Flag Count' : 'X51', \n",
        " ' Down/Up Ratio' : 'X52', \n",
        " ' Average Packet Size' : 'X53', \n",
        " ' Avg Fwd Segment Size' : 'X54', \n",
        " ' Avg Bwd Segment Size' : 'X55', \n",
        " ' Fwd Header Length.1' : 'X56', \n",
        " 'Fwd Avg Bytes/Bulk' : 'X57', \n",
        " ' Fwd Avg Packets/Bulk' : 'X58', \n",
        " ' Fwd Avg Bulk Rate' : 'X59', \n",
        " ' Bwd Avg Bytes/Bulk' : 'X60', \n",
        " ' Bwd Avg Packets/Bulk' : 'X61', \n",
        " 'Bwd Avg Bulk Rate' : 'X62', \n",
        " 'Subflow Fwd Packets' : 'X63', \n",
        " ' Subflow Fwd Bytes' : 'X64', \n",
        " ' Subflow Bwd Packets' : 'X65', \n",
        " ' Subflow Bwd Bytes' : 'X66', \n",
        " 'Init_Win_bytes_forward' : 'X67', \n",
        " ' Init_Win_bytes_backward' : 'X68', \n",
        " ' act_data_pkt_fwd' : 'X69', \n",
        " ' min_seg_size_forward' : 'X70', \n",
        " 'Active Mean' : 'X71', \n",
        " ' Active Std' : 'X72', \n",
        " ' Active Max' : 'X73', \n",
        " ' Active Min' : 'X74', \n",
        " 'Idle Mean' : 'X75', \n",
        " ' Idle Std' : 'X76', \n",
        " ' Idle Max' : 'X77', \n",
        " ' Idle Min' : 'X78', \n",
        " ' Label': 'YY'\n",
        "}\n",
        "\n",
        "# label names (YY) in the data and their\n",
        "# mapping to numerical values\n",
        "label_map = {\n",
        " 'BENIGN' : 0,\n",
        " 'FTP-Patator' : 1,\n",
        " 'SSH-Patator' : 2,\n",
        " 'DoS slowloris' : 3,\n",
        " 'DoS Slowhttptest': 4,\n",
        " 'DoS Hulk' : 5,\n",
        " 'DoS GoldenEye' : 6,\n",
        " 'Heartbleed' : 7,\n",
        " 'Web Attack � Brute Force' : 8,\n",
        " 'Web Attack � XSS' : 8,\n",
        " 'Web Attack � Sql Injection' : 8,\n",
        " 'Infiltration' : 9,\n",
        " 'Bot' : 10,\n",
        " 'PortScan' : 11,\n",
        " 'DDoS' : 12,\n",
        "}\n",
        "\n",
        "num_ids_features = 76\n",
        "num_ids_classes = 13\n",
        "ids_classes = [ 'BENIGN', 'FTP-Patator', 'SSH-Patator', 'DoS slowloris', 'DoS Slowhttptest', 'DoS Hulk', 'DoS GoldenEye', 'Heartbleed', 'Brute Force', 'XSS', 'Sql Injection', 'Infiltration', 'Bot', 'PortScan', 'DDoS',]"
      ],
      "execution_count": 16,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "usYPD_l1Bimz"
      },
      "source": [
        "# Utility functions used by classifiers\n",
        "# In particular to load and split data and output results\n",
        "def ids_load_df_from_csv():\n",
        "    \"\"\"\n",
        "    Load dataframe from csv file\n",
        "    Input:\n",
        "        None\n",
        "    Returns:\n",
        "        None\n",
        "    \"\"\"\n",
        "\n",
        "    df = pd.read_csv(data_url)\n",
        "\n",
        "    print (\"load Dataframe shape\", df.shape)\n",
        "\n",
        "    return df\n",
        "\n",
        "def ids_split(df):\n",
        "    \"\"\"\n",
        "    Input:\n",
        "        Dataframe that has columns of covariates followed by a column of labels\n",
        "    Returns:\n",
        "        X_train, X_val, X_test, y_train, y_val, y_test as numpy arrays\n",
        "    \"\"\"\n",
        "\n",
        "    from sklearn.model_selection import train_test_split\n",
        "    from sklearn.preprocessing import StandardScaler\n",
        "\n",
        "    numcols = len(df.columns)\n",
        "    print(\"df.shape\", df.shape)\n",
        "\n",
        "    X = df.iloc[:, 0:numcols-1]\n",
        "    y = df.loc[:, 'YY']\n",
        "\n",
        "    X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.15, random_state=42)\n",
        "    X_train, X_val, y_train, y_val = train_test_split(X_train, y_train, test_size=0.15, random_state=42)\n",
        "    print (\"X_train.shape\", X_train.shape, \"y_train.shape\", y_train.shape)\n",
        "    print (\"X_val.shape\", X_val.shape, \"y_val.shape\", y_val.shape)\n",
        "    print (\"X_test.shape\", X_test.shape, \"y_test.shape\", y_test.shape)\n",
        "\n",
        "    scaler = StandardScaler()\n",
        "    X_train = scaler.fit_transform(X_train)\n",
        "    X_val = scaler.transform(X_val)\n",
        "    X_test = scaler.transform(X_test)\n",
        "    y_train = y_train.values\n",
        "    y_val = y_val.values\n",
        "    y_test = y_test.values\n",
        "\n",
        "    return X_train, X_val, X_test, y_train, y_val, y_test\n",
        "\n",
        "def ids_accuracy (y_actual, y_pred):\n",
        "    \"\"\"\n",
        "    Input:\n",
        "        Numpy arrays with actual and predicted labels\n",
        "    Returns:\n",
        "        multiclass accuracy and f1 scores; two class accuracy and f1 scores\n",
        "    \"\"\"\n",
        "\n",
        "    from sklearn.metrics import accuracy_score\n",
        "    from sklearn.metrics import f1_score\n",
        "\n",
        "    # modify labels to get results for two class classification\n",
        "    y_actual_2 = (y_actual > 0).astype(int)\n",
        "    y_pred_2 = (y_pred > 0).astype(int)\n",
        "\n",
        "    acc = accuracy_score (y_actual, y_pred)\n",
        "    f1 = f1_score(y_actual, y_pred, average='macro')\n",
        "    acc_2 = accuracy_score (y_actual_2, y_pred_2)\n",
        "    f1_2 = f1_score(y_actual_2, y_pred_2)\n",
        "    \n",
        "    return acc, f1, acc_2, f1_2\n",
        "    \n",
        "\n",
        "def ids_metrics(y_actual, y_pred):\n",
        "    \"\"\"\n",
        "    Input:\n",
        "        Numpy arrays with actual and predicted labels\n",
        "    Returns:\n",
        "        None\n",
        "    Print: various classification metrics\n",
        "    \"\"\"\n",
        "\n",
        "    from sklearn.metrics import confusion_matrix\n",
        "\n",
        "    cm = confusion_matrix (y_actual, y_pred)\n",
        "    print (cm)\n",
        "\n",
        "    acc, f1, acc_2, f1_2 = ids_accuracy (y_actual, y_pred)\n",
        "    print('Classifier accuracy : {:.4f}'.format(acc), 'F1 score: {:.4f}'.format(f1))\n",
        "    print('Two class classifier accuracy : {:.4f}'.format(acc_2), 'F1 score: {:.4f}'.format(f1_2))\n"
      ],
      "execution_count": 17,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "7R8jV1u8ItPu"
      },
      "source": [
        "# Classification using Logistic regression\n",
        "from sklearn.linear_model import LogisticRegression\n",
        "\n",
        "def ids_logistic():\n",
        "    \"\"\"\n",
        "    Classify processed data set stored as csv file using logistic regression\n",
        "    Print: accuracy, confusion matrix, f1 score on the validation data set\n",
        "    Input:\n",
        "        None    \n",
        "    Returns:\n",
        "        None\n",
        "    \"\"\"\n",
        "\n",
        "    df = ids_load_df_from_csv ()\n",
        "    X_train, X_val, X_test, y_train, y_val, y_test = ids_split(df)\n",
        "\n",
        "    # max_iter could be set to a large value (10000) to prevent \n",
        "    # LogisticRegression() from complaining that # it is not coverging\n",
        "    logreg = LogisticRegression(max_iter=100)\n",
        "    logreg.fit(X_train, y_train)\n",
        "\n",
        "    y_pred = logreg.predict(X_val)\n",
        "    \n",
        "    ids_metrics(y_val, y_pred)"
      ],
      "execution_count": 18,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "dO6X7JRpJDMr",
        "outputId": "32b94a18-d81a-403a-e99d-e080afedcd03",
        "colab": {
          "base_uri": "https://localhost:8080/"
        }
      },
      "source": [
        "ids_logistic()"
      ],
      "execution_count": 19,
      "outputs": [
        {
          "output_type": "stream",
          "text": [
            "load Dataframe shape (136000, 77)\n",
            "df.shape (136000, 77)\n",
            "X_train.shape (98260, 76) y_train.shape (98260,)\n",
            "X_val.shape (17340, 76) y_val.shape (17340,)\n",
            "X_test.shape (20400, 76) y_test.shape (20400,)\n",
            "[[4514   21   73    9   24   68   11    0   45   23  239   94   57]\n",
            " [   2 1042    2    0    0    1    0    0    0    0    0    0    0]\n",
            " [   3    4 1033    0    0    1    0    0    0    0    0    0    0]\n",
            " [  36   15    2  931   14    0    0    0    1    0    1    0    0]\n",
            " [  10    0    5   54  911    0    1    0    2    0    0    0    0]\n",
            " [  16    0    0    0    1 1025    1    0    0    0    0    0    9]\n",
            " [  11    0   14    1    1    1 1005    0    4    0    0    0    0]\n",
            " [   0    0    0    0    0    0    0 1039    0    0    0    0    0]\n",
            " [   1    0   79    0    0   12    7    0  925    0    0    0    0]\n",
            " [  24   26    0    0    0    0    0    0    0  959    0    0   28]\n",
            " [  60    0    0    0    0    0    0    0    0    0  643  271    0]\n",
            " [   0    1    0    2    0    1    0    0    4    0    1  993    0]\n",
            " [   1    0    0    0    0    1    0    0    0    0    0    0  924]]\n",
            "Classifier accuracy : 0.9195 F1 score: 0.9197\n",
            "Two class classifier accuracy : 0.9522 F1 score: 0.9666\n"
          ],
          "name": "stdout"
        },
        {
          "output_type": "stream",
          "text": [
            "/usr/local/lib/python3.6/dist-packages/sklearn/linear_model/_logistic.py:940: ConvergenceWarning: lbfgs failed to converge (status=1):\n",
            "STOP: TOTAL NO. of ITERATIONS REACHED LIMIT.\n",
            "\n",
            "Increase the number of iterations (max_iter) or scale the data as shown in:\n",
            "    https://scikit-learn.org/stable/modules/preprocessing.html\n",
            "Please also refer to the documentation for alternative solver options:\n",
            "    https://scikit-learn.org/stable/modules/linear_model.html#logistic-regression\n",
            "  extra_warning_msg=_LOGISTIC_SOLVER_CONVERGENCE_MSG)\n"
          ],
          "name": "stderr"
        }
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "7Yj51Cg7LiCa"
      },
      "source": [
        "''' \n",
        "Fully connected three layer neural network using PyTorch\n",
        "With utility functions based on deeplizard tutorial\n",
        "https://deeplizard.com/learn/video/v5cngxo4mIg\n",
        "'''\n",
        "\n",
        "# Imports\n",
        "import torch\n",
        "import torch.nn as nn\n",
        "import torch.optim as optim\n",
        "import torch.nn.functional as F\n",
        "import torchvision\n",
        "import torchvision.transforms as transforms\n",
        "\n",
        "from torch.utils.data import TensorDataset, DataLoader\n",
        "from IPython.display import display, clear_output\n",
        "import pandas as pd\n",
        "import time\n",
        "\n",
        "from itertools import product\n",
        "from collections import namedtuple\n",
        "from collections import OrderedDict\n",
        "\n",
        "from sklearn.preprocessing import StandardScaler\n",
        "from sklearn.metrics import accuracy_score\n",
        "from sklearn.metrics import confusion_matrix\n",
        "from sklearn.metrics import f1_score\n",
        "\n",
        "class RunBuilder():\n",
        "    @staticmethod\n",
        "    def get_runs(params):\n",
        "        Run = namedtuple('Run', params.keys())\n",
        "        runs = []\n",
        "        for v in product(*params.values()):\n",
        "            runs.append(Run(*v))\n",
        "        return runs\n",
        "    \n",
        "class RunManager():\n",
        "    def __init__(self):\n",
        "        self.epoch_count = 0\n",
        "        self.epoch_loss = 0\n",
        "        self.epoch_num_correct = 0\n",
        "        self.epoch_start_time = None\n",
        "    \n",
        "        self.run_params = None\n",
        "        self.run_count = 0\n",
        "        self.run_data = []\n",
        "        self.run_start_time = None\n",
        "    \n",
        "        self.network = None\n",
        "\n",
        "    def begin_run(self, run, network, loss_fn, train_inputs, train_targets, X_val, y_val):\n",
        "        self.run_start_time = time.time()\n",
        "        self.run_params = run\n",
        "        self.run_count += 1\n",
        "    \n",
        "        self.network = network\n",
        "        self.loss_fn = loss_fn\n",
        "        self.train_inputs = train_inputs\n",
        "        self.train_targets = train_targets\n",
        "        self.X_val = X_val\n",
        "        self.y_val = y_val\n",
        "\n",
        "    def end_run(self):\n",
        "        self.epoch_count = 0\n",
        "\n",
        "    def begin_epoch(self):\n",
        "        self.epoch_start_time = time.time()\n",
        "        self.epoch_count += 1\n",
        "        self.epoch_loss = 0\n",
        "        self.epoch_num_correct = 0\n",
        "\n",
        "    def end_epoch(self):\n",
        "        epoch_duration = time.time() - self.epoch_start_time\n",
        "        run_duration = time.time() - self.run_start_time\n",
        "\n",
        "        with torch.no_grad():\n",
        "            loss = (self.loss_fn(self.network(self.train_inputs), self.train_targets)).item()\n",
        "\n",
        "            val_inputs = torch.from_numpy(self.X_val).float()\n",
        "            val_preds = self.network(val_inputs)\n",
        "            y_pred = val_preds.argmax(dim=1)\n",
        "            accuracy = accuracy_score (self.y_val, y_pred)\n",
        "    \n",
        "        results = OrderedDict()\n",
        "        results[\"run\"] = self.run_count\n",
        "        results[\"epoch\"] = self.epoch_count\n",
        "        results['loss'] = loss\n",
        "        results[\"accuracy\"] = accuracy\n",
        "        results['epoch duration'] = epoch_duration\n",
        "        results['run duration'] = run_duration\n",
        "        for k,v in self.run_params._asdict().items(): results[k] = v\n",
        "        self.run_data.append(results)\n",
        "    \n",
        "def ids_nn():\n",
        "    params = OrderedDict(\n",
        "        lr = [.008]\n",
        "        ,batch_size = [256]\n",
        "        ,num_epochs = [10]\n",
        "        ,step_size = [5]\n",
        "        ,gamma = [0.50]\n",
        "    )\n",
        "\n",
        "    rm = RunManager()\n",
        "\n",
        "    df = ids_load_df_from_csv ()\n",
        "    X_train, X_val, X_test, y_train, y_val, y_test = ids_split(df)\n",
        "    train_inputs = torch.from_numpy(X_train).float()\n",
        "    train_targets = torch.from_numpy(y_train).long()\n",
        "    train_ds = TensorDataset(train_inputs, train_targets)\n",
        "\n",
        "    # Run for each combination of params\n",
        "    for run in RunBuilder.get_runs(params):\n",
        "        torch.manual_seed(42)\n",
        "        print (run)\n",
        "\n",
        "        network = nn.Sequential(\n",
        "            nn.Linear(num_ids_features, num_ids_features)\n",
        "            ,nn.ReLU()\n",
        "            ,nn.Linear(num_ids_features, num_ids_classes)\n",
        "        )\n",
        "\n",
        "        train_dl = DataLoader(train_ds, run.batch_size, shuffle=True)\n",
        "        opt = torch.optim.Adam(network.parameters(), run.lr)\n",
        "        sch = torch.optim.lr_scheduler.StepLR(opt, run.step_size, run.gamma)\n",
        "        loss_fn = F.cross_entropy\n",
        "\n",
        "        rm.begin_run(run, network, loss_fn, train_inputs, train_targets, X_val, y_val) \n",
        "        # Training loop\n",
        "        for epoch in range(run.num_epochs):\n",
        "            rm.begin_epoch()\n",
        "\n",
        "            for xb,yb in train_dl:\n",
        "                pred = network(xb)\n",
        "                loss = loss_fn(pred, yb)\n",
        "                loss.backward()\n",
        "                opt.step()\n",
        "                opt.zero_grad()\n",
        "\n",
        "            rm.end_epoch()\n",
        "            sch.step() \n",
        "        rm.end_run()\n",
        "\n",
        "    print(pd.DataFrame.from_dict(rm.run_data))\n",
        "    \n",
        "    val_inputs = torch.from_numpy(X_val).float()\n",
        "    val_pred = network(val_inputs)\n",
        "\n",
        "    # Since the model returns values for all num_ids_classes\n",
        "    # The ids_class with the maximim value is picked as the label\n",
        "    val_pred = val_pred.argmax(dim=1)\n",
        "\n",
        "    # A numpy array is needed to evaluate metrics\n",
        "    y_pred = val_pred.detach().to('cpu').numpy()\n",
        "    ids_metrics(y_val, y_pred)"
      ],
      "execution_count": 20,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "AY7dyrP8L1Cx",
        "outputId": "30a37174-886c-49e1-f9eb-542cda27b3a7",
        "colab": {
          "base_uri": "https://localhost:8080/"
        }
      },
      "source": [
        "ids_nn()"
      ],
      "execution_count": 21,
      "outputs": [
        {
          "output_type": "stream",
          "text": [
            "load Dataframe shape (136000, 77)\n",
            "df.shape (136000, 77)\n",
            "X_train.shape (98260, 76) y_train.shape (98260,)\n",
            "X_val.shape (17340, 76) y_val.shape (17340,)\n",
            "X_test.shape (20400, 76) y_test.shape (20400,)\n",
            "Run(lr=0.008, batch_size=256, num_epochs=10, step_size=5, gamma=0.5)\n",
            "   run  epoch      loss  accuracy  ...  batch_size  num_epochs  step_size  gamma\n",
            "0    1      1  0.137854  0.955248  ...         256          10          5    0.5\n",
            "1    1      2  0.134446  0.956747  ...         256          10          5    0.5\n",
            "2    1      3  0.111128  0.960727  ...         256          10          5    0.5\n",
            "3    1      4  0.099807  0.963668  ...         256          10          5    0.5\n",
            "4    1      5  0.095310  0.965167  ...         256          10          5    0.5\n",
            "5    1      6  0.079728  0.970069  ...         256          10          5    0.5\n",
            "6    1      7  0.087075  0.968051  ...         256          10          5    0.5\n",
            "7    1      8  0.078842  0.971569  ...         256          10          5    0.5\n",
            "8    1      9  0.075764  0.973068  ...         256          10          5    0.5\n",
            "9    1     10  0.076526  0.973818  ...         256          10          5    0.5\n",
            "\n",
            "[10 rows x 11 columns]\n",
            "[[4921    9    5    2    4   28    2    0   27    7   92   80    1]\n",
            " [   1 1034    1   10    0    1    0    0    0    0    0    0    0]\n",
            " [   7    2 1027    0    0    1    3    0    1    0    0    0    0]\n",
            " [   1    0    2  994    3    0    0    0    0    0    0    0    0]\n",
            " [   1    0    2   13  963    0    4    0    0    0    0    0    0]\n",
            " [  23    0    0    0    0 1028    1    0    0    0    0    0    0]\n",
            " [   1    0    0    0    2    0 1032    0    2    0    0    0    0]\n",
            " [   0    0    0    0    0    0    0 1039    0    0    0    0    0]\n",
            " [  12    0   51    0    0    0    2    0  958    0    0    1    0]\n",
            " [  28    0    0    0    0    0    0    0    0 1009    0    0    0]\n",
            " [   1    0    0    0    0    0    0    0    0    0  973    0    0]\n",
            " [   1    0    0    0    0    1    0    0    0    0    0 1000    0]\n",
            " [  18    0    0    0    0    0    0    0    0    0    0    0  908]]\n",
            "Classifier accuracy : 0.9738 F1 score: 0.9765\n",
            "Two class classifier accuracy : 0.9798 F1 score: 0.9857\n"
          ],
          "name": "stdout"
        }
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "9xi5c64xEcOZ"
      },
      "source": [
        "# Classification using KNN\n",
        "from sklearn.neighbors import KNeighborsClassifier\n",
        "\n",
        "def ids_knn():\n",
        "    \"\"\"\n",
        "    Classify processed data set stored as csv file using KNN\n",
        "    Print: accuracy, confusion matrix, f1 score on the validation data set\n",
        "    Input:\n",
        "        None    \n",
        "    Returns:\n",
        "        None\n",
        "    \"\"\"\n",
        "\n",
        "    df = ids_load_df_from_csv ()\n",
        "    X_train, X_val, X_test, y_train, y_val, y_test = ids_split(df)\n",
        "\n",
        "    neigh = KNeighborsClassifier(n_neighbors=3)\n",
        "    neigh.fit(X_train, y_train)\n",
        "\n",
        "    y_pred = neigh.predict(X_val)\n",
        "    \n",
        "    ids_metrics(y_val, y_pred)"
      ],
      "execution_count": 22,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "pd-DRE1OFAbu",
        "outputId": "a3c9be98-e112-4b3e-f3eb-16a44c5cf3c4",
        "colab": {
          "base_uri": "https://localhost:8080/"
        }
      },
      "source": [
        "ids_knn()"
      ],
      "execution_count": 23,
      "outputs": [
        {
          "output_type": "stream",
          "text": [
            "load Dataframe shape (136000, 77)\n",
            "df.shape (136000, 77)\n",
            "X_train.shape (98260, 76) y_train.shape (98260,)\n",
            "X_val.shape (17340, 76) y_val.shape (17340,)\n",
            "X_test.shape (20400, 76) y_test.shape (20400,)\n",
            "[[5062    1    1    1    2    6    4    0    4    1   35   59    2]\n",
            " [   1 1043    1    1    0    0    0    0    0    0    1    0    0]\n",
            " [   0    0 1040    0    0    0    0    0    1    0    0    0    0]\n",
            " [   0    0    1  997    2    0    0    0    0    0    0    0    0]\n",
            " [   1    0    0    3  979    0    0    0    0    0    0    0    0]\n",
            " [   6    0    0    0    0 1043    2    0    0    0    0    0    1]\n",
            " [   1    0    0    0    2    0 1033    0    1    0    0    0    0]\n",
            " [   0    0    0    0    0    0    0 1039    0    0    0    0    0]\n",
            " [   0    0    2    0    0    0    0    0 1022    0    0    0    0]\n",
            " [   0    0    0    0    0    0    0    0    0 1037    0    0    0]\n",
            " [   0    0    0    0    0    0    0    0    0    0  974    0    0]\n",
            " [  20    0    0    0    0    1    0    0    0    0    0  981    0]\n",
            " [   1    0    0    0    0    0    0    0    0    0    0    0  925]]\n",
            "Classifier accuracy : 0.9905 F1 score: 0.9919\n",
            "Two class classifier accuracy : 0.9916 F1 score: 0.9940\n"
          ],
          "name": "stdout"
        }
      ]
    }
  ]
}