{ "cells": [ { "cell_type": "code", "id": "initial_id", "metadata": { "collapsed": true, "ExecuteTime": { "end_time": "2024-02-27T12:59:23.780857993Z", "start_time": "2024-02-27T12:59:23.455687145Z" } }, "source": [ "import os\n", "import sys\n", "import joblib\n", "import pickle\n", "\n", "from functools import partial\n", "\n", "from concurrent.futures import ProcessPoolExecutor\n", "\n", "import networkx as nx\n", "\n", "import numpy as np\n", "import pandas as pd\n", "import matplotlib.pyplot as plt\n", "from tqdm import tqdm\n", "\n", "from graph_based_intrusion_detection.utils import constants\n", "from graph_based_intrusion_detection.packet_processing.processing_functions import process_packets, \\\n", " multi_process_packets\n", "from graph_based_intrusion_detection.packet_processing.packet_inspection import update_port_list\n", "from graph_based_intrusion_detection.packet_processing.graph_processing import update_layer_3_graph, \\\n", " update_layer_2_graph\n", "\n", "from graph_based_intrusion_detection.utils.state_merging import merge_graph, merge_by_key, merge_states\n", "\n", "from graph_based_intrusion_detection.graph_processing.data_extraction import get_info_for_node, extract_connections, \\\n", " create_dataset_for_node\n", "\n", "# constants\n", "devices_root = os.path.abspath('../../../')\n", "time_field = 'geninfo/timestamp'\n", "timedelta_field = \"timedelta\"" ], "outputs": [], "execution_count": 2 }, { "cell_type": "code", "source": [ "# read merged dataset\n", "row_limit = None\n", "idle_dataset_path = os.path.join(devices_root, 'idle_merged.pickle')\n", "activity_dataset_path = os.path.join(devices_root, 'activity_merged.pickle')\n", "attack_dataset_path = os.path.join(devices_root, 'attack_merged.pickle')\n", "\n", "idle_dataset = pd.read_pickle(idle_dataset_path)\n", "activity_dataset = pd.read_pickle(activity_dataset_path)\n", "attack_dataset = pd.read_pickle(attack_dataset_path)\n", "\n", "merged_dataset_full = pd.concat([idle_dataset, activity_dataset, attack_dataset])\n", "merged_dataset = merged_dataset_full\n", "\n", "print(f\"Loaded merged dataset with {len(merged_dataset)} packets\")\n", "list(sorted(merged_dataset.columns))" ], "metadata": { "collapsed": false, "ExecuteTime": { "end_time": "2024-02-27T12:59:34.396893524Z", "start_time": "2024-02-27T12:59:32.031073595Z" } }, "id": "bc65976a401780a5", "outputs": [ { "name": "stdout", "output_type": "stream", "text": [ "Loaded merged dataset with 3194477 packets\n" ] }, { "data": { "text/plain": "['Activity',\n 'Attack',\n 'Farbeändern',\n 'Helligkeitssteuern',\n 'Party',\n 'Themen Auswahl',\n 'Timer Ein/Aus',\n 'Weiß/gelb',\n 'Zeitschalter',\n 'arp/arp.hw.size',\n 'arp/arp.hw.type',\n 'arp/arp.opcode',\n 'arp/arp.proto.size',\n 'arp/arp.proto.type',\n 'eth/eth.dst',\n 'eth/eth.dst/eth.dst.ig',\n 'eth/eth.dst/eth.dst.oui',\n 'eth/eth.dst/eth.lg',\n 'eth/eth.src',\n 'eth/eth.src/eth.ig',\n 'eth/eth.src/eth.lg',\n 'eth/eth.src/eth.src.oui',\n 'eth/eth.type',\n 'frame/frame.encap_type',\n 'frame/frame.len',\n 'frame/frame.marked',\n 'frame/frame.number',\n 'frame/frame.offset_shift',\n 'frame/frame.time_delta',\n 'frame/frame.time_relative',\n 'geninfo/timestamp',\n 'icmp/data/data.len',\n 'icmp/icmp.checksum.status',\n 'icmp/icmp.code',\n 'icmp/icmp.ident',\n 'icmp/icmp.resp_in',\n 'icmp/icmp.resp_to',\n 'icmp/icmp.seq',\n 'icmp/icmp.seq_le',\n 'icmp/icmp.type',\n 'igmp/igmp.checksum.status',\n 'igmp/igmp.maddr',\n 'igmp/igmp.max_resp',\n 'igmp/igmp.type',\n 'illuminance_level',\n 'ip/<>/ip.options.routeralert/ip.opt.ra',\n 'ip/<>/ip.options.routeralert/ip.opt.type',\n 'ip/ip.checksum.status',\n 'ip/ip.dsfield',\n 'ip/ip.dsfield/ip.dsfield.dscp',\n 'ip/ip.dsfield/ip.dsfield.ecn',\n 'ip/ip.dst',\n 'ip/ip.flags',\n 'ip/ip.flags/ip.flags.df',\n 'ip/ip.flags/ip.flags.mf',\n 'ip/ip.flags/ip.flags.rb',\n 'ip/ip.frag_offset',\n 'ip/ip.hdr_len',\n 'ip/ip.id',\n 'ip/ip.len',\n 'ip/ip.proto',\n 'ip/ip.src',\n 'ip/ip.ttl',\n 'ip/ip.version',\n 'name',\n 'presence_absence',\n 'tcp/tcp.ack',\n 'tcp/tcp.analysis/tcp.analysis.bytes_in_flight',\n 'tcp/tcp.analysis/tcp.analysis.push_bytes_sent',\n 'tcp/tcp.checksum.status',\n 'tcp/tcp.completeness',\n 'tcp/tcp.dstport',\n 'tcp/tcp.flags/tcp.flags.ack',\n 'tcp/tcp.flags/tcp.flags.cwr',\n 'tcp/tcp.flags/tcp.flags.ecn',\n 'tcp/tcp.flags/tcp.flags.fin',\n 'tcp/tcp.flags/tcp.flags.ns',\n 'tcp/tcp.flags/tcp.flags.push',\n 'tcp/tcp.flags/tcp.flags.res',\n 'tcp/tcp.flags/tcp.flags.reset',\n 'tcp/tcp.flags/tcp.flags.syn',\n 'tcp/tcp.flags/tcp.flags.urg',\n 'tcp/tcp.hdr_len',\n 'tcp/tcp.len',\n 'tcp/tcp.nxtseq',\n 'tcp/tcp.options/tcp.options.mss/tcp.options.mss_val',\n 'tcp/tcp.options/tcp.options.nop',\n 'tcp/tcp.seq',\n 'tcp/tcp.srcport',\n 'tcp/tcp.stream',\n 'tcp/tcp.urgent_pointer',\n 'tcp/tcp.window_size',\n 'tcp/tcp.window_size_scalefactor',\n 'tcp/tcp.window_size_value',\n 'timedelta',\n 'timedelta_prev',\n 'udp/udp.checksum.status',\n 'udp/udp.dstport',\n 'udp/udp.length',\n 'udp/udp.srcport',\n 'udp/udp.stream']" }, "execution_count": 4, "metadata": {}, "output_type": "execute_result" } ], "execution_count": 4 }, { "cell_type": "code", "source": [ "merged_dataset.head()" ], "metadata": { "collapsed": false, "ExecuteTime": { "end_time": "2024-02-27T11:13:57.660193611Z", "start_time": "2024-02-27T11:13:57.644212188Z" } }, "id": "124d8f016082e7a7", "outputs": [ { "data": { "text/plain": " tcp/tcp.flags/tcp.flags.reset arp/arp.proto.size \\\n0 False NaN \n1 False NaN \n2 False NaN \n3 False NaN \n4 False NaN \n\n tcp/tcp.options/tcp.options.nop tcp/tcp.checksum.status \\\n0 1.0 2.0 \n1 1.0 2.0 \n2 NaN 2.0 \n3 NaN 2.0 \n4 NaN 2.0 \n\n udp/udp.checksum.status tcp/tcp.nxtseq \\\n0 NaN 1.0 \n1 NaN 1.0 \n2 NaN 70.0 \n3 NaN 70.0 \n4 NaN 70.0 \n\n tcp/tcp.options/tcp.options.mss/tcp.options.mss_val tcp/tcp.hdr_len \\\n0 NaN 32.0 \n1 NaN 32.0 \n2 NaN 20.0 \n3 NaN 20.0 \n4 NaN 20.0 \n\n tcp/tcp.stream ip/ip.dst ... Farbeändern Helligkeitssteuern \\\n0 0.0 192.168.1.201 ... NaN NaN \n1 0.0 54.155.16.139 ... NaN NaN \n2 1.0 76.223.105.139 ... NaN NaN \n3 1.0 192.168.1.178 ... NaN NaN \n4 1.0 76.223.105.139 ... NaN NaN \n\n Weiß/gelb Themen Auswahl Party Zeitschalter Timer Ein/Aus \\\n0 NaN NaN NaN NaN NaN \n1 NaN NaN NaN NaN NaN \n2 NaN NaN NaN NaN NaN \n3 NaN NaN NaN NaN NaN \n4 NaN NaN NaN NaN NaN \n\n presence_absence illuminance_level Attack \n0 NaN NaN NaN \n1 NaN NaN NaN \n2 NaN NaN NaN \n3 NaN NaN NaN \n4 NaN NaN NaN \n\n[5 rows x 101 columns]", "text/html": "
| \n | tcp/tcp.flags/tcp.flags.reset | \narp/arp.proto.size | \ntcp/tcp.options/tcp.options.nop | \ntcp/tcp.checksum.status | \nudp/udp.checksum.status | \ntcp/tcp.nxtseq | \ntcp/tcp.options/tcp.options.mss/tcp.options.mss_val | \ntcp/tcp.hdr_len | \ntcp/tcp.stream | \nip/ip.dst | \n... | \nFarbeändern | \nHelligkeitssteuern | \nWeiß/gelb | \nThemen Auswahl | \nParty | \nZeitschalter | \nTimer Ein/Aus | \npresence_absence | \nilluminance_level | \nAttack | \n
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 0 | \nFalse | \nNaN | \n1.0 | \n2.0 | \nNaN | \n1.0 | \nNaN | \n32.0 | \n0.0 | \n192.168.1.201 | \n... | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \n
| 1 | \nFalse | \nNaN | \n1.0 | \n2.0 | \nNaN | \n1.0 | \nNaN | \n32.0 | \n0.0 | \n54.155.16.139 | \n... | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \n
| 2 | \nFalse | \nNaN | \nNaN | \n2.0 | \nNaN | \n70.0 | \nNaN | \n20.0 | \n1.0 | \n76.223.105.139 | \n... | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \n
| 3 | \nFalse | \nNaN | \nNaN | \n2.0 | \nNaN | \n70.0 | \nNaN | \n20.0 | \n1.0 | \n192.168.1.178 | \n... | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \n
| 4 | \nFalse | \nNaN | \nNaN | \n2.0 | \nNaN | \n70.0 | \nNaN | \n20.0 | \n1.0 | \n76.223.105.139 | \n... | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \nNaN | \n
5 rows × 101 columns
\n| \n | diff_to_last_incoming | \nnew_incoming_at_second | \ntotal_incoming_at_second | \ntotal_packet_count_in | \ntotal_bytes_in | \nsrc_ports_in | \ndst_ports_in | \npackets_per_second_in | \nbytes_per_second_in | \nmax_tcp_segment_size_in | \n... | \ndst_ports_out | \npackets_per_second_out | \nbytes_per_second_out | \nmax_tcp_segment_size_out | \nmax_tcp_header_length_out | \nmax_frame_length_out | \nmin_frame_length_out | \nactivity_at_second_out | \nattack_at_second_out | \nnode | \n
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 0 | \n0 | \n1 | \n1 | \n5379 | \n534681 | \n1 | \n1 | \n1 | \n66 | \n0 | \n... | \n1 | \n1 | \n66 | \n0 | \n32 | \n66 | \n66 | \n0 | \n0 | \n54.155.16.139 | \n
| 2 | \n2 | \n0 | \n1 | \n5379 | \n534681 | \n1 | \n1 | \n4 | \n343 | \n0 | \n... | \n1 | \n2 | \n218 | \n0 | \n32 | \n113 | \n105 | \n0 | \n0 | \n54.155.16.139 | \n
| 20 | \n18 | \n0 | \n1 | \n5379 | \n534681 | \n1 | \n1 | \n1 | \n66 | \n0 | \n... | \n1 | \n1 | \n66 | \n0 | \n32 | \n66 | \n66 | \n0 | \n0 | \n54.155.16.139 | \n
| 33 | \n13 | \n0 | \n1 | \n5379 | \n534681 | \n1 | \n1 | \n2 | \n169 | \n0 | \n... | \n1 | \n1 | \n105 | \n0 | \n32 | \n105 | \n105 | \n0 | \n0 | \n54.155.16.139 | \n
| 40 | \n13 | \n0 | \n1 | \n5379 | \n534681 | \n1 | \n1 | \n2 | \n169 | \n0 | \n... | \n1 | \n1 | \n66 | \n0 | \n32 | \n66 | \n66 | \n0 | \n0 | \n54.155.16.139 | \n
| ... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n
| 262108 | \n0 | \n1 | \n1 | \n5 | \n376 | \n1 | \n1 | \n2 | \n161 | \n0 | \n... | \n1 | \n2 | \n161 | \n0 | \n20 | \n107 | \n54 | \n0 | \n0 | \n3.122.122.135 | \n
| 262128 | \n0 | \n1 | \n1 | \n5 | \n376 | \n1 | \n1 | \n2 | \n161 | \n0 | \n... | \n1 | \n1 | \n267 | \n0 | \n20 | \n267 | \n267 | \n0 | \n0 | \n3.122.122.135 | \n
| 262293 | \n185 | \n0 | \n1 | \n5 | \n376 | \n1 | \n1 | \n1 | \n54 | \n0 | \n... | \n1 | \n2 | \n161 | \n0 | \n20 | \n107 | \n54 | \n0 | \n0 | \n3.122.122.135 | \n
| 262442 | \n149 | \n0 | \n1 | \n5 | \n376 | \n1 | \n1 | \n2 | \n161 | \n0 | \n... | \n1 | \n1 | \n107 | \n0 | \n20 | \n107 | \n107 | \n0 | \n0 | \n3.122.122.135 | \n
| 262497 | \n149 | \n0 | \n1 | \n5 | \n376 | \n1 | \n1 | \n2 | \n161 | \n0 | \n... | \n1 | \n1 | \n267 | \n0 | \n20 | \n267 | \n267 | \n0 | \n0 | \n3.122.122.135 | \n
595781 rows × 31 columns
\n| \n | diff_to_last_incoming | \nnew_incoming_at_second | \ntotal_incoming_at_second | \ntotal_packet_count_in | \ntotal_bytes_in | \nsrc_ports_in | \ndst_ports_in | \npackets_per_second_in | \nbytes_per_second_in | \nmax_tcp_segment_size_in | \n... | \ndst_ports_out | \npackets_per_second_out | \nbytes_per_second_out | \nmax_tcp_segment_size_out | \nmax_tcp_header_length_out | \nmax_frame_length_out | \nmin_frame_length_out | \nactivity_at_second_out | \nattack_at_second_out | \nnode | \n
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 703994 | \n15 | \n0 | \n1 | \n11969 | \n933475 | \n2 | \n1 | \n2 | \n177 | \n0 | \n... | \n4 | \n0 | \n0 | \n0 | \n0 | \n0 | \n0 | \n0 | \n0 | \n76.223.105.139 | \n
| 698995 | \n10 | \n0 | \n4 | \n1486 | \n403427 | \n113 | \n1 | \n1 | \n264 | \n1440 | \n... | \n113 | \n1 | \n54 | \n1420 | \n20 | \n54 | \n54 | \n0 | \n1 | \n34.140.193.14 | \n
| 24251 | \n20 | \n0 | \n0 | \n787 | \n86806 | \n2 | \n1 | \n2 | \n169 | \n0 | \n... | \n2 | \n1 | \n105 | \n0 | \n32 | \n105 | \n105 | \n0 | \n0 | \n46.51.181.189 | \n
| 698995 | \n642 | \n0 | \n2 | \n148 | \n9448 | \n3 | \n21 | \n2 | \n112 | \n1440 | \n... | \n3 | \n3 | \n202 | \n1460 | \n40 | \n74 | \n54 | \n0 | \n1 | \n192.168.1.163 | \n
| 699025 | \n642 | \n0 | \n2 | \n148 | \n9448 | \n3 | \n21 | \n2 | \n112 | \n1440 | \n... | \n3 | \n1 | \n66 | \n1460 | \n20 | \n66 | \n66 | \n0 | \n1 | \n192.168.1.163 | \n
| ... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n... | \n
| 21362 | \n269 | \n0 | \n1 | \n698 | \n38261 | \n206 | \n653 | \n3 | \n683 | \n1460 | \n... | \n207 | \n4 | \n216 | \n1460 | \n20 | \n54 | \n54 | \n0 | \n0 | \n192.168.1.128 | \n
| 22017 | \n615 | \n0 | \n1 | \n698 | \n38261 | \n206 | \n653 | \n1 | \n54 | \n1460 | \n... | \n207 | \n1 | \n74 | \n1460 | \n40 | \n74 | \n74 | \n0 | \n1 | \n192.168.1.128 | \n
| 23312 | \n615 | \n0 | \n1 | \n698 | \n38261 | \n206 | \n653 | \n1 | \n54 | \n1460 | \n... | \n207 | \n1 | \n54 | \n1460 | \n20 | \n54 | \n54 | \n0 | \n1 | \n192.168.1.128 | \n
| 20654 | \n106 | \n0 | \n1 | \n345 | \n21169 | \n2 | \n207 | \n10 | \n544 | \n1460 | \n... | \n2 | \n10 | \n913 | \n1460 | \n40 | \n407 | \n54 | \n0 | \n1 | \n192.168.1.139 | \n
| 20656 | \n2 | \n0 | \n1 | \n345 | \n21169 | \n2 | \n207 | \n1 | \n58 | \n1460 | \n... | \n2 | \n10 | \n913 | \n1460 | \n40 | \n407 | \n54 | \n0 | \n1 | \n192.168.1.139 | \n
97 rows × 31 columns
\n| \n", " | diff_to_last_incoming | \n", "new_incoming_at_second | \n", "total_incoming_at_second | \n", "total_packet_count_in | \n", "total_bytes_in | \n", "src_ports_in | \n", "dst_ports_in | \n", "packets_per_second_in | \n", "bytes_per_second_in | \n", "max_tcp_segment_size_in | \n", "... | \n", "bytes_per_second_out | \n", "max_tcp_segment_size_out | \n", "max_tcp_header_length_out | \n", "max_frame_length_out | \n", "min_frame_length_out | \n", "activity_at_second_out | \n", "attack_at_second_out | \n", "node | \n", "activity_state | \n", "attack_state | \n", "
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 0 | \n", "0 | \n", "1 | \n", "1 | \n", "5379 | \n", "534681 | \n", "1 | \n", "1 | \n", "1 | \n", "66 | \n", "0 | \n", "... | \n", "66 | \n", "0 | \n", "32 | \n", "66 | \n", "66 | \n", "0 | \n", "0 | \n", "54.155.16.139 | \n", "0 | \n", "0 | \n", "
| 2 | \n", "2 | \n", "0 | \n", "1 | \n", "5379 | \n", "534681 | \n", "1 | \n", "1 | \n", "4 | \n", "343 | \n", "0 | \n", "... | \n", "218 | \n", "0 | \n", "32 | \n", "113 | \n", "105 | \n", "0 | \n", "0 | \n", "54.155.16.139 | \n", "0 | \n", "0 | \n", "
| 20 | \n", "18 | \n", "0 | \n", "1 | \n", "5379 | \n", "534681 | \n", "1 | \n", "1 | \n", "1 | \n", "66 | \n", "0 | \n", "... | \n", "66 | \n", "0 | \n", "32 | \n", "66 | \n", "66 | \n", "0 | \n", "0 | \n", "54.155.16.139 | \n", "0 | \n", "0 | \n", "
| 33 | \n", "13 | \n", "0 | \n", "1 | \n", "5379 | \n", "534681 | \n", "1 | \n", "1 | \n", "2 | \n", "169 | \n", "0 | \n", "... | \n", "105 | \n", "0 | \n", "32 | \n", "105 | \n", "105 | \n", "0 | \n", "0 | \n", "54.155.16.139 | \n", "0 | \n", "0 | \n", "
| 40 | \n", "13 | \n", "0 | \n", "1 | \n", "5379 | \n", "534681 | \n", "1 | \n", "1 | \n", "2 | \n", "169 | \n", "0 | \n", "... | \n", "66 | \n", "0 | \n", "32 | \n", "66 | \n", "66 | \n", "0 | \n", "0 | \n", "54.155.16.139 | \n", "0 | \n", "0 | \n", "
| ... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "
| 262108 | \n", "0 | \n", "1 | \n", "1 | \n", "5 | \n", "376 | \n", "1 | \n", "1 | \n", "2 | \n", "161 | \n", "0 | \n", "... | \n", "161 | \n", "0 | \n", "20 | \n", "107 | \n", "54 | \n", "0 | \n", "0 | \n", "3.122.122.135 | \n", "0 | \n", "0 | \n", "
| 262128 | \n", "0 | \n", "1 | \n", "1 | \n", "5 | \n", "376 | \n", "1 | \n", "1 | \n", "2 | \n", "161 | \n", "0 | \n", "... | \n", "267 | \n", "0 | \n", "20 | \n", "267 | \n", "267 | \n", "0 | \n", "0 | \n", "3.122.122.135 | \n", "0 | \n", "0 | \n", "
| 262293 | \n", "185 | \n", "0 | \n", "1 | \n", "5 | \n", "376 | \n", "1 | \n", "1 | \n", "1 | \n", "54 | \n", "0 | \n", "... | \n", "161 | \n", "0 | \n", "20 | \n", "107 | \n", "54 | \n", "0 | \n", "0 | \n", "3.122.122.135 | \n", "0 | \n", "0 | \n", "
| 262442 | \n", "149 | \n", "0 | \n", "1 | \n", "5 | \n", "376 | \n", "1 | \n", "1 | \n", "2 | \n", "161 | \n", "0 | \n", "... | \n", "107 | \n", "0 | \n", "20 | \n", "107 | \n", "107 | \n", "0 | \n", "0 | \n", "3.122.122.135 | \n", "0 | \n", "0 | \n", "
| 262497 | \n", "149 | \n", "0 | \n", "1 | \n", "5 | \n", "376 | \n", "1 | \n", "1 | \n", "2 | \n", "161 | \n", "0 | \n", "... | \n", "267 | \n", "0 | \n", "20 | \n", "267 | \n", "267 | \n", "0 | \n", "0 | \n", "3.122.122.135 | \n", "0 | \n", "0 | \n", "
595781 rows × 33 columns
\n", "| \n", " | diff_to_last_incoming | \n", "new_incoming_at_second | \n", "total_incoming_at_second | \n", "total_packet_count_in | \n", "total_bytes_in | \n", "src_ports_in | \n", "dst_ports_in | \n", "packets_per_second_in | \n", "bytes_per_second_in | \n", "max_tcp_segment_size_in | \n", "... | \n", "bytes_per_second_out | \n", "max_tcp_segment_size_out | \n", "max_tcp_header_length_out | \n", "max_frame_length_out | \n", "min_frame_length_out | \n", "activity_at_second_out | \n", "attack_at_second_out | \n", "node | \n", "activity_state | \n", "attack_state | \n", "
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 0 | \n", "0 | \n", "1 | \n", "1 | \n", "5379 | \n", "534681 | \n", "1 | \n", "1 | \n", "1 | \n", "66 | \n", "0 | \n", "... | \n", "66 | \n", "0 | \n", "32 | \n", "66 | \n", "66 | \n", "0 | \n", "0 | \n", "54.155.16.139 | \n", "0 | \n", "0 | \n", "
| 2 | \n", "2 | \n", "0 | \n", "1 | \n", "5379 | \n", "534681 | \n", "1 | \n", "1 | \n", "4 | \n", "343 | \n", "0 | \n", "... | \n", "218 | \n", "0 | \n", "32 | \n", "113 | \n", "105 | \n", "0 | \n", "0 | \n", "54.155.16.139 | \n", "0 | \n", "0 | \n", "
| 20 | \n", "18 | \n", "0 | \n", "1 | \n", "5379 | \n", "534681 | \n", "1 | \n", "1 | \n", "1 | \n", "66 | \n", "0 | \n", "... | \n", "66 | \n", "0 | \n", "32 | \n", "66 | \n", "66 | \n", "0 | \n", "0 | \n", "54.155.16.139 | \n", "0 | \n", "0 | \n", "
| 33 | \n", "13 | \n", "0 | \n", "1 | \n", "5379 | \n", "534681 | \n", "1 | \n", "1 | \n", "2 | \n", "169 | \n", "0 | \n", "... | \n", "105 | \n", "0 | \n", "32 | \n", "105 | \n", "105 | \n", "0 | \n", "0 | \n", "54.155.16.139 | \n", "0 | \n", "0 | \n", "
| 40 | \n", "13 | \n", "0 | \n", "1 | \n", "5379 | \n", "534681 | \n", "1 | \n", "1 | \n", "2 | \n", "169 | \n", "0 | \n", "... | \n", "66 | \n", "0 | \n", "32 | \n", "66 | \n", "66 | \n", "0 | \n", "0 | \n", "54.155.16.139 | \n", "0 | \n", "0 | \n", "
| ... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "
| 42496 | \n", "7 | \n", "0 | \n", "1 | \n", "5379 | \n", "534681 | \n", "1 | \n", "1 | \n", "2 | \n", "173 | \n", "0 | \n", "... | \n", "113 | \n", "0 | \n", "32 | \n", "113 | \n", "113 | \n", "0 | \n", "0 | \n", "54.155.16.139 | \n", "0 | \n", "0 | \n", "
| 42502 | \n", "6 | \n", "0 | \n", "1 | \n", "5379 | \n", "534681 | \n", "1 | \n", "1 | \n", "1 | \n", "66 | \n", "0 | \n", "... | \n", "66 | \n", "0 | \n", "32 | \n", "66 | \n", "66 | \n", "0 | \n", "0 | \n", "54.155.16.139 | \n", "0 | \n", "0 | \n", "
| 42522 | \n", "20 | \n", "0 | \n", "1 | \n", "5379 | \n", "534681 | \n", "1 | \n", "1 | \n", "1 | \n", "66 | \n", "0 | \n", "... | \n", "66 | \n", "0 | \n", "32 | \n", "66 | \n", "66 | \n", "0 | \n", "0 | \n", "54.155.16.139 | \n", "0 | \n", "0 | \n", "
| 42523 | \n", "1 | \n", "0 | \n", "1 | \n", "5379 | \n", "534681 | \n", "1 | \n", "1 | \n", "2 | \n", "163 | \n", "0 | \n", "... | \n", "97 | \n", "0 | \n", "32 | \n", "97 | \n", "97 | \n", "0 | \n", "0 | \n", "54.155.16.139 | \n", "0 | \n", "0 | \n", "
| 42524 | \n", "1 | \n", "0 | \n", "1 | \n", "5379 | \n", "534681 | \n", "1 | \n", "1 | \n", "2 | \n", "132 | \n", "0 | \n", "... | \n", "132 | \n", "0 | \n", "32 | \n", "66 | \n", "66 | \n", "0 | \n", "0 | \n", "54.155.16.139 | \n", "0 | \n", "0 | \n", "
3894 rows × 33 columns
\n", "