{ "cells": [ { "metadata": { "ExecuteTime": { "end_time": "2024-02-27T12:58:21.532722137Z", "start_time": "2024-02-27T12:58:21.317772254Z" } }, "cell_type": "code", "source": [ "import json\n", "import os\n", "import time\n", "\n", "import pandas as pd\n", "import networkx as nx\n", "\n", "from kafka import KafkaConsumer, KafkaProducer, KafkaAdminClient\n", "import redis\n", "\n", "from graph_based_intrusion_detection.utils import constants\n", "from graph_based_intrusion_detection.utils.network_transport_utils import deserialize, serialize" ], "id": "62284ba9a54cad9b", "outputs": [], "execution_count": 1 }, { "metadata": { "ExecuteTime": { "end_time": "2024-02-27T12:58:21.533440468Z", "start_time": "2024-02-27T12:58:21.531812746Z" } }, "cell_type": "code", "source": [ "# constants\n", "devices_root = os.path.abspath('../../../')\n", "time_field = 'geninfo/timestamp'\n", "timedelta_field = \"timedelta\"\n" ], "id": "e2ac6b2bea4af750", "outputs": [], "execution_count": 2 }, { "cell_type": "code", "id": "initial_id", "metadata": { "collapsed": true, "ExecuteTime": { "end_time": "2024-02-27T12:58:24.623717709Z", "start_time": "2024-02-27T12:58:21.532068016Z" } }, "source": [ "# read merged dataset\n", "row_limit = None\n", "idle_dataset_path = os.path.join(devices_root, 'idle_merged.pickle')\n", "activity_dataset_path = os.path.join(devices_root, 'activity_merged.pickle')\n", "attack_dataset_path = os.path.join(devices_root, 'attack_merged.pickle')\n", "\n", "idle_dataset = pd.read_pickle(idle_dataset_path)\n", "activity_dataset = pd.read_pickle(activity_dataset_path)\n", "attack_dataset = pd.read_pickle(attack_dataset_path)\n", "\n", "merged_dataset_full = pd.concat([idle_dataset, activity_dataset, attack_dataset])\n", "merged_dataset = merged_dataset_full\n", "\n", "print(f\"Loaded merged dataset with {len(merged_dataset)} packets\")\n", "list(sorted(merged_dataset.columns))" ], "outputs": [ { "name": "stdout", "output_type": "stream", "text": [ "Loaded merged dataset with 3194477 packets\n" ] }, { "data": { "text/plain": "['Activity',\n 'Attack',\n 'Farbeändern',\n 'Helligkeitssteuern',\n 'Party',\n 'Themen Auswahl',\n 'Timer Ein/Aus',\n 'Weiß/gelb',\n 'Zeitschalter',\n 'arp/arp.hw.size',\n 'arp/arp.hw.type',\n 'arp/arp.opcode',\n 'arp/arp.proto.size',\n 'arp/arp.proto.type',\n 'eth/eth.dst',\n 'eth/eth.dst/eth.dst.ig',\n 'eth/eth.dst/eth.dst.oui',\n 'eth/eth.dst/eth.lg',\n 'eth/eth.src',\n 'eth/eth.src/eth.ig',\n 'eth/eth.src/eth.lg',\n 'eth/eth.src/eth.src.oui',\n 'eth/eth.type',\n 'frame/frame.encap_type',\n 'frame/frame.len',\n 'frame/frame.marked',\n 'frame/frame.number',\n 'frame/frame.offset_shift',\n 'frame/frame.time_delta',\n 'frame/frame.time_relative',\n 'geninfo/timestamp',\n 'icmp/data/data.len',\n 'icmp/icmp.checksum.status',\n 'icmp/icmp.code',\n 'icmp/icmp.ident',\n 'icmp/icmp.resp_in',\n 'icmp/icmp.resp_to',\n 'icmp/icmp.seq',\n 'icmp/icmp.seq_le',\n 'icmp/icmp.type',\n 'igmp/igmp.checksum.status',\n 'igmp/igmp.maddr',\n 'igmp/igmp.max_resp',\n 'igmp/igmp.type',\n 'illuminance_level',\n 'ip/<>/ip.options.routeralert/ip.opt.ra',\n 'ip/<>/ip.options.routeralert/ip.opt.type',\n 'ip/ip.checksum.status',\n 'ip/ip.dsfield',\n 'ip/ip.dsfield/ip.dsfield.dscp',\n 'ip/ip.dsfield/ip.dsfield.ecn',\n 'ip/ip.dst',\n 'ip/ip.flags',\n 'ip/ip.flags/ip.flags.df',\n 'ip/ip.flags/ip.flags.mf',\n 'ip/ip.flags/ip.flags.rb',\n 'ip/ip.frag_offset',\n 'ip/ip.hdr_len',\n 'ip/ip.id',\n 'ip/ip.len',\n 'ip/ip.proto',\n 'ip/ip.src',\n 'ip/ip.ttl',\n 'ip/ip.version',\n 'name',\n 'presence_absence',\n 'tcp/tcp.ack',\n 'tcp/tcp.analysis/tcp.analysis.bytes_in_flight',\n 'tcp/tcp.analysis/tcp.analysis.push_bytes_sent',\n 'tcp/tcp.checksum.status',\n 'tcp/tcp.completeness',\n 'tcp/tcp.dstport',\n 'tcp/tcp.flags/tcp.flags.ack',\n 'tcp/tcp.flags/tcp.flags.cwr',\n 'tcp/tcp.flags/tcp.flags.ecn',\n 'tcp/tcp.flags/tcp.flags.fin',\n 'tcp/tcp.flags/tcp.flags.ns',\n 'tcp/tcp.flags/tcp.flags.push',\n 'tcp/tcp.flags/tcp.flags.res',\n 'tcp/tcp.flags/tcp.flags.reset',\n 'tcp/tcp.flags/tcp.flags.syn',\n 'tcp/tcp.flags/tcp.flags.urg',\n 'tcp/tcp.hdr_len',\n 'tcp/tcp.len',\n 'tcp/tcp.nxtseq',\n 'tcp/tcp.options/tcp.options.mss/tcp.options.mss_val',\n 'tcp/tcp.options/tcp.options.nop',\n 'tcp/tcp.seq',\n 'tcp/tcp.srcport',\n 'tcp/tcp.stream',\n 'tcp/tcp.urgent_pointer',\n 'tcp/tcp.window_size',\n 'tcp/tcp.window_size_scalefactor',\n 'tcp/tcp.window_size_value',\n 'timedelta',\n 'timedelta_prev',\n 'udp/udp.checksum.status',\n 'udp/udp.dstport',\n 'udp/udp.length',\n 'udp/udp.srcport',\n 'udp/udp.stream']" }, "execution_count": 3, "metadata": {}, "output_type": "execute_result" } ], "execution_count": 3 }, { "metadata": { "ExecuteTime": { "end_time": "2024-02-27T12:58:24.625494342Z", "start_time": "2024-02-27T12:58:24.624269320Z" } }, "cell_type": "code", "source": [ "merged_dataset[\"Attack\"]" ], "id": "eb6cc8d5fda6a592", "outputs": [ { "data": { "text/plain": "0 NaN\n1 NaN\n2 NaN\n3 NaN\n4 NaN\n ... \n1002184 False\n1002185 False\n1002186 False\n1002187 True\n1002188 False\nName: Attack, Length: 3194477, dtype: object" }, "execution_count": 4, "metadata": {}, "output_type": "execute_result" } ], "execution_count": 4 }, { "metadata": { "ExecuteTime": { "end_time": "2024-02-27T12:58:24.737352398Z", "start_time": "2024-02-27T12:58:24.625896572Z" } }, "cell_type": "code", "source": [ "# create kafka producer\n", "producer = KafkaProducer(bootstrap_servers='localhost:9092')" ], "id": "1c916da24d18b2cb", "outputs": [], "execution_count": 5 }, { "metadata": { "ExecuteTime": { "end_time": "2024-02-27T12:58:25.101840964Z", "start_time": "2024-02-27T12:58:24.775561457Z" } }, "cell_type": "code", "source": [ "df_no_attacks = merged_dataset[merged_dataset[\"Attack\"] == 0]\n", "len(df_no_attacks)" ], "id": "f42cf1cb4efa5f0a", "outputs": [ { "data": { "text/plain": "1001608" }, "execution_count": 6, "metadata": {}, "output_type": "execute_result" } ], "execution_count": 6 }, { "metadata": { "ExecuteTime": { "end_time": "2024-02-27T12:58:25.137020130Z", "start_time": "2024-02-27T12:58:25.134574937Z" } }, "cell_type": "code", "source": [ "df_with_attacks = merged_dataset[merged_dataset[\"Attack\"] > 0]\n", "len(df_with_attacks)" ], "id": "9a2be6344480c108", "outputs": [ { "data": { "text/plain": "581" }, "execution_count": 7, "metadata": {}, "output_type": "execute_result" } ], "execution_count": 7 }, { "metadata": { "ExecuteTime": { "end_time": "2024-02-26T11:29:07.686861Z", "start_time": "2024-02-26T11:29:07.659441Z" } }, "cell_type": "code", "source": [ "df_to_use" ], "id": "c721f82aa7b67e1e", "outputs": [ { "data": { "text/plain": [ " tcp/tcp.flags/tcp.flags.reset arp/arp.proto.size \\\n", "1 False 4.0 \n", "624196 False NaN \n", "624197 False NaN \n", "624198 False NaN \n", "624199 False NaN \n", "... ... ... \n", "1001457 True NaN \n", "1001458 False 4.0 \n", "1001459 False 4.0 \n", "1001460 False NaN \n", "1002187 False NaN \n", "\n", " tcp/tcp.options/tcp.options.nop tcp/tcp.checksum.status \\\n", "1 NaN NaN \n", "624196 NaN 2.0 \n", "624197 NaN 2.0 \n", "624198 NaN 2.0 \n", "624199 NaN 2.0 \n", "... ... ... \n", "1001457 NaN 2.0 \n", "1001458 NaN NaN \n", "1001459 NaN NaN \n", "1001460 NaN 2.0 \n", "1002187 NaN NaN \n", "\n", " udp/udp.checksum.status tcp/tcp.nxtseq \\\n", "1 NaN NaN \n", "624196 NaN 354.0 \n", "624197 NaN 354.0 \n", "624198 NaN 353.0 \n", "624199 NaN 353.0 \n", "... ... ... \n", "1001457 NaN 1.0 \n", "1001458 NaN NaN \n", "1001459 NaN NaN \n", "1001460 NaN 4210.0 \n", "1002187 NaN NaN \n", "\n", " tcp/tcp.options/tcp.options.mss/tcp.options.mss_val tcp/tcp.hdr_len \\\n", "1 NaN NaN \n", "624196 NaN 20.0 \n", "624197 NaN 20.0 \n", "624198 NaN 20.0 \n", "624199 NaN 20.0 \n", "... ... ... \n", "1001457 NaN 20.0 \n", "1001458 NaN NaN \n", "1001459 NaN NaN \n", "1001460 NaN 20.0 \n", "1002187 NaN NaN \n", "\n", " tcp/tcp.stream ip/ip.dst ... Farbeändern Helligkeitssteuern \\\n", "1 NaN NaN ... NaN NaN \n", "624196 42.0 192.168.1.218 ... NaN NaN \n", "624197 42.0 192.168.1.218 ... NaN NaN \n", "624198 42.0 192.168.1.218 ... NaN NaN \n", "624199 42.0 192.168.1.218 ... NaN NaN \n", "... ... ... ... ... ... \n", "1001457 1002.0 192.168.1.229 ... NaN NaN \n", "1001458 NaN NaN ... NaN NaN \n", "1001459 NaN NaN ... NaN NaN \n", "1001460 0.0 76.223.105.139 ... NaN NaN \n", "1002187 NaN NaN ... NaN NaN \n", "\n", " Weiß/gelb Themen Auswahl Party Zeitschalter Timer Ein/Aus \\\n", "1 NaN NaN NaN NaN NaN \n", "624196 NaN NaN NaN NaN NaN \n", "624197 NaN NaN NaN NaN NaN \n", "624198 NaN NaN NaN NaN NaN \n", "624199 NaN NaN NaN NaN NaN \n", "... ... ... ... ... ... \n", "1001457 NaN NaN NaN NaN NaN \n", "1001458 NaN NaN NaN NaN NaN \n", "1001459 NaN NaN NaN NaN NaN \n", "1001460 NaN NaN NaN NaN NaN \n", "1002187 NaN NaN NaN NaN NaN \n", "\n", " presence_absence illuminance_level Attack \n", "1 NaN NaN True \n", "624196 NaN NaN True \n", "624197 NaN NaN True \n", "624198 NaN NaN True \n", "624199 NaN NaN True \n", "... ... ... ... \n", "1001457 NaN NaN True \n", "1001458 NaN NaN True \n", "1001459 NaN NaN True \n", "1001460 NaN NaN True \n", "1002187 NaN NaN True \n", "\n", "[581 rows x 101 columns]" ], "text/html": [ "
| \n", " | tcp/tcp.flags/tcp.flags.reset | \n", "arp/arp.proto.size | \n", "tcp/tcp.options/tcp.options.nop | \n", "tcp/tcp.checksum.status | \n", "udp/udp.checksum.status | \n", "tcp/tcp.nxtseq | \n", "tcp/tcp.options/tcp.options.mss/tcp.options.mss_val | \n", "tcp/tcp.hdr_len | \n", "tcp/tcp.stream | \n", "ip/ip.dst | \n", "... | \n", "Farbeändern | \n", "Helligkeitssteuern | \n", "Weiß/gelb | \n", "Themen Auswahl | \n", "Party | \n", "Zeitschalter | \n", "Timer Ein/Aus | \n", "presence_absence | \n", "illuminance_level | \n", "Attack | \n", "
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | \n", "False | \n", "4.0 | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "... | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "True | \n", "
| 624196 | \n", "False | \n", "NaN | \n", "NaN | \n", "2.0 | \n", "NaN | \n", "354.0 | \n", "NaN | \n", "20.0 | \n", "42.0 | \n", "192.168.1.218 | \n", "... | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "True | \n", "
| 624197 | \n", "False | \n", "NaN | \n", "NaN | \n", "2.0 | \n", "NaN | \n", "354.0 | \n", "NaN | \n", "20.0 | \n", "42.0 | \n", "192.168.1.218 | \n", "... | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "True | \n", "
| 624198 | \n", "False | \n", "NaN | \n", "NaN | \n", "2.0 | \n", "NaN | \n", "353.0 | \n", "NaN | \n", "20.0 | \n", "42.0 | \n", "192.168.1.218 | \n", "... | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "True | \n", "
| 624199 | \n", "False | \n", "NaN | \n", "NaN | \n", "2.0 | \n", "NaN | \n", "353.0 | \n", "NaN | \n", "20.0 | \n", "42.0 | \n", "192.168.1.218 | \n", "... | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "True | \n", "
| ... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "... | \n", "
| 1001457 | \n", "True | \n", "NaN | \n", "NaN | \n", "2.0 | \n", "NaN | \n", "1.0 | \n", "NaN | \n", "20.0 | \n", "1002.0 | \n", "192.168.1.229 | \n", "... | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "True | \n", "
| 1001458 | \n", "False | \n", "4.0 | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "... | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "True | \n", "
| 1001459 | \n", "False | \n", "4.0 | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "... | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "True | \n", "
| 1001460 | \n", "False | \n", "NaN | \n", "NaN | \n", "2.0 | \n", "NaN | \n", "4210.0 | \n", "NaN | \n", "20.0 | \n", "0.0 | \n", "76.223.105.139 | \n", "... | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "True | \n", "
| 1002187 | \n", "False | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "... | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "NaN | \n", "True | \n", "
581 rows × 101 columns
\n", "