Random Forest classifier on the KDD CUP 99 dataset.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>hot</th>\n",
       "      <th>num_failed_logins</th>\n",
       "      <th>logged_in</th>\n",
       "      <th>num_compromised</th>\n",
       "      <th>...</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>count</th>\n",
       "      <td>494021.000000</td>\n",
       "      <td>4.940210e+05</td>\n",
       "      <td>4.940210e+05</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>mean</th>\n",
       "      <td>47.979302</td>\n",
       "      <td>3.025610e+03</td>\n",
       "      <td>8.685324e+02</td>\n",
       "      <td>0.000045</td>\n",
       "      <td>0.006433</td>\n",
       "      <td>0.000014</td>\n",
       "      <td>0.034519</td>\n",
       "      <td>0.000152</td>\n",
       "      <td>0.148247</td>\n",
       "      <td>0.010212</td>\n",
       "      <td>...</td>\n",
       "      <td>232.470778</td>\n",
       "      <td>188.665670</td>\n",
       "      <td>0.753780</td>\n",
       "      <td>0.030906</td>\n",
       "      <td>0.601935</td>\n",
       "      <td>0.006684</td>\n",
       "      <td>0.176754</td>\n",
       "      <td>0.176443</td>\n",
       "      <td>0.058118</td>\n",
       "      <td>0.057412</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>std</th>\n",
       "      <td>707.746472</td>\n",
       "      <td>9.882181e+05</td>\n",
       "      <td>3.304000e+04</td>\n",
       "      <td>0.006673</td>\n",
       "      <td>0.134805</td>\n",
       "      <td>0.005510</td>\n",
       "      <td>0.782103</td>\n",
       "      <td>0.015520</td>\n",
       "      <td>0.355345</td>\n",
       "      <td>1.798326</td>\n",
       "      <td>...</td>\n",
       "      <td>64.745380</td>\n",
       "      <td>106.040437</td>\n",
       "      <td>0.410781</td>\n",
       "      <td>0.109259</td>\n",
       "      <td>0.481309</td>\n",
       "      <td>0.042133</td>\n",
       "      <td>0.380593</td>\n",
       "      <td>0.380919</td>\n",
       "      <td>0.230590</td>\n",
       "      <td>0.230140</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>min</th>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25%</th>\n",
       "      <td>0.000000</td>\n",
       "      <td>4.500000e+01</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>46.000000</td>\n",
       "      <td>0.410000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>50%</th>\n",
       "      <td>0.000000</td>\n",
       "      <td>5.200000e+02</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>75%</th>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.032000e+03</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.040000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>max</th>\n",
       "      <td>58329.000000</td>\n",
       "      <td>6.933756e+08</td>\n",
       "      <td>5.155468e+06</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>3.000000</td>\n",
       "      <td>3.000000</td>\n",
       "      <td>30.000000</td>\n",
       "      <td>5.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>884.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>8 rows × 38 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "            duration     src_bytes     dst_bytes           land  \\\n",
       "count  494021.000000  4.940210e+05  4.940210e+05  494021.000000   \n",
       "mean       47.979302  3.025610e+03  8.685324e+02       0.000045   \n",
       "std       707.746472  9.882181e+05  3.304000e+04       0.006673   \n",
       "min         0.000000  0.000000e+00  0.000000e+00       0.000000   \n",
       "25%         0.000000  4.500000e+01  0.000000e+00       0.000000   \n",
       "50%         0.000000  5.200000e+02  0.000000e+00       0.000000   \n",
       "75%         0.000000  1.032000e+03  0.000000e+00       0.000000   \n",
       "max     58329.000000  6.933756e+08  5.155468e+06       1.000000   \n",
       "\n",
       "       wrong_fragment         urgent            hot  num_failed_logins  \\\n",
       "count   494021.000000  494021.000000  494021.000000      494021.000000   \n",
       "mean         0.006433       0.000014       0.034519           0.000152   \n",
       "std          0.134805       0.005510       0.782103           0.015520   \n",
       "min          0.000000       0.000000       0.000000           0.000000   \n",
       "25%          0.000000       0.000000       0.000000           0.000000   \n",
       "50%          0.000000       0.000000       0.000000           0.000000   \n",
       "75%          0.000000       0.000000       0.000000           0.000000   \n",
       "max          3.000000       3.000000      30.000000           5.000000   \n",
       "\n",
       "           logged_in  num_compromised  ...  dst_host_count  \\\n",
       "count  494021.000000    494021.000000  ...   494021.000000   \n",
       "mean        0.148247         0.010212  ...      232.470778   \n",
       "std         0.355345         1.798326  ...       64.745380   \n",
       "min         0.000000         0.000000  ...        0.000000   \n",
       "25%         0.000000         0.000000  ...      255.000000   \n",
       "50%         0.000000         0.000000  ...      255.000000   \n",
       "75%         0.000000         0.000000  ...      255.000000   \n",
       "max         1.000000       884.000000  ...      255.000000   \n",
       "\n",
       "       dst_host_srv_count  dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "count       494021.000000           494021.000000           494021.000000   \n",
       "mean           188.665670                0.753780                0.030906   \n",
       "std            106.040437                0.410781                0.109259   \n",
       "min              0.000000                0.000000                0.000000   \n",
       "25%             46.000000                0.410000                0.000000   \n",
       "50%            255.000000                1.000000                0.000000   \n",
       "75%            255.000000                1.000000                0.040000   \n",
       "max            255.000000                1.000000                1.000000   \n",
       "\n",
       "       dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "count                494021.000000                494021.000000   \n",
       "mean                      0.601935                     0.006684   \n",
       "std                       0.481309                     0.042133   \n",
       "min                       0.000000                     0.000000   \n",
       "25%                       0.000000                     0.000000   \n",
       "50%                       1.000000                     0.000000   \n",
       "75%                       1.000000                     0.000000   \n",
       "max                       1.000000                     1.000000   \n",
       "\n",
       "       dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "count         494021.000000             494021.000000         494021.000000   \n",
       "mean               0.176754                  0.176443              0.058118   \n",
       "std                0.380593                  0.380919              0.230590   \n",
       "min                0.000000                  0.000000              0.000000   \n",
       "25%                0.000000                  0.000000              0.000000   \n",
       "50%                0.000000                  0.000000              0.000000   \n",
       "75%                0.000000                  0.000000              0.000000   \n",
       "max                1.000000                  1.000000              1.000000   \n",
       "\n",
       "       dst_host_srv_rerror_rate  \n",
       "count             494021.000000  \n",
       "mean                   0.057412  \n",
       "std                    0.230140  \n",
       "min                    0.000000  \n",
       "25%                    0.000000  \n",
       "50%                    0.000000  \n",
       "75%                    0.000000  \n",
       "max                    1.000000  \n",
       "\n",
       "[8 rows x 38 columns]"
      ]
     },
     "execution_count": 1,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#loading the data\n",
    "import pandas\n",
    "from time import time\n",
    "col_names = [\"duration\", \"protocol_type\", \"service\", \"flag\", \"src_bytes\", \"dst_bytes\", \"land\", \"wrong_fragment\", \"urgent\", \"hot\", \n",
    "             \"num_failed_logins\", \"logged_in\", \"num_compromised\", \"root_shell\", \"su_attempted\", \"num_root\", \"num_file_creations\", \n",
    "             \"num_shells\", \"num_access_files\", \"num_outbound_cmds\", \"is_host_login\", \"is_guest_login\", \"count\", \"srv_count\", \n",
    "             \"serror_rate\", \"srv_serror_rate\", \"rerror_rate\", \"srv_rerror_rate\", \"same_srv_rate\", \"diff_srv_rate\", \n",
    "             \"srv_diff_host_rate\", \"dst_host_count\",\"dst_host_srv_count\", \"dst_host_same_srv_rate\", \"dst_host_diff_srv_rate\", \n",
    "             \"dst_host_same_src_port_rate\", \"dst_host_srv_diff_host_rate\", \"dst_host_serror_rate\", \"dst_host_srv_serror_rate\", \n",
    "             \"dst_host_rerror_rate\", \"dst_host_srv_rerror_rate\", \"label\"]\n",
    "kdd_data_10percent = pandas.read_csv(\"kddcup.data_10_percent_corrected\", names = col_names)\n",
    "kdd_data_10percent.describe()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "smurf.              280790\n",
       "neptune.            107201\n",
       "normal.              97278\n",
       "back.                 2203\n",
       "satan.                1589\n",
       "ipsweep.              1247\n",
       "portsweep.            1040\n",
       "warezclient.          1020\n",
       "teardrop.              979\n",
       "pod.                   264\n",
       "nmap.                  231\n",
       "guess_passwd.           53\n",
       "buffer_overflow.        30\n",
       "land.                   21\n",
       "warezmaster.            20\n",
       "imap.                   12\n",
       "rootkit.                10\n",
       "loadmodule.              9\n",
       "ftp_write.               8\n",
       "multihop.                7\n",
       "phf.                     4\n",
       "perl.                    3\n",
       "spy.                     2\n",
       "Name: label, dtype: int64"
      ]
     },
     "execution_count": 2,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#a look at how the labels are distributed\n",
    "kdd_data_10percent['label'].value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>hot</th>\n",
       "      <th>num_failed_logins</th>\n",
       "      <th>logged_in</th>\n",
       "      <th>num_compromised</th>\n",
       "      <th>...</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>count</th>\n",
       "      <td>494021.000000</td>\n",
       "      <td>4.940210e+05</td>\n",
       "      <td>4.940210e+05</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>mean</th>\n",
       "      <td>47.979302</td>\n",
       "      <td>3.025610e+03</td>\n",
       "      <td>8.685324e+02</td>\n",
       "      <td>0.000045</td>\n",
       "      <td>0.006433</td>\n",
       "      <td>0.000014</td>\n",
       "      <td>0.034519</td>\n",
       "      <td>0.000152</td>\n",
       "      <td>0.148247</td>\n",
       "      <td>0.010212</td>\n",
       "      <td>...</td>\n",
       "      <td>232.470778</td>\n",
       "      <td>188.665670</td>\n",
       "      <td>0.753780</td>\n",
       "      <td>0.030906</td>\n",
       "      <td>0.601935</td>\n",
       "      <td>0.006684</td>\n",
       "      <td>0.176754</td>\n",
       "      <td>0.176443</td>\n",
       "      <td>0.058118</td>\n",
       "      <td>0.057412</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>std</th>\n",
       "      <td>707.746472</td>\n",
       "      <td>9.882181e+05</td>\n",
       "      <td>3.304000e+04</td>\n",
       "      <td>0.006673</td>\n",
       "      <td>0.134805</td>\n",
       "      <td>0.005510</td>\n",
       "      <td>0.782103</td>\n",
       "      <td>0.015520</td>\n",
       "      <td>0.355345</td>\n",
       "      <td>1.798326</td>\n",
       "      <td>...</td>\n",
       "      <td>64.745380</td>\n",
       "      <td>106.040437</td>\n",
       "      <td>0.410781</td>\n",
       "      <td>0.109259</td>\n",
       "      <td>0.481309</td>\n",
       "      <td>0.042133</td>\n",
       "      <td>0.380593</td>\n",
       "      <td>0.380919</td>\n",
       "      <td>0.230590</td>\n",
       "      <td>0.230140</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>min</th>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25%</th>\n",
       "      <td>0.000000</td>\n",
       "      <td>4.500000e+01</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>46.000000</td>\n",
       "      <td>0.410000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>50%</th>\n",
       "      <td>0.000000</td>\n",
       "      <td>5.200000e+02</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>75%</th>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.032000e+03</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.040000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>max</th>\n",
       "      <td>58329.000000</td>\n",
       "      <td>6.933756e+08</td>\n",
       "      <td>5.155468e+06</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>3.000000</td>\n",
       "      <td>3.000000</td>\n",
       "      <td>30.000000</td>\n",
       "      <td>5.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>884.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>8 rows × 38 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "            duration     src_bytes     dst_bytes           land  \\\n",
       "count  494021.000000  4.940210e+05  4.940210e+05  494021.000000   \n",
       "mean       47.979302  3.025610e+03  8.685324e+02       0.000045   \n",
       "std       707.746472  9.882181e+05  3.304000e+04       0.006673   \n",
       "min         0.000000  0.000000e+00  0.000000e+00       0.000000   \n",
       "25%         0.000000  4.500000e+01  0.000000e+00       0.000000   \n",
       "50%         0.000000  5.200000e+02  0.000000e+00       0.000000   \n",
       "75%         0.000000  1.032000e+03  0.000000e+00       0.000000   \n",
       "max     58329.000000  6.933756e+08  5.155468e+06       1.000000   \n",
       "\n",
       "       wrong_fragment         urgent            hot  num_failed_logins  \\\n",
       "count   494021.000000  494021.000000  494021.000000      494021.000000   \n",
       "mean         0.006433       0.000014       0.034519           0.000152   \n",
       "std          0.134805       0.005510       0.782103           0.015520   \n",
       "min          0.000000       0.000000       0.000000           0.000000   \n",
       "25%          0.000000       0.000000       0.000000           0.000000   \n",
       "50%          0.000000       0.000000       0.000000           0.000000   \n",
       "75%          0.000000       0.000000       0.000000           0.000000   \n",
       "max          3.000000       3.000000      30.000000           5.000000   \n",
       "\n",
       "           logged_in  num_compromised  ...  dst_host_count  \\\n",
       "count  494021.000000    494021.000000  ...   494021.000000   \n",
       "mean        0.148247         0.010212  ...      232.470778   \n",
       "std         0.355345         1.798326  ...       64.745380   \n",
       "min         0.000000         0.000000  ...        0.000000   \n",
       "25%         0.000000         0.000000  ...      255.000000   \n",
       "50%         0.000000         0.000000  ...      255.000000   \n",
       "75%         0.000000         0.000000  ...      255.000000   \n",
       "max         1.000000       884.000000  ...      255.000000   \n",
       "\n",
       "       dst_host_srv_count  dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "count       494021.000000           494021.000000           494021.000000   \n",
       "mean           188.665670                0.753780                0.030906   \n",
       "std            106.040437                0.410781                0.109259   \n",
       "min              0.000000                0.000000                0.000000   \n",
       "25%             46.000000                0.410000                0.000000   \n",
       "50%            255.000000                1.000000                0.000000   \n",
       "75%            255.000000                1.000000                0.040000   \n",
       "max            255.000000                1.000000                1.000000   \n",
       "\n",
       "       dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "count                494021.000000                494021.000000   \n",
       "mean                      0.601935                     0.006684   \n",
       "std                       0.481309                     0.042133   \n",
       "min                       0.000000                     0.000000   \n",
       "25%                       0.000000                     0.000000   \n",
       "50%                       1.000000                     0.000000   \n",
       "75%                       1.000000                     0.000000   \n",
       "max                       1.000000                     1.000000   \n",
       "\n",
       "       dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "count         494021.000000             494021.000000         494021.000000   \n",
       "mean               0.176754                  0.176443              0.058118   \n",
       "std                0.380593                  0.380919              0.230590   \n",
       "min                0.000000                  0.000000              0.000000   \n",
       "25%                0.000000                  0.000000              0.000000   \n",
       "50%                0.000000                  0.000000              0.000000   \n",
       "75%                0.000000                  0.000000              0.000000   \n",
       "max                1.000000                  1.000000              1.000000   \n",
       "\n",
       "       dst_host_srv_rerror_rate  \n",
       "count             494021.000000  \n",
       "mean                   0.057412  \n",
       "std                    0.230140  \n",
       "min                    0.000000  \n",
       "25%                    0.000000  \n",
       "50%                    0.000000  \n",
       "75%                    0.000000  \n",
       "max                    1.000000  \n",
       "\n",
       "[8 rows x 38 columns]"
      ]
     },
     "execution_count": 3,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#Initially, we will use all features\n",
    "num_features = [\"duration\", \"src_bytes\", \"dst_bytes\", \"land\", \"wrong_fragment\", \"urgent\", \"hot\", \"num_failed_logins\", \n",
    "                \"logged_in\", \"num_compromised\", \"root_shell\", \"su_attempted\", \"num_root\", \"num_file_creations\", \"num_shells\",\n",
    "                \"num_access_files\", \"num_outbound_cmds\", \"is_host_login\", \"is_guest_login\", \"count\", \"srv_count\", \"serror_rate\", \n",
    "                \"srv_serror_rate\", \"rerror_rate\", \"srv_rerror_rate\", \"same_srv_rate\", \"diff_srv_rate\", \"srv_diff_host_rate\",\n",
    "                \"dst_host_count\", \"dst_host_srv_count\", \"dst_host_same_srv_rate\", \"dst_host_diff_srv_rate\", \n",
    "                \"dst_host_same_src_port_rate\", \"dst_host_srv_diff_host_rate\", \"dst_host_serror_rate\", \"dst_host_srv_serror_rate\",\n",
    "                \"dst_host_rerror_rate\", \"dst_host_srv_rerror_rate\"]\n",
    "features = kdd_data_10percent[num_features].astype(float)\n",
    "features.describe()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "attack.    396743\n",
       "normal.     97278\n",
       "Name: label, dtype: int64"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#we are going to reduce the outputs to 'normal' and 'attack'\n",
    "from sklearn.ensemble import RandomForestClassifier\n",
    "labels = kdd_data_10percent['label'].copy()\n",
    "labels[labels != 'normal.'] = 'attack.'\n",
    "labels.value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Classifier trained in 26.862 seconds.\n"
     ]
    }
   ],
   "source": [
    "#Training a classifier\n",
    "from sklearn.ensemble import RandomForestClassifier\n",
    "clf = RandomForestClassifier(random_state = 0)\n",
    "t0 = time()\n",
    "clf.fit(features, labels)\n",
    "tt = time() - t0\n",
    "print (\"Classifier trained in {} seconds.\".format(round(tt, 3)))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "smurf.              164091\n",
       "normal.              60593\n",
       "neptune.             58001\n",
       "snmpgetattack.        7741\n",
       "mailbomb.             5000\n",
       "guess_passwd.         4367\n",
       "snmpguess.            2406\n",
       "satan.                1633\n",
       "warezmaster.          1602\n",
       "back.                 1098\n",
       "mscan.                1053\n",
       "apache2.               794\n",
       "processtable.          759\n",
       "saint.                 736\n",
       "portsweep.             354\n",
       "ipsweep.               306\n",
       "httptunnel.            158\n",
       "pod.                    87\n",
       "nmap.                   84\n",
       "buffer_overflow.        22\n",
       "multihop.               18\n",
       "named.                  17\n",
       "sendmail.               17\n",
       "ps.                     16\n",
       "rootkit.                13\n",
       "xterm.                  13\n",
       "teardrop.               12\n",
       "xlock.                   9\n",
       "land.                    9\n",
       "xsnoop.                  4\n",
       "ftp_write.               3\n",
       "loadmodule.              2\n",
       "perl.                    2\n",
       "udpstorm.                2\n",
       "worm.                    2\n",
       "phf.                     2\n",
       "sqlattack.               2\n",
       "imap.                    1\n",
       "Name: label, dtype: int64"
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#Loading the labelled test data\n",
    "kdd_data_corrected = pandas.read_csv(\"corrected.gz\", header=None, names = col_names)\n",
    "kdd_data_corrected['label'].value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "<ipython-input-9-22d8c81f0749>:2: SettingWithCopyWarning: \n",
      "A value is trying to be set on a copy of a slice from a DataFrame\n",
      "\n",
      "See the caveats in the documentation: https://pandas.pydata.org/pandas-docs/stable/user_guide/indexing.html#returning-a-view-versus-a-copy\n",
      "  kdd_data_corrected['label'][kdd_data_corrected['label']!='normal.'] = 'attack.'\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "attack.    250436\n",
       "normal.     60593\n",
       "Name: label, dtype: int64"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#Converting all the new attack labels to 'attack.'\n",
    "kdd_data_corrected['label'][kdd_data_corrected['label']!='normal.'] = 'attack.'\n",
    "kdd_data_corrected['label'].value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [],
   "source": [
    "from sklearn.model_selection import train_test_split\n",
    "X_train, X_test, y_train, y_test = train_test_split(kdd_data_corrected[num_features],kdd_data_corrected['label'], test_size=0.1,random_state=42)\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Predicted in 0.297 seconds\n"
     ]
    }
   ],
   "source": [
    "#Predictions on the test data\n",
    "clf.fit(features, labels)\n",
    "t0 = time()\n",
    "pred = clf.predict(X_test)\n",
    "tt = time() - t0\n",
    "print (\"Predicted in {} seconds\".format(round(tt,3)))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Accuracy is 0.927.\n"
     ]
    }
   ],
   "source": [
    "#Calculating out the accuracy\n",
    "from sklearn.metrics import accuracy_score\n",
    "acc = accuracy_score(pred, y_test)\n",
    "print (\"Accuracy is {}.\".format(round(acc,4)))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.8"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}