ma_cisco_malware/main.py

import argparse
import os

from keras.models import load_model
from keras.utils import np_utils

import dataset
import hyperband
import models

parser = argparse.ArgumentParser()

parser.add_argument("--modes", action="store", dest="modes", nargs="+",
                    default=[])

parser.add_argument("--train", action="store", dest="train_data",
                    default="data/full_dataset.csv.tar.bz2")

parser.add_argument("--test", action="store", dest="test_data",
                    default="data/full_future_dataset.csv.tar.bz2")

# parser.add_argument("--h5data", action="store", dest="h5data",
#                     default="")
#
parser.add_argument("--models", action="store", dest="models",
                    default="models/model_x")

# parser.add_argument("--pred", action="store", dest="pred",
#                     default="")
#
parser.add_argument("--type", action="store", dest="model_type",
                    default="paul")

parser.add_argument("--batch", action="store", dest="batch_size",
                    default=64, type=int)

parser.add_argument("--epochs", action="store", dest="epochs",
                    default=10, type=int)

# parser.add_argument("--samples", action="store", dest="samples",
#                     default=100000, type=int)
#
# parser.add_argument("--samples_val", action="store", dest="samples_val",
#                     default=10000, type=int)
#
parser.add_argument("--embd", action="store", dest="embedding",
                    default=128, type=int)

parser.add_argument("--hidden_char_dims", action="store", dest="hidden_char_dims",
                    default=256, type=int)

parser.add_argument("--window", action="store", dest="window",
                    default=10, type=int)

parser.add_argument("--domain_length", action="store", dest="domain_length",
                    default=40, type=int)

parser.add_argument("--domain_embd", action="store", dest="domain_embedding",
                    default=512, type=int)

# parser.add_argument("--queue", action="store", dest="queue_size",
#                     default=50, type=int)
#
# parser.add_argument("--p", action="store", dest="p_train",
#                     default=0.5, type=float)
#
# parser.add_argument("--p_val", action="store", dest="p_val",
#                     default=0.01, type=float)
#
# parser.add_argument("--gpu", action="store", dest="gpu",
#                     default=0, type=int)
#
# parser.add_argument("--tmp", action="store_true", dest="tmp")
#
# parser.add_argument("--test", action="store_true", dest="test")

args = parser.parse_args()

args.embedding_model = args.models + "_embd.h5"
args.clf_model = args.models + "_clf.h5"
args.h5data = args.train_data + ".h5"


# config = tf.ConfigProto(log_device_placement=True)
# config.gpu_options.per_process_gpu_memory_fraction = 0.5
# config.gpu_options.allow_growth = True
# session = tf.Session(config=config)


def exists_or_make_path(p):
    if not os.path.exists(p):
        os.makedirs(p)


def main_paul_best():
    char_dict = dataset.get_character_dict()
    user_flow_df = dataset.get_user_flow_data(args.train_data)

    param = models.pauls_networks.best_config
    param["vocab_size"] = len(char_dict) + 1
    print(param)

    print("create training dataset")
    domain_tr, flow_tr, client_tr, server_tr = dataset.create_dataset_from_flows(
        user_flow_df, char_dict,
        max_len=args.domain_length,
        window_size=args.window)
    client_tr = np_utils.to_categorical(client_tr, 2)
    server_tr = np_utils.to_categorical(server_tr, 2)

    embedding, model = models.get_models_by_params(param)

    model.compile(optimizer='adam',
                  loss='categorical_crossentropy',
                  metrics=['accuracy'])

    model.fit([domain_tr, flow_tr],
              [client_tr, server_tr],
              batch_size=args.batch_size,
              epochs=args.epochs,
              shuffle=True,
              validation_split=0.2)

    embedding.save(args.embedding_model)
    model.save(args.clf_model)


def main_hyperband():
    char_dict = dataset.get_character_dict()
    user_flow_df = dataset.get_user_flow_data(args.train_data)

    params = {
        # static params
        "type": ["paul"],
        "batch_size": [64],
        "vocab_size": [len(char_dict) + 1],
        "window_size": [10],
        "domain_length": [40],
        "flow_features": [3],
        "input_length": [40],
        # model params
        "embedding_size": [16, 32, 64, 128, 256, 512],
        "filter_embedding": [16, 32, 64, 128, 256, 512],
        "kernel_embedding": [1, 3, 5, 7, 9],
        "hidden_embedding": [16, 32, 64, 128, 256, 512],
        "dropout": [0.5],
        "domain_features": [16, 32, 64, 128, 256, 512],
        "filter_main": [16, 32, 64, 128, 256, 512],
        "kernels_main": [1, 3, 5, 7, 9],
        "dense_main": [16, 32, 64, 128, 256, 512],
    }
    param = hyperband.sample_params(params)
    print(param)

    print("create training dataset")
    domain_tr, flow_tr, client_tr, server_tr = dataset.create_dataset_from_flows(
        user_flow_df, char_dict,
        max_len=args.domain_length,
        window_size=args.window)

    hp = hyperband.Hyperband(params, [domain_tr, flow_tr], [client_tr, server_tr])
    hp.run()


def main_train():
    exists_or_make_path(args.clf_model)
    char_dict = dataset.get_character_dict()
    print("check for h5data")
    try:
        open(args.h5data, "r")
    except FileNotFoundError:
        user_flow_df = dataset.get_user_flow_data(args.train_data)
        print("create training dataset")
        domain_tr, flow_tr, client_tr, server_tr = dataset.create_dataset_from_flows(
            user_flow_df, char_dict,
            max_len=args.domain_length, window_size=args.window)
        print("store training dataset as h5 file")
        dataset.store_h5dataset(args.h5data, domain_tr, flow_tr, client_tr, server_tr)
    print("load h5 dataset")
    domain_tr, flow_tr, client_tr, server_tr = dataset.load_h5dataset(args.h5data)

    # parameter
    param = {
        "type": "paul",
        "batch_size": 64,
        "window_size": args.window,
        "domain_length": args.domain_length,
        "flow_features": 3,
        "vocab_size": len(char_dict) + 1,
        #
        'dropout': 0.5,
        'domain_features': args.domain_embedding,
        'embedding_size': args.embedding,
        'filter_main': 128,
        'flow_features': 3,
        'dense_main': 512,
        'filter_embedding': args.hidden_char_dims,
        'hidden_embedding': args.domain_embedding,
        'kernel_embedding': 3,
        'kernels_main': 3,
        'input_length': 40
    }

    embedding, model = models.get_models_by_params(param)
    embedding.summary()
    model.summary()

    model.compile(optimizer='adam',
                  loss='categorical_crossentropy',
                  metrics=['accuracy'])

    model.fit([domain_tr, flow_tr],
              [client_tr, server_tr],
              batch_size=args.batch_size,
              epochs=args.epochs,
              shuffle=True,
              validation_split=0.2)

    embedding.save(args.embedding_model)
    model.save(args.clf_model)


def main_test():
    char_dict = dataset.get_character_dict()
    user_flow_df = dataset.get_user_flow_data(args.test_data)
    domain_val, flow_val, client_val, server_val = dataset.create_dataset_from_flows(
        user_flow_df, char_dict,
        max_len=args.domain_length, window_size=args.window)
    # embedding = load_model(args.embedding_model)
    clf = load_model(args.clf_model)

    print(clf.evaluate([domain_val, flow_val],
                       [client_val, server_val],
                       batch_size=args.batch_size))


def main_visualization():
    mask = dataset.load_mask_eval(args.data, args.test_image)
    y_pred_path = args.model_path + "pred.npy"
    print("plot model")
    model = load_model(args.model_path + "model.h5",
                       custom_objects=evaluation.get_metrics())
    visualize.plot_model(model, args.model_path + "model.png")
    print("plot training curve")
    logs = pd.read_csv(args.model_path + "train.log")
    visualize.plot_training_curve(logs, "{}/train.png".format(args.model_path))
    pred = np.load(y_pred_path)
    print("plot pr curve")
    visualize.plot_precision_recall(mask, pred, "{}/prc.png".format(args.model_path))
    visualize.plot_precision_recall_curves(mask, pred, "{}/prc2.png".format(args.model_path))
    print("plot roc curve")
    visualize.plot_roc_curve(mask, pred, "{}/roc.png".format(args.model_path))
    print("store prediction image")
    visualize.save_image_as(pred, "{}/pred.png".format(args.model_path))


def main_score():
    mask = dataset.load_mask_eval(args.data, args.test_image)
    pred = np.load(args.pred)
    visualize.score_model(mask, pred)


def main():
    if "train" in args.modes:
        main_train()
    if "hyperband" in args.modes:
        main_hyperband()
    if "test" in args.modes:
        main_test()
    if "fancy" in args.modes:
        main_visualization()
    if "score" in args.modes:
        main_score()
    if "paul" in args.modes:
        main_paul_best()


if __name__ == "__main__":
    main()