ma_cisco_malware/main.py

import argparse
import os

from keras.callbacks import ModelCheckpoint, CSVLogger, EarlyStopping
from keras.models import load_model

import dataset
import hyperband
import models

parser = argparse.ArgumentParser()

parser.add_argument("--modes", action="store", dest="modes", nargs="+",
                    default=[])

parser.add_argument("--train", action="store", dest="train_data",
                    default="data/full_dataset.csv.tar.bz2")

parser.add_argument("--test", action="store", dest="test_data",
                    default="data/full_future_dataset.csv.tar.bz2")

# parser.add_argument("--h5data", action="store", dest="h5data",
#                     default="")
#
parser.add_argument("--models", action="store", dest="model_path",
                    default="models/models_x")

# parser.add_argument("--pred", action="store", dest="pred",
#                     default="")
#
parser.add_argument("--type", action="store", dest="model_type",
                    default="paul")

parser.add_argument("--batch", action="store", dest="batch_size",
                    default=64, type=int)

parser.add_argument("--epochs", action="store", dest="epochs",
                    default=10, type=int)

# parser.add_argument("--samples", action="store", dest="samples",
#                     default=100000, type=int)
#
# parser.add_argument("--samples_val", action="store", dest="samples_val",
#                     default=10000, type=int)
#
parser.add_argument("--embd", action="store", dest="embedding",
                    default=128, type=int)

parser.add_argument("--hidden_char_dims", action="store", dest="hidden_char_dims",
                    default=256, type=int)

parser.add_argument("--window", action="store", dest="window",
                    default=10, type=int)

parser.add_argument("--domain_length", action="store", dest="domain_length",
                    default=40, type=int)

parser.add_argument("--domain_embd", action="store", dest="domain_embedding",
                    default=512, type=int)

# parser.add_argument("--queue", action="store", dest="queue_size",
#                     default=50, type=int)
#
# parser.add_argument("--p", action="store", dest="p_train",
#                     default=0.5, type=float)
#
# parser.add_argument("--p_val", action="store", dest="p_val",
#                     default=0.01, type=float)
#
# parser.add_argument("--gpu", action="store", dest="gpu",
#                     default=0, type=int)
#
# parser.add_argument("--tmp", action="store_true", dest="tmp")
#
# parser.add_argument("--test", action="store_true", dest="test")

args = parser.parse_args()

args.embedding_model = os.path.join(args.model_path, "embd.h5")
args.clf_model = os.path.join(args.model_path, "clf.h5")
args.train_log = os.path.join(args.model_path, "train.log")
args.h5data = args.train_data + ".h5"


# config = tf.ConfigProto(log_device_placement=True)
# config.gpu_options.per_process_gpu_memory_fraction = 0.5
# config.gpu_options.allow_growth = True
# session = tf.Session(config=config)


def exists_or_make_path(p):
    if not os.path.exists(p):
        os.makedirs(p)


def main_paul_best():
    char_dict = dataset.get_character_dict()
    domain_tr, flow_tr, client_tr, server_tr = load_or_generate_h5data(args.h5data, args.train_data,
                                                                       args.domain_length, args.window)

    param = models.pauls_networks.best_config
    param["vocab_size"] = len(char_dict) + 1

    embedding, model = models.get_models_by_params(param)

    model.compile(optimizer='adam',
                  loss='categorical_crossentropy',
                  metrics=['accuracy'])

    model.fit([domain_tr, flow_tr],
              [client_tr, server_tr],
              batch_size=args.batch_size,
              epochs=args.epochs,
              shuffle=True,
              validation_split=0.2)

    embedding.save(args.embedding_model)
    model.save(args.clf_model)


def main_hyperband():
    char_dict = dataset.get_character_dict()
    user_flow_df = dataset.get_user_flow_data(args.train_data)

    params = {
        # static params
        "type": ["paul"],
        "batch_size": [64],
        "vocab_size": [len(char_dict) + 1],
        "window_size": [10],
        "domain_length": [40],
        "flow_features": [3],
        "input_length": [40],
        # model params
        "embedding_size": [16, 32, 64, 128, 256, 512],
        "filter_embedding": [16, 32, 64, 128, 256, 512],
        "kernel_embedding": [1, 3, 5, 7, 9],
        "hidden_embedding": [16, 32, 64, 128, 256, 512],
        "dropout": [0.5],
        "domain_features": [16, 32, 64, 128, 256, 512],
        "filter_main": [16, 32, 64, 128, 256, 512],
        "kernels_main": [1, 3, 5, 7, 9],
        "dense_main": [16, 32, 64, 128, 256, 512],
    }
    param = hyperband.sample_params(params)
    print(param)

    print("create training dataset")
    domain_tr, flow_tr, client_tr, server_tr = dataset.create_dataset_from_flows(user_flow_df, char_dict,
                                                                                 max_len=args.domain_length,
                                                                                 window_size=args.window)

    hp = hyperband.Hyperband(params, [domain_tr, flow_tr], [client_tr, server_tr])
    hp.run()


def load_or_generate_h5data(h5data, train_data, domain_length, window_size):
    char_dict = dataset.get_character_dict()
    print("check for h5data", h5data)
    try:
        open(h5data, "r")
    except FileNotFoundError:
        print("h5 data not found - load csv file")
        user_flow_df = dataset.get_user_flow_data(train_data)
        print("create training dataset")
        domain_tr, flow_tr, client_tr, server_tr = dataset.create_dataset_from_flows(user_flow_df, char_dict,
                                                                                     max_len=domain_length,
                                                                                     window_size=window_size)
        print("store training dataset as h5 file")
        dataset.store_h5dataset(args.h5data, domain_tr, flow_tr, client_tr, server_tr)
    print("load h5 dataset")
    return dataset.load_h5dataset(h5data)


def main_train():
    exists_or_make_path(args.model_path)

    char_dict = dataset.get_character_dict()
    domain_tr, flow_tr, client_tr, server_tr = load_or_generate_h5data(args.h5data, args.train_data,
                                                                       args.domain_length, args.window)

    # parameter
    param = {
        "type": "paul",
        "batch_size": 64,
        "window_size": args.window,
        "domain_length": args.domain_length,
        "flow_features": 3,
        "vocab_size": len(char_dict) + 1,
        #
        'dropout': 0.5,
        'domain_features': args.domain_embedding,
        'embedding_size': args.embedding,
        'filter_main': 128,
        'flow_features': 3,
        'dense_main': 512,
        'filter_embedding': args.hidden_char_dims,
        'hidden_embedding': args.domain_embedding,
        'kernel_embedding': 3,
        'kernels_main': 3,
        'input_length': 40
    }

    embedding, model = models.get_models_by_params(param)
    embedding.summary()
    model.summary()
    print("define callbacks")
    cp = ModelCheckpoint(filepath=args.clf_model,
                         monitor='val_loss',
                         verbose=False,
                         save_best_only=True)
    csv = CSVLogger(args.train_log)
    early = EarlyStopping(monitor='val_loss',
                          patience=5,
                          verbose=False)
    print("compile model")
    model.compile(optimizer='adam',
                  loss='categorical_crossentropy',
                  metrics=['accuracy'])
    print("start training")
    model.fit([domain_tr, flow_tr],
              [client_tr, server_tr],
              batch_size=args.batch_size,
              epochs=args.epochs,
              callbacks=[cp, csv, early],
              shuffle=True,
              validation_split=0.2)
    print("save embedding")
    embedding.save(args.embedding_model)


def main_test():
    domain_val, flow_val, client_val, server_val = load_or_generate_h5data(args.h5data, args.train_data,
                                                                           args.domain_length, args.window)
    # embedding = load_model(args.embedding_model)
    clf = load_model(args.clf_model)

    loss, _, _, client_acc, server_acc = clf.evaluate([domain_val, flow_val],
                                                      [client_val, server_val],
                                                      batch_size=args.batch_size)

    print(f"loss: {loss}\nclient acc: {client_acc}\nserver acc: {server_acc}")


def main_visualization():
    mask = dataset.load_mask_eval(args.data, args.test_image)
    y_pred_path = args.model_path + "pred.npy"
    print("plot model")
    model = load_model(args.model_path + "model.h5",
                       custom_objects=evaluation.get_metrics())
    visualize.plot_model(model, args.model_path + "model.png")
    print("plot training curve")
    logs = pd.read_csv(args.model_path + "train.log")
    visualize.plot_training_curve(logs, "{}/train.png".format(args.model_path))
    pred = np.load(y_pred_path)
    print("plot pr curve")
    visualize.plot_precision_recall(mask, pred, "{}/prc.png".format(args.model_path))
    visualize.plot_precision_recall_curves(mask, pred, "{}/prc2.png".format(args.model_path))
    print("plot roc curve")
    visualize.plot_roc_curve(mask, pred, "{}/roc.png".format(args.model_path))
    print("store prediction image")
    visualize.save_image_as(pred, "{}/pred.png".format(args.model_path))


def main_score():
    mask = dataset.load_mask_eval(args.data, args.test_image)
    pred = np.load(args.pred)
    visualize.score_model(mask, pred)


def main():
    if "train" in args.modes:
        main_train()
    if "hyperband" in args.modes:
        main_hyperband()
    if "test" in args.modes:
        main_test()
    if "fancy" in args.modes:
        main_visualization()
    if "score" in args.modes:
        main_score()
    if "paul" in args.modes:
        main_paul_best()


if __name__ == "__main__":
    main()