ma_cisco_malware/main.py

288 lines
10 KiB
Python
Raw Normal View History

2017-07-03 13:48:12 +02:00
import argparse
2017-07-09 23:58:08 +02:00
import os
2017-07-03 13:48:12 +02:00
from keras.callbacks import ModelCheckpoint, CSVLogger, EarlyStopping
2017-07-08 17:46:07 +02:00
from keras.models import load_model
import dataset
2017-07-07 16:48:10 +02:00
import hyperband
import models
2017-07-03 13:48:12 +02:00
parser = argparse.ArgumentParser()
2017-07-08 17:46:07 +02:00
parser.add_argument("--modes", action="store", dest="modes", nargs="+",
default=[])
2017-07-05 21:19:19 +02:00
parser.add_argument("--train", action="store", dest="train_data",
default="data/full_dataset.csv.tar.bz2")
parser.add_argument("--test", action="store", dest="test_data",
default="data/full_future_dataset.csv.tar.bz2")
2017-07-03 13:48:12 +02:00
# parser.add_argument("--h5data", action="store", dest="h5data",
# default="")
#
parser.add_argument("--models", action="store", dest="model_path",
default="models/models_x")
2017-07-05 21:19:19 +02:00
2017-07-03 13:48:12 +02:00
# parser.add_argument("--pred", action="store", dest="pred",
# default="")
#
2017-07-07 16:48:10 +02:00
parser.add_argument("--type", action="store", dest="model_type",
default="paul")
2017-07-03 13:48:12 +02:00
parser.add_argument("--batch", action="store", dest="batch_size",
default=64, type=int)
parser.add_argument("--epochs", action="store", dest="epochs",
default=10, type=int)
# parser.add_argument("--samples", action="store", dest="samples",
# default=100000, type=int)
#
# parser.add_argument("--samples_val", action="store", dest="samples_val",
# default=10000, type=int)
#
parser.add_argument("--embd", action="store", dest="embedding",
default=128, type=int)
parser.add_argument("--hidden_char_dims", action="store", dest="hidden_char_dims",
default=256, type=int)
parser.add_argument("--window", action="store", dest="window",
default=10, type=int)
parser.add_argument("--domain_length", action="store", dest="domain_length",
default=40, type=int)
parser.add_argument("--domain_embd", action="store", dest="domain_embedding",
default=512, type=int)
2017-07-03 13:48:12 +02:00
# parser.add_argument("--queue", action="store", dest="queue_size",
# default=50, type=int)
#
# parser.add_argument("--p", action="store", dest="p_train",
# default=0.5, type=float)
#
# parser.add_argument("--p_val", action="store", dest="p_val",
# default=0.01, type=float)
#
# parser.add_argument("--gpu", action="store", dest="gpu",
# default=0, type=int)
#
# parser.add_argument("--tmp", action="store_true", dest="tmp")
#
2017-07-05 21:19:19 +02:00
# parser.add_argument("--test", action="store_true", dest="test")
2017-07-03 13:48:12 +02:00
args = parser.parse_args()
args.embedding_model = os.path.join(args.model_path, "embd.h5")
args.clf_model = os.path.join(args.model_path, "clf.h5")
args.train_log = os.path.join(args.model_path, "train.log")
2017-07-09 23:58:08 +02:00
args.h5data = args.train_data + ".h5"
2017-07-08 15:04:58 +02:00
2017-06-30 10:42:21 +02:00
# config = tf.ConfigProto(log_device_placement=True)
# config.gpu_options.per_process_gpu_memory_fraction = 0.5
# config.gpu_options.allow_growth = True
# session = tf.Session(config=config)
2017-07-09 23:58:08 +02:00
def exists_or_make_path(p):
if not os.path.exists(p):
os.makedirs(p)
2017-07-08 11:53:03 +02:00
def main_paul_best():
char_dict = dataset.get_character_dict()
domain_tr, flow_tr, client_tr, server_tr = load_or_generate_h5data(args.h5data, args.train_data,
args.domain_length, args.window)
2017-07-08 11:53:03 +02:00
param = models.pauls_networks.best_config
param["vocab_size"] = len(char_dict) + 1
embedding, model = models.get_models_by_params(param)
model.compile(optimizer='adam',
loss='categorical_crossentropy',
metrics=['accuracy'])
model.fit([domain_tr, flow_tr],
[client_tr, server_tr],
batch_size=args.batch_size,
epochs=args.epochs,
shuffle=True,
validation_split=0.2)
2017-07-08 15:04:58 +02:00
embedding.save(args.embedding_model)
model.save(args.clf_model)
2017-07-08 11:53:03 +02:00
2017-07-07 16:48:10 +02:00
def main_hyperband():
char_dict = dataset.get_character_dict()
user_flow_df = dataset.get_user_flow_data(args.train_data)
params = {
# static params
"type": ["paul"],
"batch_size": [64],
"vocab_size": [len(char_dict) + 1],
"window_size": [10],
"domain_length": [40],
"flow_features": [3],
"input_length": [40],
# model params
"embedding_size": [16, 32, 64, 128, 256, 512],
"filter_embedding": [16, 32, 64, 128, 256, 512],
"kernel_embedding": [1, 3, 5, 7, 9],
"hidden_embedding": [16, 32, 64, 128, 256, 512],
"dropout": [0.5],
"domain_features": [16, 32, 64, 128, 256, 512],
"filter_main": [16, 32, 64, 128, 256, 512],
"kernels_main": [1, 3, 5, 7, 9],
"dense_main": [16, 32, 64, 128, 256, 512],
}
param = hyperband.sample_params(params)
print(param)
print("create training dataset")
domain_tr, flow_tr, client_tr, server_tr = dataset.create_dataset_from_flows(user_flow_df, char_dict,
max_len=args.domain_length,
window_size=args.window)
2017-07-07 16:48:10 +02:00
hp = hyperband.Hyperband(params, [domain_tr, flow_tr], [client_tr, server_tr])
hp.run()
def load_or_generate_h5data(h5data, train_data, domain_length, window_size):
char_dict = dataset.get_character_dict()
print("check for h5data", h5data)
2017-07-09 23:58:08 +02:00
try:
open(h5data, "r")
2017-07-09 23:58:08 +02:00
except FileNotFoundError:
print("h5 data not found - load csv file")
user_flow_df = dataset.get_user_flow_data(train_data)
2017-07-09 23:58:08 +02:00
print("create training dataset")
domain_tr, flow_tr, client_tr, server_tr = dataset.create_dataset_from_flows(user_flow_df, char_dict,
max_len=domain_length,
window_size=window_size)
2017-07-09 23:58:08 +02:00
print("store training dataset as h5 file")
dataset.store_h5dataset(args.h5data, domain_tr, flow_tr, client_tr, server_tr)
print("load h5 dataset")
return dataset.load_h5dataset(h5data)
def main_train():
exists_or_make_path(args.model_path)
char_dict = dataset.get_character_dict()
domain_tr, flow_tr, client_tr, server_tr = load_or_generate_h5data(args.h5data, args.train_data,
args.domain_length, args.window)
2017-07-09 23:58:08 +02:00
# parameter
param = {
"type": "paul",
"batch_size": 64,
"window_size": args.window,
"domain_length": args.domain_length,
"flow_features": 3,
"vocab_size": len(char_dict) + 1,
#
'dropout': 0.5,
'domain_features': args.domain_embedding,
'embedding_size': args.embedding,
'filter_main': 128,
'flow_features': 3,
'dense_main': 512,
'filter_embedding': args.hidden_char_dims,
'hidden_embedding': args.domain_embedding,
'kernel_embedding': 3,
'kernels_main': 3,
'input_length': 40
}
2017-07-09 23:58:08 +02:00
embedding, model = models.get_models_by_params(param)
2017-07-08 11:53:03 +02:00
embedding.summary()
model.summary()
print("define callbacks")
cp = ModelCheckpoint(filepath=args.clf_model,
monitor='val_loss',
verbose=False,
save_best_only=True)
csv = CSVLogger(args.train_log)
early = EarlyStopping(monitor='val_loss',
patience=5,
verbose=False)
print("compile model")
model.compile(optimizer='adam',
2017-07-07 16:48:10 +02:00
loss='categorical_crossentropy',
metrics=['accuracy'])
print("start training")
model.fit([domain_tr, flow_tr],
2017-07-05 21:19:19 +02:00
[client_tr, server_tr],
2017-07-03 13:48:12 +02:00
batch_size=args.batch_size,
epochs=args.epochs,
callbacks=[cp, csv, early],
2017-07-05 21:19:19 +02:00
shuffle=True,
validation_split=0.2)
print("save embedding")
2017-07-08 15:04:58 +02:00
embedding.save(args.embedding_model)
2017-07-07 16:48:10 +02:00
2017-07-05 21:19:19 +02:00
def main_test():
domain_val, flow_val, client_val, server_val = load_or_generate_h5data(args.h5data, args.train_data,
args.domain_length, args.window)
2017-07-08 15:04:58 +02:00
# embedding = load_model(args.embedding_model)
clf = load_model(args.clf_model)
loss, _, _, client_acc, server_acc = clf.evaluate([domain_val, flow_val],
[client_val, server_val],
batch_size=args.batch_size)
print(f"loss: {loss}\nclient acc: {client_acc}\nserver acc: {server_acc}")
def main_visualization():
mask = dataset.load_mask_eval(args.data, args.test_image)
y_pred_path = args.model_path + "pred.npy"
print("plot model")
model = load_model(args.model_path + "model.h5",
custom_objects=evaluation.get_metrics())
visualize.plot_model(model, args.model_path + "model.png")
print("plot training curve")
logs = pd.read_csv(args.model_path + "train.log")
visualize.plot_training_curve(logs, "{}/train.png".format(args.model_path))
pred = np.load(y_pred_path)
print("plot pr curve")
visualize.plot_precision_recall(mask, pred, "{}/prc.png".format(args.model_path))
visualize.plot_precision_recall_curves(mask, pred, "{}/prc2.png".format(args.model_path))
print("plot roc curve")
visualize.plot_roc_curve(mask, pred, "{}/roc.png".format(args.model_path))
print("store prediction image")
visualize.save_image_as(pred, "{}/pred.png".format(args.model_path))
def main_score():
mask = dataset.load_mask_eval(args.data, args.test_image)
pred = np.load(args.pred)
visualize.score_model(mask, pred)
def main():
2017-07-07 16:48:10 +02:00
if "train" in args.modes:
main_train()
if "hyperband" in args.modes:
main_hyperband()
if "test" in args.modes:
main_test()
if "fancy" in args.modes:
main_visualization()
if "score" in args.modes:
main_score()
2017-07-08 11:53:03 +02:00
if "paul" in args.modes:
main_paul_best()
if __name__ == "__main__":
main()