ma_cisco_malware/main.py

138 lines
4.7 KiB
Python

import argparse
import numpy as np
from keras.utils import np_utils
import dataset
import models
parser = argparse.ArgumentParser()
parser.add_argument("--modes", action="store", dest="modes", nargs="+")
# parser.add_argument("--data", action="store", dest="data",
# default="data/")
#
# parser.add_argument("--h5data", action="store", dest="h5data",
# default="")
#
# parser.add_argument("--model", action="store", dest="model",
# default="model_x")
#
# parser.add_argument("--pred", action="store", dest="pred",
# default="")
#
# parser.add_argument("--type", action="store", dest="model_type",
# default="simple_conv")
#
parser.add_argument("--batch", action="store", dest="batch_size",
default=64, type=int)
parser.add_argument("--epochs", action="store", dest="epochs",
default=10, type=int)
# parser.add_argument("--samples", action="store", dest="samples",
# default=100000, type=int)
#
# parser.add_argument("--samples_val", action="store", dest="samples_val",
# default=10000, type=int)
#
parser.add_argument("--embd", action="store", dest="embedding",
default=128, type=int)
parser.add_argument("--hidden_char_dims", action="store", dest="hidden_char_dims",
default=256, type=int)
parser.add_argument("--window", action="store", dest="window",
default=10, type=int)
parser.add_argument("--domain_length", action="store", dest="domain_length",
default=40, type=int)
parser.add_argument("--domain_embd", action="store", dest="domain_embedding",
default=512, type=int)
# parser.add_argument("--queue", action="store", dest="queue_size",
# default=50, type=int)
#
# parser.add_argument("--p", action="store", dest="p_train",
# default=0.5, type=float)
#
# parser.add_argument("--p_val", action="store", dest="p_val",
# default=0.01, type=float)
#
# parser.add_argument("--gpu", action="store", dest="gpu",
# default=0, type=int)
#
# parser.add_argument("--tmp", action="store_true", dest="tmp")
#
# parser.add_argument("--test", action="store", dest="test_image",
# default=6, choices=range(7), type=int)
args = parser.parse_args()
# config = tf.ConfigProto(log_device_placement=True)
# config.gpu_options.per_process_gpu_memory_fraction = 0.5
# config.gpu_options.allow_growth = True
# session = tf.Session(config=config)
def main():
# parameter
cnnDropout = 0.5
cnnHiddenDims = 1024
flowFeatures = 3
numCiscoFeatures = 30
kernel_size = 3
drop_out = 0.5
filters = 128
hidden_dims = 100
vocabSize = 40
threshold = 3
minFlowsPerUser = 10
char_dict = dataset.get_character_dict()
user_flow_df = dataset.get_user_flow_data()
print("create training dataset")
(X_tr, hits_tr, names_tr, server_tr, trusted_hits_tr) = dataset.create_dataset_from_flows(
user_flow_df, char_dict,
max_len=args.domain_length, window_size=args.window)
# make client labels discrete with 4 different values
# TODO: use trusted_hits_tr for client classification too
client_labels = np.apply_along_axis(lambda x: dataset.discretize_label(x, 3), 0, np.atleast_2d(hits_tr))
# select only 1.0 and 0.0 from training data
pos_idx = np.where(client_labels == 1.0)[0]
neg_idx = np.where(client_labels == 0.0)[0]
idx = np.concatenate((pos_idx, neg_idx))
# select labels for prediction
client_labels = client_labels[idx]
server_labels = server_tr[idx]
shared_cnn = models.get_embedding_network_rene(len(char_dict) + 1, args.embedding, args.domain_length,
args.hidden_char_dims, args.domain_embedding, 0.5)
shared_cnn.summary()
model = models.get_top_cnn_rene(cnnDropout, flowFeatures, args.domain_embedding,
args.window, args.domain_length, filters, kernel_size,
cnnHiddenDims, shared_cnn)
model.summary()
model.compile(optimizer='adam',
loss='binary_crossentropy',
metrics=['accuracy'])
client_labels = np_utils.to_categorical(client_labels, 2)
server_labels = np_utils.to_categorical(server_labels, 2)
model.fit(X_tr,
[client_labels, server_labels],
batch_size=args.batch_size,
epochs=args.epochs,
shuffle=True)
# TODO: for validation we use future data -> validation_data=(testData,testLabel))
if __name__ == "__main__":
main()