03_malicious_url_detect.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# **Malicious URL Detect**\n",
    "\n",
    "#### malicious-url-detection-with-ML\n",
    "\n",
    "malicious url detection with machine learning"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "import os\n",
    "import json\n",
    "from pathlib import Path\n",
    "import pandas as pd\n",
    "import numpy as np\n",
    "\n",
    "from string import printable\n",
    "from sklearn import model_selection\n",
    "from sklearn.metrics import classification_report\n",
    "\n",
    "from keras.preprocessing import sequence\n",
    "from keras.models import model_from_json"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [],
   "source": [
    "def print_layers_dims(model):\n",
    "    l_layers = model.layers\n",
    "    # Note None is ALWAYS batch_size\n",
    "    for i in range(len(l_layers)):\n",
    "        print(l_layers[i])\n",
    "        print('Input Shape: ', l_layers[i].input_shape,\n",
    "              'Output Shape: ', l_layers[i].output_shape)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [],
   "source": [
    "def save_model(model, fileModelJSON, fileWeights):\n",
    "    # have h5py installed\n",
    "    if Path(fileModelJSON).is_file():\n",
    "        os.remove(fileModelJSON)\n",
    "    json_string = model.to_json()\n",
    "    with open(fileModelJSON, 'w') as f:\n",
    "        json.dump(json_string, f)\n",
    "\n",
    "    if Path(fileWeights).is_file():\n",
    "        os.remove(fileWeights)\n",
    "    model.save_weights(fileWeights)\n",
    "\n",
    "\n",
    "def load_model(fileModelJSON, fileWeights):\n",
    "    with open(fileModelJSON, 'r') as f:\n",
    "        model_json = json.load(f)\n",
    "        model = model_from_json(model_json)\n",
    "\n",
    "    model.load_weights(fileWeights)\n",
    "    return model"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## read data"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [],
   "source": [
    "def read_data():\n",
    "    data_file_path = os.path.join(\"data/malicious_url\", 'url_data.csv')\n",
    "    df = pd.read_csv(data_file_path)\n",
    "\n",
    "    # Step 1: Convert raw URL string in list of lists where characters that are contained in \"printable\" are stored encoded as integer\n",
    "    url_int_tokens = [\n",
    "        [printable.index(x) + 1 for x in url if x in printable] for url in df.url]\n",
    "\n",
    "    # Step 2: Cut URL string at max_len or pad with zeros if shorter\n",
    "    max_len = 75\n",
    "    X = sequence.pad_sequences(url_int_tokens, maxlen=max_len)\n",
    "\n",
    "    # Step 3: Extract labels form df to numpy array\n",
    "    target = np.array(df.isMalicious)\n",
    "\n",
    "    print('Matrix dimensions of X: ', X.shape,\n",
    "          'Vector dimension of target: ', target.shape)\n",
    "\n",
    "    X_train, X_test, target_train, target_test = model_selection.train_test_split(\n",
    "        X, target, test_size=0.25, random_state=33)\n",
    "\n",
    "    return X_train, X_test, target_train, target_test"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Matrix dimensions of X:  (194798, 75) Vector dimension of target:  (194798,)\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "array([[ 0,  0,  0, ..., 32, 24, 21],\n",
       "       [76, 26, 18, ..., 24, 30, 25],\n",
       "       [62, 68, 11, ..., 35, 81, 31],\n",
       "       ...,\n",
       "       [ 0,  0,  0, ..., 24, 15, 22],\n",
       "       [ 0,  0,  0, ...,  4, 77,  3],\n",
       "       [ 0,  0,  0, ..., 36, 19, 30]], dtype=int32)"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "X_train, X_test, target_train, target_test = read_data()\n",
    "X_train"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [],
   "source": [
    "from models.cnn import ConvFully\n",
    "from models.rnn import SimpleLSTM\n",
    "from models.cnn_rnn import ConvLSTM\n",
    "epochs_num = 10\n",
    "batch_size = 32 #8"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## **RNN**"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "model_name = \"simple_lstm\"\n",
    "model = SimpleLSTM().build_model()\n",
    "model.fit(X_train, target_train,\n",
    "            epochs=epochs_num, batch_size=batch_size)\n",
    "loss, accuracy = model.evaluate(X_test, target_test, verbose=1)\n",
    "\n",
    "print('\\nFinal Cross-Validation Accuracy', accuracy, '\\n')\n",
    "\n",
    "# print_layers_dims(model)\n",
    "# save model\n",
    "json_file_path = os.path.join(\"cache/malicious_url\", model_name + \".json\")\n",
    "weight_file_path = os.path.join(\"cache/malicious_url\", model_name + \".h5\")\n",
    "save_model(model, json_file_path, weight_file_path)\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Accuracy Score is:  0.8655441478439425\n",
      "Precision Score is : 0.8579050828418984\n",
      "Recall Score is : 0.8767578205075642\n",
      "F1 Score:  0.8672290036092299\n",
      "AUC Score:  0.8655252346603806\n"
     ]
    }
   ],
   "source": [
    "from utils import eval_utils\n",
    "model_name = \"simple_lstm\"\n",
    "json_file_path = os.path.join(\"cache/malicious_url\", model_name + \".json\")\n",
    "weight_file_path = os.path.join(\"cache/malicious_url\", model_name + \".h5\")\n",
    "model = load_model(json_file_path, weight_file_path)\n",
    "y_pred = model.predict(X_test)\n",
    "# print(y_pred)\n",
    "pred = eval_utils.to_y(y_pred)\n",
    "# print(pred)\n",
    "# print(classification_report(target_test, pred, digits=5))\n",
    "eval_utils.evaluate_result(target_test, pred)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## **CNN**"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "model_name = \"conv_fully\"\n",
    "\n",
    "model = ConvFully().build_model()\n",
    "model.fit(X_train, target_train,\n",
    "            epochs=epochs_num, batch_size=batch_size)\n",
    "loss, accuracy = model.evaluate(X_test, target_test, verbose=1)\n",
    "\n",
    "print('\\nFinal Cross-Validation Accuracy', accuracy, '\\n')\n",
    "\n",
    "pred = model.predict(X_test)\n",
    "print(classification_report(target_test, pred, digits=5))\n",
    "\n",
    "# print_layers_dims(model)\n",
    "# save model\n",
    "json_file_path = os.path.join(\"cache/malicious_url\", model_name + \".json\")\n",
    "weight_file_path = os.path.join(\"cache/malicious_url\", model_name + \".h5\")\n",
    "save_model(model, json_file_path, weight_file_path)\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/Users/kunma/opt/anaconda3/envs/url-analysis/lib/python3.7/site-packages/tensorflow/python/keras/layers/core.py:1059: UserWarning: malicious_url.nn_model is not loaded, but a Lambda layer uses it. It may cause errors.\n",
      "  , UserWarning)\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Accuracy Score is:  0.8379671457905544\n",
      "Precision Score is : 0.8431494883953082\n",
      "Recall Score is : 0.831085236357673\n",
      "F1 Score:  0.8370738958974254\n",
      "AUC Score:  0.8379787529437384\n"
     ]
    }
   ],
   "source": [
    "from utils import eval_utils\n",
    "model_name = \"conv_fully\"\n",
    "json_file_path = os.path.join(\"cache/malicious_url\", model_name + \".json\")\n",
    "weight_file_path = os.path.join(\"cache/malicious_url\", model_name + \".h5\")\n",
    "model = load_model(json_file_path, weight_file_path)\n",
    "y_pred = model.predict(X_test)\n",
    "# print(y_pred)\n",
    "pred = eval_utils.to_y(y_pred)\n",
    "# print(pred)\n",
    "# print(classification_report(target_test, pred, digits=5))\n",
    "eval_utils.evaluate_result(target_test, pred)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## **Conv_LSTM**"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "model_name = \"conv_lstm\"\n",
    "\n",
    "model = ConvLSTM().build_model()\n",
    "model.fit(X_train, target_train,\n",
    "            epochs=epochs_num, batch_size=batch_size)\n",
    "loss, accuracy = model.evaluate(X_test, target_test, verbose=1)\n",
    "\n",
    "print('\\nFinal Cross-Validation Accuracy', accuracy, '\\n')\n",
    "\n",
    "pred = model.predict(X_test)\n",
    "print(classification_report(target_test, pred, digits=5))\n",
    "\n",
    "# print_layers_dims(model)\n",
    "# save model\n",
    "json_file_path = os.path.join(\"cache/malicious_url\", model_name + \".json\")\n",
    "weight_file_path = os.path.join(\"cache/malicious_url\", model_name + \".h5\")\n",
    "save_model(model, json_file_path, weight_file_path)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Accuracy Score is:  0.9242505133470226\n",
      "Precision Score is : 0.9288969917958068\n",
      "Recall Score is : 0.9191095076052642\n",
      "F1 Score:  0.92397733127254\n",
      "AUC Score:  0.9242591842604873\n"
     ]
    }
   ],
   "source": [
    "from utils import eval_utils\n",
    "model_name = \"conv_lstm\"\n",
    "json_file_path = os.path.join(\"cache/malicious_url\", model_name + \".json\")\n",
    "weight_file_path = os.path.join(\"cache/malicious_url\", model_name + \".h5\")\n",
    "model = load_model(json_file_path, weight_file_path)\n",
    "y_pred = model.predict(X_test)\n",
    "# print(y_pred)\n",
    "pred = eval_utils.to_y(y_pred)\n",
    "# print(pred)\n",
    "# print(classification_report(target_test, pred, digits=5))\n",
    "eval_utils.evaluate_result(target_test, pred)"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3.7.6 ('url-analysis')",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.6"
  },
  "orig_nbformat": 4,
  "vscode": {
   "interpreter": {
    "hash": "a6057abd5798a041d5b2e8597a30353311df594746bf26b0b4c3807e7d6a1eaa"
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}