├── LICENSE ├── README.md ├── model_generation ├── ReadMe.md ├── model_representation.py ├── models │ ├── class_flow_phase_2048pkt_1rf_0.dot │ ├── class_flow_phase_256pkt_1rf_0.dot │ ├── class_flow_phase_2pkt_1rf_0.dot │ ├── class_flow_phase_32pkt_1rf_0.dot │ ├── class_flow_phase_4pkt_1rf_0.dot │ ├── class_flow_phase_512pkt_1rf_0.dot │ ├── class_flow_phase_8pkt_1rf_0.dot │ ├── class_pkt_1rf_0.dot │ └── flow_size_predict_1xgb.txt └── tree_to_table │ ├── rf.py │ ├── utils.py │ └── xgb.py └── switch ├── control_plane ├── bin_table_and_class_flow.pkl ├── controller.py └── flow_size_and_class_pkt.pkl └── data_plane ├── headers.p4 ├── parsers.p4 ├── switch.p4 └── util.p4 /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2023 IDP 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # NetBeacon 2 | [An Efficient Design of Intelligent Network Data Plane](https://www.usenix.org/conference/usenixsecurity23/presentation/zhouguangmeng) USENIX Security 2023 3 | 4 | #### model_generation 5 | train and transform models to flow tables 6 | 7 | #### switch 8 | the codes running in switch including control plane and data plane 9 | 10 | 11 | #### Excute 12 | ##### Generate flow table 13 | 1. python model_representation.py 14 | ##### Excute Traffic classification 15 | 1. complie and run p4 code (switch.p4) of data plane, and set switch port 16 | 2. run the code (controller.py ) of control plane 17 | 3. send traffic... 18 | -------------------------------------------------------------------------------- /model_generation/ReadMe.md: -------------------------------------------------------------------------------- 1 | #### models 2 | 3 | trained model, includes models in different phases, per-packet model, long and short flow prediction model. 4 | 5 | RandomForest model trained using scikit-learn(0.24.2) package in python 6 | saved as dot file by 7 | 8 | ``` 9 | from sklearn.ensemble import RandomForestClassifier 10 | from sklearn.tree import export_graphviz 11 | 12 | rfc = RandomForestClassifier(...) 13 | rfc.fit(...) 14 | for i in range(len(rfc.estimators_)): 15 | export_graphviz(rfc.estimators_[i], out_file='rf_tree_{}.dot'.format(i), 16 | feature_names = xx, 17 | class_names = [xx,xx,...], 18 | rounded = True, proportion = False, 19 | precision = 4, filled = True) 20 | ``` 21 | 22 | XGBoost model trained using xgboost(1.6.0) package in python 23 | saved as txt file by 24 | 25 | ``` 26 | from xgboost import XGBClassifier 27 | rfc = XGBClassifier(...) 28 | rfc.fit(...) 29 | rfc.get_booster().dump_model("xxx") 30 | ``` 31 | 32 | #### tree_to_table 33 | transform model to flow table on the data plane 34 | 35 | #### model_representation 36 | transform models under the models folder into flow tables and put them under switch/control_plane 37 | -------------------------------------------------------------------------------- /model_generation/model_representation.py: -------------------------------------------------------------------------------- 1 | from tree_to_table.rf import get_rf_feature_thres,get_rf_trees_table_entries 2 | from tree_to_table.xgb import get_xgb_feature_thres,get_xgb_trees_table_entries 3 | from tree_to_table.utils import * 4 | import os 5 | 6 | current_path = os.getcwd() 7 | dir_path = os.path.abspath(os.path.dirname(os.getcwd())) # 8 | 9 | def get_flow_size_and_class_pkt(): 10 | ## Merge flowsize prediction and packet level classification, range mark of both can be shared 11 | pkt_feat = ['proto','total_len','diffserv', 'ttl', 'tcp_dataOffset', 'tcp_window', 'udp_length'] 12 | pkt_feat_bits = [8,16,8,8,4,16,16] #feature bits 13 | key_bits = {} 14 | for i in range(len(pkt_feat)): 15 | key_bits[pkt_feat[i]] = pkt_feat_bits[i] 16 | 17 | 18 | flow_size_model_file = current_path+'/models/flow_size_predict_1xgb.txt' #flowsize prediction 19 | class_pkt_model_file = current_path+'/models/class_pkt_1rf' #packet level classification 20 | 21 | feat_dict_flow_size = get_xgb_feature_thres(flow_size_model_file,pkt_feat) 22 | 23 | class_pkt_tree_num = 1 24 | feat_dict_class_pkt = get_rf_feature_thres(class_pkt_model_file,pkt_feat,class_pkt_tree_num) 25 | 26 | feat_dict = {} 27 | for key in pkt_feat: 28 | feat_dict[key] = list(set(feat_dict_flow_size[key]) | set(feat_dict_class_pkt[key])) 29 | feat_dict[key].sort() 30 | print(key,len(feat_dict_flow_size[key]),feat_dict_flow_size[key]) 31 | print(key,len(feat_dict_class_pkt[key]),feat_dict_class_pkt[key]) 32 | print("--",key,len(feat_dict[key]),feat_dict[key]) 33 | 34 | 35 | pkt_feat_mark_bit = [8,144,24,64,8,48,72] #range mark bits, take the maximum value of the number of thresholds in each model, respectively 36 | range_mark_bits = {} 37 | for i in range(len(pkt_feat)): 38 | range_mark_bits[pkt_feat[i]] = pkt_feat_mark_bit[i] 39 | 40 | feat_table_datas = get_feature_table_entries(feat_dict,key_bits,range_mark_bits) 41 | sum_e = 0 42 | for key in feat_table_datas.keys(): 43 | sum_e+=len(feat_table_datas[key]) 44 | print("feature table entries: ",sum_e) 45 | 46 | tree_data_flow_size = get_xgb_trees_table_entries(flow_size_model_file,pkt_feat,feat_dict,range_mark_bits) 47 | print("flow size tree table entries: ",len(tree_data_flow_size)) 48 | 49 | tree_data_class_pkt = get_rf_trees_table_entries(class_pkt_model_file,pkt_feat,feat_dict,range_mark_bits,class_pkt_tree_num) 50 | print("class pkt tree table entries: ",len(tree_data_class_pkt)) 51 | 52 | with open(dir_path+'/switch/control_plane/flow_size_and_class_pkt.pkl','wb') as f: 53 | pickle.dump([feat_table_datas,tree_data_flow_size, tree_data_class_pkt],f,protocol=2) 54 | 55 | 56 | def get_class_flow(): 57 | ## multi-phase classification 58 | pkt_flow_feat = ['pkt_size_max','flow_iat_min','bin_5','bin_3','pkt_size_var_approx','pkt_size_avg','pkt_size_min'] 59 | # maximum packet size, minimum packet ipd, packet number whose size in [80, 96), packet number whose size in [48, 64), 60 | # the variance of packet size, the mean of packet size , minimum packet size 61 | pkt_flow_feat_bit = [16,32,8,16,32,32,16] #feature bits 62 | 63 | #convert the aggregate feature 64 | bin_table = get_bin_table(pkt_flow_feat,16) #16 is the packet size bits 65 | 66 | class_flow_model_files = [ 67 | current_path + '/models/class_flow_phase_2pkt_1rf', 68 | current_path + '/models/class_flow_phase_4pkt_1rf', 69 | current_path + '/models/class_flow_phase_8pkt_1rf', 70 | current_path + '/models/class_flow_phase_32pkt_1rf', 71 | current_path + '/models/class_flow_phase_256pkt_1rf', 72 | current_path + '/models/class_flow_phase_512pkt_1rf', 73 | current_path + '/models/class_flow_phase_2048pkt_1rf',] 74 | class_flow_tree_nums = [1,1,1,1,1,1,1] 75 | 76 | max_feat_thres={} 77 | for i in range(len(pkt_flow_feat)): 78 | max_feat_thres[pkt_flow_feat[i]]=0 79 | count=0 80 | feat_dicts = [] 81 | for model_file in class_flow_model_files: 82 | tree_num = class_flow_tree_nums[count] 83 | feat_dict = get_rf_feature_thres(model_file,pkt_flow_feat,tree_num) 84 | for key in feat_dict.keys(): 85 | print(key,len(feat_dict[key]),feat_dict[key]) 86 | if max_feat_thres[key] 1 [labeldistance=2.5, labelangle=45, headlabel="True"] ; 7 | 2 [label="pkt_size_var_approx <= 58158.5\ngini = 0.049\nsamples = 524\nvalue = [21, 0, 815]\nclass = 2", fillcolor="#843ee6"] ; 8 | 1 -> 2 ; 9 | 3 [label="pkt_size_min <= 74.5\ngini = 0.0027\nsamples = 465\nvalue = [1, 0, 736]\nclass = 2", fillcolor="#8139e5"] ; 10 | 2 -> 3 ; 11 | 4 [label="gini = 0.0\nsamples = 464\nvalue = [0, 0, 736]\nclass = 2", fillcolor="#8139e5"] ; 12 | 3 -> 4 ; 13 | 5 [label="gini = 0.0\nsamples = 1\nvalue = [1, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 14 | 3 -> 5 ; 15 | 6 [label="pkt_size_min <= 48.0\ngini = 0.3224\nsamples = 59\nvalue = [20, 0, 79]\nclass = 2", fillcolor="#a16bec"] ; 16 | 2 -> 6 ; 17 | 7 [label="bin_3 <= 61.5\ngini = 0.2268\nsamples = 14\nvalue = [20, 0, 3]\nclass = 0", fillcolor="#e99457"] ; 18 | 6 -> 7 ; 19 | 8 [label="gini = 0.0\nsamples = 12\nvalue = [20, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 20 | 7 -> 8 ; 21 | 9 [label="gini = 0.0\nsamples = 2\nvalue = [0, 0, 3]\nclass = 2", fillcolor="#8139e5"] ; 22 | 7 -> 9 ; 23 | 10 [label="gini = 0.0\nsamples = 45\nvalue = [0, 0, 76]\nclass = 2", fillcolor="#8139e5"] ; 24 | 6 -> 10 ; 25 | 11 [label="pkt_size_var_approx <= 41928.5\ngini = 0.1755\nsamples = 590\nvalue = [27, 859, 63]\nclass = 1", fillcolor="#4de88e"] ; 26 | 1 -> 11 ; 27 | 12 [label="flow_iat_min <= 49.5\ngini = 0.0078\nsamples = 470\nvalue = [0, 764, 3]\nclass = 1", fillcolor="#3ae581"] ; 28 | 11 -> 12 ; 29 | 13 [label="gini = 0.0\nsamples = 469\nvalue = [0, 764, 0]\nclass = 1", fillcolor="#39e581"] ; 30 | 12 -> 13 ; 31 | 14 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 3]\nclass = 2", fillcolor="#8139e5"] ; 32 | 12 -> 14 ; 33 | 15 [label="bin_5 <= 3.5\ngini = 0.5968\nsamples = 120\nvalue = [27, 95, 60]\nclass = 1", fillcolor="#c6f8db"] ; 34 | 11 -> 15 ; 35 | 16 [label="pkt_size_var_approx <= 77611.5\ngini = 0.6312\nsamples = 32\nvalue = [17, 8, 19]\nclass = 2", fillcolor="#f6f0fd"] ; 36 | 15 -> 16 ; 37 | 17 [label="pkt_size_avg <= 362.5\ngini = 0.5536\nsamples = 18\nvalue = [17, 5, 6]\nclass = 0", fillcolor="#f2c09c"] ; 38 | 16 -> 17 ; 39 | 18 [label="bin_3 <= 552.5\ngini = 0.6605\nsamples = 13\nvalue = [7, 5, 6]\nclass = 0", fillcolor="#fdf4ee"] ; 40 | 17 -> 18 ; 41 | 19 [label="pkt_size_max <= 2216.0\ngini = 0.4898\nsamples = 6\nvalue = [0, 4, 3]\nclass = 1", fillcolor="#cef8e0"] ; 42 | 18 -> 19 ; 43 | 20 [label="bin_5 <= 1.5\ngini = 0.32\nsamples = 5\nvalue = [0, 4, 1]\nclass = 1", fillcolor="#6aeca0"] ; 44 | 19 -> 20 ; 45 | 21 [label="gini = 0.5\nsamples = 2\nvalue = [0, 1, 1]\nclass = 1", fillcolor="#ffffff"] ; 46 | 20 -> 21 ; 47 | 22 [label="gini = 0.0\nsamples = 3\nvalue = [0, 3, 0]\nclass = 1", fillcolor="#39e581"] ; 48 | 20 -> 22 ; 49 | 23 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 2]\nclass = 2", fillcolor="#8139e5"] ; 50 | 19 -> 23 ; 51 | 24 [label="pkt_size_var_approx <= 68056.5\ngini = 0.5124\nsamples = 7\nvalue = [7, 1, 3]\nclass = 0", fillcolor="#f2c09c"] ; 52 | 18 -> 24 ; 53 | 25 [label="bin_3 <= 630.0\ngini = 0.3457\nsamples = 5\nvalue = [7, 0, 2]\nclass = 0", fillcolor="#eca572"] ; 54 | 24 -> 25 ; 55 | 26 [label="gini = 0.0\nsamples = 3\nvalue = [6, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 56 | 25 -> 26 ; 57 | 27 [label="gini = 0.4444\nsamples = 2\nvalue = [1, 0, 2]\nclass = 2", fillcolor="#c09cf2"] ; 58 | 25 -> 27 ; 59 | 28 [label="bin_3 <= 706.5\ngini = 0.5\nsamples = 2\nvalue = [0, 1, 1]\nclass = 1", fillcolor="#ffffff"] ; 60 | 24 -> 28 ; 61 | 29 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 1]\nclass = 2", fillcolor="#8139e5"] ; 62 | 28 -> 29 ; 63 | 30 [label="gini = 0.0\nsamples = 1\nvalue = [0, 1, 0]\nclass = 1", fillcolor="#39e581"] ; 64 | 28 -> 30 ; 65 | 31 [label="gini = 0.0\nsamples = 5\nvalue = [10, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 66 | 17 -> 31 ; 67 | 32 [label="pkt_size_var_approx <= 90520.0\ngini = 0.3047\nsamples = 14\nvalue = [0, 3, 13]\nclass = 2", fillcolor="#9e67eb"] ; 68 | 16 -> 32 ; 69 | 33 [label="gini = 0.0\nsamples = 6\nvalue = [0, 0, 7]\nclass = 2", fillcolor="#8139e5"] ; 70 | 32 -> 33 ; 71 | 34 [label="flow_iat_min <= 10.5\ngini = 0.4444\nsamples = 8\nvalue = [0, 3, 6]\nclass = 2", fillcolor="#c09cf2"] ; 72 | 32 -> 34 ; 73 | 35 [label="pkt_size_avg <= 328.0\ngini = 0.375\nsamples = 3\nvalue = [0, 3, 1]\nclass = 1", fillcolor="#7beeab"] ; 74 | 34 -> 35 ; 75 | 36 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 1]\nclass = 2", fillcolor="#8139e5"] ; 76 | 35 -> 36 ; 77 | 37 [label="gini = 0.0\nsamples = 2\nvalue = [0, 3, 0]\nclass = 1", fillcolor="#39e581"] ; 78 | 35 -> 37 ; 79 | 38 [label="gini = 0.0\nsamples = 5\nvalue = [0, 0, 5]\nclass = 2", fillcolor="#8139e5"] ; 80 | 34 -> 38 ; 81 | 39 [label="bin_3 <= 441.5\ngini = 0.509\nsamples = 88\nvalue = [10, 87, 41]\nclass = 1", fillcolor="#a1f3c3"] ; 82 | 15 -> 39 ; 83 | 40 [label="pkt_size_avg <= 337.5\ngini = 0.655\nsamples = 27\nvalue = [10, 14, 16]\nclass = 2", fillcolor="#f5f0fd"] ; 84 | 39 -> 40 ; 85 | 41 [label="pkt_size_max <= 488.5\ngini = 0.3457\nsamples = 4\nvalue = [7, 2, 0]\nclass = 0", fillcolor="#eca572"] ; 86 | 40 -> 41 ; 87 | 42 [label="gini = 0.0\nsamples = 1\nvalue = [0, 2, 0]\nclass = 1", fillcolor="#39e581"] ; 88 | 41 -> 42 ; 89 | 43 [label="gini = 0.0\nsamples = 3\nvalue = [7, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 90 | 41 -> 43 ; 91 | 44 [label="pkt_size_avg <= 355.5\ngini = 0.5744\nsamples = 23\nvalue = [3, 12, 16]\nclass = 2", fillcolor="#e4d5fa"] ; 92 | 40 -> 44 ; 93 | 45 [label="pkt_size_avg <= 341.0\ngini = 0.3047\nsamples = 11\nvalue = [0, 3, 13]\nclass = 2", fillcolor="#9e67eb"] ; 94 | 44 -> 45 ; 95 | 46 [label="flow_iat_min <= 9.5\ngini = 0.4444\nsamples = 2\nvalue = [0, 2, 1]\nclass = 1", fillcolor="#9cf2c0"] ; 96 | 45 -> 46 ; 97 | 47 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 1]\nclass = 2", fillcolor="#8139e5"] ; 98 | 46 -> 47 ; 99 | 48 [label="gini = 0.0\nsamples = 1\nvalue = [0, 2, 0]\nclass = 1", fillcolor="#39e581"] ; 100 | 46 -> 48 ; 101 | 49 [label="pkt_size_var_approx <= 69314.0\ngini = 0.142\nsamples = 9\nvalue = [0, 1, 12]\nclass = 2", fillcolor="#8c49e7"] ; 102 | 45 -> 49 ; 103 | 50 [label="gini = 0.4444\nsamples = 3\nvalue = [0, 1, 2]\nclass = 2", fillcolor="#c09cf2"] ; 104 | 49 -> 50 ; 105 | 51 [label="gini = 0.0\nsamples = 6\nvalue = [0, 0, 10]\nclass = 2", fillcolor="#8139e5"] ; 106 | 49 -> 51 ; 107 | 52 [label="pkt_size_max <= 1480.0\ngini = 0.56\nsamples = 12\nvalue = [3, 9, 3]\nclass = 1", fillcolor="#9cf2c0"] ; 108 | 44 -> 52 ; 109 | 53 [label="pkt_size_var_approx <= 72441.5\ngini = 0.6111\nsamples = 6\nvalue = [3, 1, 2]\nclass = 0", fillcolor="#f8e0ce"] ; 110 | 52 -> 53 ; 111 | 54 [label="gini = 0.0\nsamples = 3\nvalue = [3, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 112 | 53 -> 54 ; 113 | 55 [label="gini = 0.4444\nsamples = 3\nvalue = [0, 1, 2]\nclass = 2", fillcolor="#c09cf2"] ; 114 | 53 -> 55 ; 115 | 56 [label="bin_5 <= 8.5\ngini = 0.1975\nsamples = 6\nvalue = [0, 8, 1]\nclass = 1", fillcolor="#52e891"] ; 116 | 52 -> 56 ; 117 | 57 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 1]\nclass = 2", fillcolor="#8139e5"] ; 118 | 56 -> 57 ; 119 | 58 [label="gini = 0.0\nsamples = 5\nvalue = [0, 8, 0]\nclass = 1", fillcolor="#39e581"] ; 120 | 56 -> 58 ; 121 | 59 [label="pkt_size_max <= 5708.0\ngini = 0.38\nsamples = 61\nvalue = [0, 73, 25]\nclass = 1", fillcolor="#7deeac"] ; 122 | 39 -> 59 ; 123 | 60 [label="bin_3 <= 612.0\ngini = 0.2778\nsamples = 53\nvalue = [0, 70, 14]\nclass = 1", fillcolor="#61ea9a"] ; 124 | 59 -> 60 ; 125 | 61 [label="bin_5 <= 11.5\ngini = 0.1952\nsamples = 43\nvalue = [0, 65, 8]\nclass = 1", fillcolor="#51e891"] ; 126 | 60 -> 61 ; 127 | 62 [label="pkt_size_avg <= 365.5\ngini = 0.3628\nsamples = 13\nvalue = [0, 16, 5]\nclass = 1", fillcolor="#77eda8"] ; 128 | 61 -> 62 ; 129 | 63 [label="gini = 0.32\nsamples = 12\nvalue = [0, 16, 4]\nclass = 1", fillcolor="#6aeca0"] ; 130 | 62 -> 63 ; 131 | 64 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 1]\nclass = 2", fillcolor="#8139e5"] ; 132 | 62 -> 64 ; 133 | 65 [label="bin_5 <= 23.5\ngini = 0.1087\nsamples = 30\nvalue = [0, 49, 3]\nclass = 1", fillcolor="#45e789"] ; 134 | 61 -> 65 ; 135 | 66 [label="gini = 0.0\nsamples = 19\nvalue = [0, 33, 0]\nclass = 1", fillcolor="#39e581"] ; 136 | 65 -> 66 ; 137 | 67 [label="gini = 0.2659\nsamples = 11\nvalue = [0, 16, 3]\nclass = 1", fillcolor="#5eea99"] ; 138 | 65 -> 67 ; 139 | 68 [label="bin_5 <= 9.5\ngini = 0.4959\nsamples = 10\nvalue = [0, 5, 6]\nclass = 2", fillcolor="#eadefb"] ; 140 | 60 -> 68 ; 141 | 69 [label="flow_iat_min <= 12.5\ngini = 0.32\nsamples = 5\nvalue = [0, 4, 1]\nclass = 1", fillcolor="#6aeca0"] ; 142 | 68 -> 69 ; 143 | 70 [label="gini = 0.0\nsamples = 4\nvalue = [0, 4, 0]\nclass = 1", fillcolor="#39e581"] ; 144 | 69 -> 70 ; 145 | 71 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 1]\nclass = 2", fillcolor="#8139e5"] ; 146 | 69 -> 71 ; 147 | 72 [label="pkt_size_var_approx <= 79784.5\ngini = 0.2778\nsamples = 5\nvalue = [0, 1, 5]\nclass = 2", fillcolor="#9a61ea"] ; 148 | 68 -> 72 ; 149 | 73 [label="gini = 0.4444\nsamples = 3\nvalue = [0, 1, 2]\nclass = 2", fillcolor="#c09cf2"] ; 150 | 72 -> 73 ; 151 | 74 [label="gini = 0.0\nsamples = 2\nvalue = [0, 0, 3]\nclass = 2", fillcolor="#8139e5"] ; 152 | 72 -> 74 ; 153 | 75 [label="flow_iat_min <= 14.0\ngini = 0.3367\nsamples = 8\nvalue = [0, 3, 11]\nclass = 2", fillcolor="#a36fec"] ; 154 | 59 -> 75 ; 155 | 76 [label="bin_5 <= 15.0\ngini = 0.1528\nsamples = 7\nvalue = [0, 1, 11]\nclass = 2", fillcolor="#8c4be7"] ; 156 | 75 -> 76 ; 157 | 77 [label="pkt_size_var_approx <= 143268.5\ngini = 0.32\nsamples = 4\nvalue = [0, 1, 4]\nclass = 2", fillcolor="#a06aec"] ; 158 | 76 -> 77 ; 159 | 78 [label="gini = 0.0\nsamples = 3\nvalue = [0, 0, 4]\nclass = 2", fillcolor="#8139e5"] ; 160 | 77 -> 78 ; 161 | 79 [label="gini = 0.0\nsamples = 1\nvalue = [0, 1, 0]\nclass = 1", fillcolor="#39e581"] ; 162 | 77 -> 79 ; 163 | 80 [label="gini = 0.0\nsamples = 3\nvalue = [0, 0, 7]\nclass = 2", fillcolor="#8139e5"] ; 164 | 76 -> 80 ; 165 | 81 [label="gini = 0.0\nsamples = 1\nvalue = [0, 2, 0]\nclass = 1", fillcolor="#39e581"] ; 166 | 75 -> 81 ; 167 | 82 [label="pkt_size_max <= 2964.0\ngini = 0.4852\nsamples = 2417\nvalue = [2599, 507, 718]\nclass = 0", fillcolor="#efb387"] ; 168 | 0 -> 82 [labeldistance=2.5, labelangle=-45, headlabel="False"] ; 169 | 83 [label="pkt_size_min <= 44.0\ngini = 0.2222\nsamples = 1850\nvalue = [2590, 183, 178]\nclass = 0", fillcolor="#e89153"] ; 170 | 82 -> 83 ; 171 | 84 [label="pkt_size_var_approx <= 550632.5\ngini = 0.1401\nsamples = 1604\nvalue = [2353, 65, 124]\nclass = 0", fillcolor="#e78b48"] ; 172 | 83 -> 84 ; 173 | 85 [label="bin_5 <= 3.5\ngini = 0.4652\nsamples = 384\nvalue = [432, 65, 124]\nclass = 0", fillcolor="#efb184"] ; 174 | 84 -> 85 ; 175 | 86 [label="pkt_size_avg <= 953.5\ngini = 0.4203\nsamples = 92\nvalue = [3, 41, 109]\nclass = 2", fillcolor="#b287ef"] ; 176 | 85 -> 86 ; 177 | 87 [label="pkt_size_avg <= 477.5\ngini = 0.2827\nsamples = 75\nvalue = [3, 18, 106]\nclass = 2", fillcolor="#995fea"] ; 178 | 86 -> 87 ; 179 | 88 [label="bin_3 <= 153.5\ngini = 0.4444\nsamples = 4\nvalue = [2, 4, 0]\nclass = 1", fillcolor="#9cf2c0"] ; 180 | 87 -> 88 ; 181 | 89 [label="gini = 0.0\nsamples = 2\nvalue = [2, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 182 | 88 -> 89 ; 183 | 90 [label="gini = 0.0\nsamples = 2\nvalue = [0, 4, 0]\nclass = 1", fillcolor="#39e581"] ; 184 | 88 -> 90 ; 185 | 91 [label="bin_5 <= 0.5\ngini = 0.2191\nsamples = 71\nvalue = [1, 14, 106]\nclass = 2", fillcolor="#9355e9"] ; 186 | 87 -> 91 ; 187 | 92 [label="gini = 0.0\nsamples = 39\nvalue = [0, 0, 71]\nclass = 2", fillcolor="#8139e5"] ; 188 | 91 -> 92 ; 189 | 93 [label="flow_iat_min <= 27.5\ngini = 0.4312\nsamples = 32\nvalue = [1, 14, 35]\nclass = 2", fillcolor="#b68cf0"] ; 190 | 91 -> 93 ; 191 | 94 [label="gini = 0.5216\nsamples = 24\nvalue = [1, 14, 18]\nclass = 2", fillcolor="#e4d5fa"] ; 192 | 93 -> 94 ; 193 | 95 [label="gini = 0.0\nsamples = 8\nvalue = [0, 0, 17]\nclass = 2", fillcolor="#8139e5"] ; 194 | 93 -> 95 ; 195 | 96 [label="pkt_size_var_approx <= 444064.5\ngini = 0.2041\nsamples = 17\nvalue = [0, 23, 3]\nclass = 1", fillcolor="#53e891"] ; 196 | 86 -> 96 ; 197 | 97 [label="pkt_size_max <= 1672.5\ngini = 0.0799\nsamples = 16\nvalue = [0, 23, 1]\nclass = 1", fillcolor="#42e686"] ; 198 | 96 -> 97 ; 199 | 98 [label="flow_iat_min <= 21.5\ngini = 0.4444\nsamples = 3\nvalue = [0, 2, 1]\nclass = 1", fillcolor="#9cf2c0"] ; 200 | 97 -> 98 ; 201 | 99 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 1]\nclass = 2", fillcolor="#8139e5"] ; 202 | 98 -> 99 ; 203 | 100 [label="gini = 0.0\nsamples = 2\nvalue = [0, 2, 0]\nclass = 1", fillcolor="#39e581"] ; 204 | 98 -> 100 ; 205 | 101 [label="gini = 0.0\nsamples = 13\nvalue = [0, 21, 0]\nclass = 1", fillcolor="#39e581"] ; 206 | 97 -> 101 ; 207 | 102 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 2]\nclass = 2", fillcolor="#8139e5"] ; 208 | 96 -> 102 ; 209 | 103 [label="pkt_size_avg <= 735.0\ngini = 0.1561\nsamples = 292\nvalue = [429, 24, 15]\nclass = 0", fillcolor="#e78c4a"] ; 210 | 85 -> 103 ; 211 | 104 [label="bin_5 <= 14.5\ngini = 0.4938\nsamples = 50\nvalue = [48, 16, 8]\nclass = 0", fillcolor="#f0b78e"] ; 212 | 103 -> 104 ; 213 | 105 [label="pkt_size_avg <= 699.0\ngini = 0.277\nsamples = 41\nvalue = [48, 6, 3]\nclass = 0", fillcolor="#ea975c"] ; 214 | 104 -> 105 ; 215 | 106 [label="bin_3 <= 379.0\ngini = 0.1166\nsamples = 36\nvalue = [46, 1, 2]\nclass = 0", fillcolor="#e78946"] ; 216 | 105 -> 106 ; 217 | 107 [label="gini = 0.0416\nsamples = 34\nvalue = [46, 0, 1]\nclass = 0", fillcolor="#e6843d"] ; 218 | 106 -> 107 ; 219 | 108 [label="gini = 0.5\nsamples = 2\nvalue = [0, 1, 1]\nclass = 1", fillcolor="#ffffff"] ; 220 | 106 -> 108 ; 221 | 109 [label="bin_3 <= 137.0\ngini = 0.5312\nsamples = 5\nvalue = [2, 5, 1]\nclass = 1", fillcolor="#9cf2c0"] ; 222 | 105 -> 109 ; 223 | 110 [label="gini = 0.0\nsamples = 1\nvalue = [1, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 224 | 109 -> 110 ; 225 | 111 [label="gini = 0.449\nsamples = 4\nvalue = [1, 5, 1]\nclass = 1", fillcolor="#7beeab"] ; 226 | 109 -> 111 ; 227 | 112 [label="flow_iat_min <= 15.5\ngini = 0.4444\nsamples = 9\nvalue = [0, 10, 5]\nclass = 1", fillcolor="#9cf2c0"] ; 228 | 104 -> 112 ; 229 | 113 [label="pkt_size_avg <= 605.0\ngini = 0.1975\nsamples = 6\nvalue = [0, 8, 1]\nclass = 1", fillcolor="#52e891"] ; 230 | 112 -> 113 ; 231 | 114 [label="gini = 0.4444\nsamples = 2\nvalue = [0, 2, 1]\nclass = 1", fillcolor="#9cf2c0"] ; 232 | 113 -> 114 ; 233 | 115 [label="gini = 0.0\nsamples = 4\nvalue = [0, 6, 0]\nclass = 1", fillcolor="#39e581"] ; 234 | 113 -> 115 ; 235 | 116 [label="pkt_size_avg <= 560.5\ngini = 0.4444\nsamples = 3\nvalue = [0, 2, 4]\nclass = 2", fillcolor="#c09cf2"] ; 236 | 112 -> 116 ; 237 | 117 [label="gini = 0.4444\nsamples = 2\nvalue = [0, 2, 1]\nclass = 1", fillcolor="#9cf2c0"] ; 238 | 116 -> 117 ; 239 | 118 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 3]\nclass = 2", fillcolor="#8139e5"] ; 240 | 116 -> 118 ; 241 | 119 [label="bin_5 <= 6.5\ngini = 0.0736\nsamples = 242\nvalue = [381, 8, 7]\nclass = 0", fillcolor="#e68641"] ; 242 | 103 -> 119 ; 243 | 120 [label="pkt_size_var_approx <= 452753.5\ngini = 0.602\nsamples = 9\nvalue = [2, 7, 5]\nclass = 1", fillcolor="#d3f9e3"] ; 244 | 119 -> 120 ; 245 | 121 [label="pkt_size_var_approx <= 416451.0\ngini = 0.5926\nsamples = 6\nvalue = [2, 2, 5]\nclass = 2", fillcolor="#c9aaf4"] ; 246 | 120 -> 121 ; 247 | 122 [label="gini = 0.4444\nsamples = 2\nvalue = [2, 1, 0]\nclass = 0", fillcolor="#f2c09c"] ; 248 | 121 -> 122 ; 249 | 123 [label="gini = 0.2778\nsamples = 4\nvalue = [0, 1, 5]\nclass = 2", fillcolor="#9a61ea"] ; 250 | 121 -> 123 ; 251 | 124 [label="gini = 0.0\nsamples = 3\nvalue = [0, 5, 0]\nclass = 1", fillcolor="#39e581"] ; 252 | 120 -> 124 ; 253 | 125 [label="bin_3 <= 314.0\ngini = 0.0156\nsamples = 233\nvalue = [379, 1, 2]\nclass = 0", fillcolor="#e5823b"] ; 254 | 119 -> 125 ; 255 | 126 [label="pkt_size_avg <= 906.0\ngini = 0.0056\nsamples = 220\nvalue = [356, 0, 1]\nclass = 0", fillcolor="#e5813a"] ; 256 | 125 -> 126 ; 257 | 127 [label="gini = 0.0\nsamples = 213\nvalue = [348, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 258 | 126 -> 127 ; 259 | 128 [label="gini = 0.1975\nsamples = 7\nvalue = [8, 0, 1]\nclass = 0", fillcolor="#e89152"] ; 260 | 126 -> 128 ; 261 | 129 [label="bin_5 <= 15.5\ngini = 0.1504\nsamples = 13\nvalue = [23, 1, 1]\nclass = 0", fillcolor="#e78c49"] ; 262 | 125 -> 129 ; 263 | 130 [label="gini = 0.0\nsamples = 11\nvalue = [23, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 264 | 129 -> 130 ; 265 | 131 [label="gini = 0.5\nsamples = 2\nvalue = [0, 1, 1]\nclass = 1", fillcolor="#ffffff"] ; 266 | 129 -> 131 ; 267 | 132 [label="gini = 0.0\nsamples = 1220\nvalue = [1921, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 268 | 84 -> 132 ; 269 | 133 [label="pkt_size_min <= 50.0\ngini = 0.5636\nsamples = 246\nvalue = [237, 118, 54]\nclass = 0", fillcolor="#f4cbae"] ; 270 | 83 -> 133 ; 271 | 134 [label="gini = 0.0\nsamples = 55\nvalue = [0, 89, 0]\nclass = 1", fillcolor="#39e581"] ; 272 | 133 -> 134 ; 273 | 135 [label="bin_5 <= 14.0\ngini = 0.4148\nsamples = 191\nvalue = [237, 29, 54]\nclass = 0", fillcolor="#eda877"] ; 274 | 133 -> 135 ; 275 | 136 [label="pkt_size_var_approx <= 364349.0\ngini = 0.3608\nsamples = 179\nvalue = [237, 20, 46]\nclass = 0", fillcolor="#eca16c"] ; 276 | 135 -> 136 ; 277 | 137 [label="pkt_size_var_approx <= 77998.5\ngini = 0.1316\nsamples = 81\nvalue = [134, 6, 4]\nclass = 0", fillcolor="#e78a47"] ; 278 | 136 -> 137 ; 279 | 138 [label="pkt_size_avg <= 402.5\ngini = 0.2188\nsamples = 13\nvalue = [21, 3, 0]\nclass = 0", fillcolor="#e99355"] ; 280 | 137 -> 138 ; 281 | 139 [label="pkt_size_var_approx <= 64868.0\ngini = 0.0868\nsamples = 12\nvalue = [21, 1, 0]\nclass = 0", fillcolor="#e68742"] ; 282 | 138 -> 139 ; 283 | 140 [label="gini = 0.1975\nsamples = 5\nvalue = [8, 1, 0]\nclass = 0", fillcolor="#e89152"] ; 284 | 139 -> 140 ; 285 | 141 [label="gini = 0.0\nsamples = 7\nvalue = [13, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 286 | 139 -> 141 ; 287 | 142 [label="gini = 0.0\nsamples = 1\nvalue = [0, 2, 0]\nclass = 1", fillcolor="#39e581"] ; 288 | 138 -> 142 ; 289 | 143 [label="bin_3 <= 890.5\ngini = 0.1115\nsamples = 68\nvalue = [113, 3, 4]\nclass = 0", fillcolor="#e78945"] ; 290 | 137 -> 143 ; 291 | 144 [label="pkt_size_avg <= 905.0\ngini = 0.0665\nsamples = 66\nvalue = [113, 3, 1]\nclass = 0", fillcolor="#e68540"] ; 292 | 143 -> 144 ; 293 | 145 [label="gini = 0.0342\nsamples = 64\nvalue = [113, 2, 0]\nclass = 0", fillcolor="#e5833d"] ; 294 | 144 -> 145 ; 295 | 146 [label="gini = 0.5\nsamples = 2\nvalue = [0, 1, 1]\nclass = 1", fillcolor="#ffffff"] ; 296 | 144 -> 146 ; 297 | 147 [label="gini = 0.0\nsamples = 2\nvalue = [0, 0, 3]\nclass = 2", fillcolor="#8139e5"] ; 298 | 143 -> 147 ; 299 | 148 [label="pkt_size_max <= 2600.0\ngini = 0.5028\nsamples = 98\nvalue = [103, 14, 42]\nclass = 0", fillcolor="#f1bd98"] ; 300 | 136 -> 148 ; 301 | 149 [label="pkt_size_avg <= 897.5\ngini = 0.5712\nsamples = 32\nvalue = [19, 6, 30]\nclass = 2", fillcolor="#d8c2f7"] ; 302 | 148 -> 149 ; 303 | 150 [label="pkt_size_var_approx <= 419972.5\ngini = 0.6101\nsamples = 23\nvalue = [19, 6, 14]\nclass = 0", fillcolor="#fae6d7"] ; 304 | 149 -> 150 ; 305 | 151 [label="gini = 0.4938\nsamples = 16\nvalue = [18, 6, 3]\nclass = 0", fillcolor="#f0b78e"] ; 306 | 150 -> 151 ; 307 | 152 [label="gini = 0.1528\nsamples = 7\nvalue = [1, 0, 11]\nclass = 2", fillcolor="#8c4be7"] ; 308 | 150 -> 152 ; 309 | 153 [label="gini = 0.0\nsamples = 9\nvalue = [0, 0, 16]\nclass = 2", fillcolor="#8139e5"] ; 310 | 149 -> 153 ; 311 | 154 [label="pkt_size_avg <= 960.5\ngini = 0.3284\nsamples = 66\nvalue = [84, 8, 12]\nclass = 0", fillcolor="#eb9c64"] ; 312 | 148 -> 154 ; 313 | 155 [label="pkt_size_var_approx <= 460235.5\ngini = 0.5506\nsamples = 29\nvalue = [31, 8, 12]\nclass = 0", fillcolor="#f2c29f"] ; 314 | 154 -> 155 ; 315 | 156 [label="gini = 0.6475\nsamples = 15\nvalue = [7, 8, 12]\nclass = 2", fillcolor="#e4d5fa"] ; 316 | 155 -> 156 ; 317 | 157 [label="gini = 0.0\nsamples = 14\nvalue = [24, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 318 | 155 -> 157 ; 319 | 158 [label="gini = 0.0\nsamples = 37\nvalue = [53, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 320 | 154 -> 158 ; 321 | 159 [label="bin_3 <= 435.0\ngini = 0.4983\nsamples = 12\nvalue = [0, 9, 8]\nclass = 1", fillcolor="#e9fcf1"] ; 322 | 135 -> 159 ; 323 | 160 [label="gini = 0.0\nsamples = 5\nvalue = [0, 0, 6]\nclass = 2", fillcolor="#8139e5"] ; 324 | 159 -> 160 ; 325 | 161 [label="bin_3 <= 645.5\ngini = 0.2975\nsamples = 7\nvalue = [0, 9, 2]\nclass = 1", fillcolor="#65eb9d"] ; 326 | 159 -> 161 ; 327 | 162 [label="gini = 0.0\nsamples = 5\nvalue = [0, 8, 0]\nclass = 1", fillcolor="#39e581"] ; 328 | 161 -> 162 ; 329 | 163 [label="bin_3 <= 674.5\ngini = 0.4444\nsamples = 2\nvalue = [0, 1, 2]\nclass = 2", fillcolor="#c09cf2"] ; 330 | 161 -> 163 ; 331 | 164 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 2]\nclass = 2", fillcolor="#8139e5"] ; 332 | 163 -> 164 ; 333 | 165 [label="gini = 0.0\nsamples = 1\nvalue = [0, 1, 0]\nclass = 1", fillcolor="#39e581"] ; 334 | 163 -> 165 ; 335 | 166 [label="pkt_size_max <= 7544.5\ngini = 0.4795\nsamples = 567\nvalue = [9, 324, 540]\nclass = 2", fillcolor="#cdb1f5"] ; 336 | 82 -> 166 ; 337 | 167 [label="pkt_size_var_approx <= 1404258.5\ngini = 0.5151\nsamples = 342\nvalue = [9, 276, 248]\nclass = 1", fillcolor="#ecfcf3"] ; 338 | 166 -> 167 ; 339 | 168 [label="bin_5 <= 3.5\ngini = 0.4935\nsamples = 182\nvalue = [9, 187, 107]\nclass = 1", fillcolor="#aef4cc"] ; 340 | 167 -> 168 ; 341 | 169 [label="flow_iat_min <= 9.5\ngini = 0.5122\nsamples = 65\nvalue = [6, 40, 71]\nclass = 2", fillcolor="#ccaff5"] ; 342 | 168 -> 169 ; 343 | 170 [label="pkt_size_var_approx <= 549547.5\ngini = 0.2449\nsamples = 37\nvalue = [0, 9, 54]\nclass = 2", fillcolor="#965ae9"] ; 344 | 169 -> 170 ; 345 | 171 [label="gini = 0.0\nsamples = 23\nvalue = [0, 0, 41]\nclass = 2", fillcolor="#8139e5"] ; 346 | 170 -> 171 ; 347 | 172 [label="pkt_size_max <= 7016.0\ngini = 0.4835\nsamples = 14\nvalue = [0, 9, 13]\nclass = 2", fillcolor="#d8c2f7"] ; 348 | 170 -> 172 ; 349 | 173 [label="gini = 0.0\nsamples = 6\nvalue = [0, 6, 0]\nclass = 1", fillcolor="#39e581"] ; 350 | 172 -> 173 ; 351 | 174 [label="flow_iat_min <= 5.5\ngini = 0.3047\nsamples = 8\nvalue = [0, 3, 13]\nclass = 2", fillcolor="#9e67eb"] ; 352 | 172 -> 174 ; 353 | 175 [label="gini = 0.0\nsamples = 2\nvalue = [0, 0, 5]\nclass = 2", fillcolor="#8139e5"] ; 354 | 174 -> 175 ; 355 | 176 [label="gini = 0.3967\nsamples = 6\nvalue = [0, 3, 8]\nclass = 2", fillcolor="#b083ef"] ; 356 | 174 -> 176 ; 357 | 177 [label="bin_3 <= 417.5\ngini = 0.559\nsamples = 28\nvalue = [6, 31, 17]\nclass = 1", fillcolor="#b4f5cf"] ; 358 | 169 -> 177 ; 359 | 178 [label="pkt_size_var_approx <= 459065.5\ngini = 0.3472\nsamples = 13\nvalue = [4, 23, 2]\nclass = 1", fillcolor="#69eb9f"] ; 360 | 177 -> 178 ; 361 | 179 [label="bin_3 <= 132.5\ngini = 0.4444\nsamples = 3\nvalue = [4, 0, 2]\nclass = 0", fillcolor="#f2c09c"] ; 362 | 178 -> 179 ; 363 | 180 [label="gini = 0.0\nsamples = 2\nvalue = [0, 0, 2]\nclass = 2", fillcolor="#8139e5"] ; 364 | 179 -> 180 ; 365 | 181 [label="gini = 0.0\nsamples = 1\nvalue = [4, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 366 | 179 -> 181 ; 367 | 182 [label="gini = 0.0\nsamples = 10\nvalue = [0, 23, 0]\nclass = 1", fillcolor="#39e581"] ; 368 | 178 -> 182 ; 369 | 183 [label="bin_5 <= 1.5\ngini = 0.5312\nsamples = 15\nvalue = [2, 8, 15]\nclass = 2", fillcolor="#cbadf4"] ; 370 | 177 -> 183 ; 371 | 184 [label="pkt_size_avg <= 872.5\ngini = 0.4752\nsamples = 12\nvalue = [2, 5, 15]\nclass = 2", fillcolor="#b58bf0"] ; 372 | 183 -> 184 ; 373 | 185 [label="gini = 0.625\nsamples = 8\nvalue = [2, 5, 5]\nclass = 1", fillcolor="#ffffff"] ; 374 | 184 -> 185 ; 375 | 186 [label="gini = 0.0\nsamples = 4\nvalue = [0, 0, 10]\nclass = 2", fillcolor="#8139e5"] ; 376 | 184 -> 186 ; 377 | 187 [label="gini = 0.0\nsamples = 3\nvalue = [0, 3, 0]\nclass = 1", fillcolor="#39e581"] ; 378 | 183 -> 187 ; 379 | 188 [label="pkt_size_var_approx <= 928854.5\ngini = 0.3377\nsamples = 117\nvalue = [3, 147, 36]\nclass = 1", fillcolor="#6ceca2"] ; 380 | 168 -> 188 ; 381 | 189 [label="bin_3 <= 161.5\ngini = 0.2637\nsamples = 88\nvalue = [3, 117, 18]\nclass = 1", fillcolor="#5cea97"] ; 382 | 188 -> 189 ; 383 | 190 [label="bin_3 <= 29.0\ngini = 0.497\nsamples = 8\nvalue = [0, 7, 6]\nclass = 1", fillcolor="#e3fbed"] ; 384 | 189 -> 190 ; 385 | 191 [label="gini = 0.0\nsamples = 2\nvalue = [0, 3, 0]\nclass = 1", fillcolor="#39e581"] ; 386 | 190 -> 191 ; 387 | 192 [label="pkt_size_avg <= 826.0\ngini = 0.48\nsamples = 6\nvalue = [0, 4, 6]\nclass = 2", fillcolor="#d5bdf6"] ; 388 | 190 -> 192 ; 389 | 193 [label="gini = 0.2449\nsamples = 4\nvalue = [0, 1, 6]\nclass = 2", fillcolor="#965ae9"] ; 390 | 192 -> 193 ; 391 | 194 [label="gini = 0.0\nsamples = 2\nvalue = [0, 3, 0]\nclass = 1", fillcolor="#39e581"] ; 392 | 192 -> 194 ; 393 | 195 [label="pkt_size_avg <= 387.5\ngini = 0.2158\nsamples = 80\nvalue = [3, 110, 12]\nclass = 1", fillcolor="#53e892"] ; 394 | 189 -> 195 ; 395 | 196 [label="bin_3 <= 530.5\ngini = 0.4444\nsamples = 6\nvalue = [0, 2, 4]\nclass = 2", fillcolor="#c09cf2"] ; 396 | 195 -> 196 ; 397 | 197 [label="gini = 0.4444\nsamples = 3\nvalue = [0, 2, 1]\nclass = 1", fillcolor="#9cf2c0"] ; 398 | 196 -> 197 ; 399 | 198 [label="gini = 0.0\nsamples = 3\nvalue = [0, 0, 3]\nclass = 2", fillcolor="#8139e5"] ; 400 | 196 -> 198 ; 401 | 199 [label="pkt_size_var_approx <= 908899.5\ngini = 0.1712\nsamples = 74\nvalue = [3, 108, 8]\nclass = 1", fillcolor="#4de88d"] ; 402 | 195 -> 199 ; 403 | 200 [label="gini = 0.1443\nsamples = 72\nvalue = [1, 107, 8]\nclass = 1", fillcolor="#4ae78c"] ; 404 | 199 -> 200 ; 405 | 201 [label="gini = 0.4444\nsamples = 2\nvalue = [2, 1, 0]\nclass = 0", fillcolor="#f2c09c"] ; 406 | 199 -> 201 ; 407 | 202 [label="pkt_size_max <= 5864.0\ngini = 0.4688\nsamples = 29\nvalue = [0, 30, 18]\nclass = 1", fillcolor="#b0f5cd"] ; 408 | 188 -> 202 ; 409 | 203 [label="bin_5 <= 17.0\ngini = 0.2449\nsamples = 5\nvalue = [0, 1, 6]\nclass = 2", fillcolor="#965ae9"] ; 410 | 202 -> 203 ; 411 | 204 [label="gini = 0.0\nsamples = 3\nvalue = [0, 0, 4]\nclass = 2", fillcolor="#8139e5"] ; 412 | 203 -> 204 ; 413 | 205 [label="bin_3 <= 242.5\ngini = 0.4444\nsamples = 2\nvalue = [0, 1, 2]\nclass = 2", fillcolor="#c09cf2"] ; 414 | 203 -> 205 ; 415 | 206 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 2]\nclass = 2", fillcolor="#8139e5"] ; 416 | 205 -> 206 ; 417 | 207 [label="gini = 0.0\nsamples = 1\nvalue = [0, 1, 0]\nclass = 1", fillcolor="#39e581"] ; 418 | 205 -> 207 ; 419 | 208 [label="bin_3 <= 319.5\ngini = 0.414\nsamples = 24\nvalue = [0, 29, 12]\nclass = 1", fillcolor="#8bf0b5"] ; 420 | 202 -> 208 ; 421 | 209 [label="gini = 0.0\nsamples = 6\nvalue = [0, 10, 0]\nclass = 1", fillcolor="#39e581"] ; 422 | 208 -> 209 ; 423 | 210 [label="flow_iat_min <= 11.5\ngini = 0.4745\nsamples = 18\nvalue = [0, 19, 12]\nclass = 1", fillcolor="#b6f5d1"] ; 424 | 208 -> 210 ; 425 | 211 [label="gini = 0.2076\nsamples = 12\nvalue = [0, 15, 2]\nclass = 1", fillcolor="#53e892"] ; 426 | 210 -> 211 ; 427 | 212 [label="gini = 0.4082\nsamples = 6\nvalue = [0, 4, 10]\nclass = 2", fillcolor="#b388ef"] ; 428 | 210 -> 212 ; 429 | 213 [label="pkt_size_avg <= 1077.0\ngini = 0.4744\nsamples = 160\nvalue = [0, 89, 141]\nclass = 2", fillcolor="#d1b6f5"] ; 430 | 167 -> 213 ; 431 | 214 [label="bin_3 <= 244.0\ngini = 0.4994\nsamples = 62\nvalue = [0, 45, 42]\nclass = 1", fillcolor="#f2fdf7"] ; 432 | 213 -> 214 ; 433 | 215 [label="gini = 0.0\nsamples = 11\nvalue = [0, 12, 0]\nclass = 1", fillcolor="#39e581"] ; 434 | 214 -> 215 ; 435 | 216 [label="flow_iat_min <= 17.0\ngini = 0.4928\nsamples = 51\nvalue = [0, 33, 42]\nclass = 2", fillcolor="#e4d5f9"] ; 436 | 214 -> 216 ; 437 | 217 [label="pkt_size_max <= 7296.0\ngini = 0.4444\nsamples = 30\nvalue = [0, 28, 14]\nclass = 1", fillcolor="#9cf2c0"] ; 438 | 216 -> 217 ; 439 | 218 [label="bin_5 <= 27.5\ngini = 0.4844\nsamples = 14\nvalue = [0, 7, 10]\nclass = 2", fillcolor="#d9c4f7"] ; 440 | 217 -> 218 ; 441 | 219 [label="gini = 0.497\nsamples = 11\nvalue = [0, 7, 6]\nclass = 1", fillcolor="#e3fbed"] ; 442 | 218 -> 219 ; 443 | 220 [label="gini = 0.0\nsamples = 3\nvalue = [0, 0, 4]\nclass = 2", fillcolor="#8139e5"] ; 444 | 218 -> 220 ; 445 | 221 [label="bin_5 <= 27.5\ngini = 0.2688\nsamples = 16\nvalue = [0, 21, 4]\nclass = 1", fillcolor="#5fea99"] ; 446 | 217 -> 221 ; 447 | 222 [label="gini = 0.0868\nsamples = 14\nvalue = [0, 21, 1]\nclass = 1", fillcolor="#42e687"] ; 448 | 221 -> 222 ; 449 | 223 [label="gini = 0.0\nsamples = 2\nvalue = [0, 0, 3]\nclass = 2", fillcolor="#8139e5"] ; 450 | 221 -> 223 ; 451 | 224 [label="pkt_size_var_approx <= 2283707.5\ngini = 0.2571\nsamples = 21\nvalue = [0, 5, 28]\nclass = 2", fillcolor="#985cea"] ; 452 | 216 -> 224 ; 453 | 225 [label="pkt_size_avg <= 981.0\ngini = 0.0666\nsamples = 18\nvalue = [0, 1, 28]\nclass = 2", fillcolor="#8640e6"] ; 454 | 224 -> 225 ; 455 | 226 [label="gini = 0.0\nsamples = 9\nvalue = [0, 0, 15]\nclass = 2", fillcolor="#8139e5"] ; 456 | 225 -> 226 ; 457 | 227 [label="gini = 0.1327\nsamples = 9\nvalue = [0, 1, 13]\nclass = 2", fillcolor="#8b48e7"] ; 458 | 225 -> 227 ; 459 | 228 [label="gini = 0.0\nsamples = 3\nvalue = [0, 4, 0]\nclass = 1", fillcolor="#39e581"] ; 460 | 224 -> 228 ; 461 | 229 [label="bin_5 <= 10.5\ngini = 0.426\nsamples = 98\nvalue = [0, 44, 99]\nclass = 2", fillcolor="#b991f1"] ; 462 | 213 -> 229 ; 463 | 230 [label="bin_3 <= 201.5\ngini = 0.4835\nsamples = 56\nvalue = [0, 36, 52]\nclass = 2", fillcolor="#d8c2f7"] ; 464 | 229 -> 230 ; 465 | 231 [label="pkt_size_var_approx <= 3202665.5\ngini = 0.3628\nsamples = 12\nvalue = [0, 16, 5]\nclass = 1", fillcolor="#77eda8"] ; 466 | 230 -> 231 ; 467 | 232 [label="gini = 0.0\nsamples = 8\nvalue = [0, 13, 0]\nclass = 1", fillcolor="#39e581"] ; 468 | 231 -> 232 ; 469 | 233 [label="bin_3 <= 54.5\ngini = 0.4688\nsamples = 4\nvalue = [0, 3, 5]\nclass = 2", fillcolor="#cdb0f5"] ; 470 | 231 -> 233 ; 471 | 234 [label="gini = 0.0\nsamples = 1\nvalue = [0, 3, 0]\nclass = 1", fillcolor="#39e581"] ; 472 | 233 -> 234 ; 473 | 235 [label="gini = 0.0\nsamples = 3\nvalue = [0, 0, 5]\nclass = 2", fillcolor="#8139e5"] ; 474 | 233 -> 235 ; 475 | 236 [label="pkt_size_min <= 46.0\ngini = 0.4188\nsamples = 44\nvalue = [0, 20, 47]\nclass = 2", fillcolor="#b78df0"] ; 476 | 230 -> 236 ; 477 | 237 [label="bin_3 <= 400.5\ngini = 0.3062\nsamples = 35\nvalue = [0, 10, 43]\nclass = 2", fillcolor="#9e67eb"] ; 478 | 236 -> 237 ; 479 | 238 [label="gini = 0.2268\nsamples = 29\nvalue = [0, 6, 40]\nclass = 2", fillcolor="#9457e9"] ; 480 | 237 -> 238 ; 481 | 239 [label="gini = 0.4898\nsamples = 6\nvalue = [0, 4, 3]\nclass = 1", fillcolor="#cef8e0"] ; 482 | 237 -> 239 ; 483 | 240 [label="bin_5 <= 1.5\ngini = 0.4082\nsamples = 9\nvalue = [0, 10, 4]\nclass = 1", fillcolor="#88efb3"] ; 484 | 236 -> 240 ; 485 | 241 [label="gini = 0.0\nsamples = 4\nvalue = [0, 6, 0]\nclass = 1", fillcolor="#39e581"] ; 486 | 240 -> 241 ; 487 | 242 [label="gini = 0.5\nsamples = 5\nvalue = [0, 4, 4]\nclass = 1", fillcolor="#ffffff"] ; 488 | 240 -> 242 ; 489 | 243 [label="pkt_size_max <= 7320.0\ngini = 0.2486\nsamples = 42\nvalue = [0, 8, 47]\nclass = 2", fillcolor="#965be9"] ; 490 | 229 -> 243 ; 491 | 244 [label="bin_3 <= 268.0\ngini = 0.1557\nsamples = 35\nvalue = [0, 4, 43]\nclass = 2", fillcolor="#8d4be7"] ; 492 | 243 -> 244 ; 493 | 245 [label="gini = 0.0\nsamples = 19\nvalue = [0, 0, 27]\nclass = 2", fillcolor="#8139e5"] ; 494 | 244 -> 245 ; 495 | 246 [label="bin_5 <= 16.5\ngini = 0.32\nsamples = 16\nvalue = [0, 4, 16]\nclass = 2", fillcolor="#a06aec"] ; 496 | 244 -> 246 ; 497 | 247 [label="gini = 0.0\nsamples = 4\nvalue = [0, 0, 5]\nclass = 2", fillcolor="#8139e5"] ; 498 | 246 -> 247 ; 499 | 248 [label="gini = 0.3911\nsamples = 12\nvalue = [0, 4, 11]\nclass = 2", fillcolor="#af81ee"] ; 500 | 246 -> 248 ; 501 | 249 [label="bin_5 <= 19.5\ngini = 0.5\nsamples = 7\nvalue = [0, 4, 4]\nclass = 1", fillcolor="#ffffff"] ; 502 | 243 -> 249 ; 503 | 250 [label="gini = 0.0\nsamples = 3\nvalue = [0, 0, 3]\nclass = 2", fillcolor="#8139e5"] ; 504 | 249 -> 250 ; 505 | 251 [label="pkt_size_avg <= 1202.5\ngini = 0.32\nsamples = 4\nvalue = [0, 4, 1]\nclass = 1", fillcolor="#6aeca0"] ; 506 | 249 -> 251 ; 507 | 252 [label="gini = 0.0\nsamples = 2\nvalue = [0, 3, 0]\nclass = 1", fillcolor="#39e581"] ; 508 | 251 -> 252 ; 509 | 253 [label="gini = 0.5\nsamples = 2\nvalue = [0, 1, 1]\nclass = 1", fillcolor="#ffffff"] ; 510 | 251 -> 253 ; 511 | 254 [label="pkt_size_var_approx <= 16018741.5\ngini = 0.2425\nsamples = 225\nvalue = [0, 48, 292]\nclass = 2", fillcolor="#965ae9"] ; 512 | 166 -> 254 ; 513 | 255 [label="pkt_size_min <= 46.0\ngini = 0.2276\nsamples = 223\nvalue = [0, 44, 292]\nclass = 2", fillcolor="#9457e9"] ; 514 | 254 -> 255 ; 515 | 256 [label="bin_5 <= 4.5\ngini = 0.1528\nsamples = 162\nvalue = [0, 20, 220]\nclass = 2", fillcolor="#8c4be7"] ; 516 | 255 -> 256 ; 517 | 257 [label="pkt_size_var_approx <= 2417259.5\ngini = 0.3112\nsamples = 54\nvalue = [0, 16, 67]\nclass = 2", fillcolor="#9f68eb"] ; 518 | 256 -> 257 ; 519 | 258 [label="pkt_size_max <= 20435.5\ngini = 0.1372\nsamples = 16\nvalue = [0, 2, 25]\nclass = 2", fillcolor="#8b49e7"] ; 520 | 257 -> 258 ; 521 | 259 [label="gini = 0.0\nsamples = 12\nvalue = [0, 0, 21]\nclass = 2", fillcolor="#8139e5"] ; 522 | 258 -> 259 ; 523 | 260 [label="pkt_size_max <= 28072.5\ngini = 0.4444\nsamples = 4\nvalue = [0, 2, 4]\nclass = 2", fillcolor="#c09cf2"] ; 524 | 258 -> 260 ; 525 | 261 [label="gini = 0.0\nsamples = 1\nvalue = [0, 2, 0]\nclass = 1", fillcolor="#39e581"] ; 526 | 260 -> 261 ; 527 | 262 [label="gini = 0.0\nsamples = 3\nvalue = [0, 0, 4]\nclass = 2", fillcolor="#8139e5"] ; 528 | 260 -> 262 ; 529 | 263 [label="pkt_size_var_approx <= 2649334.0\ngini = 0.375\nsamples = 38\nvalue = [0, 14, 42]\nclass = 2", fillcolor="#ab7bee"] ; 530 | 257 -> 263 ; 531 | 264 [label="gini = 0.0\nsamples = 1\nvalue = [0, 2, 0]\nclass = 1", fillcolor="#39e581"] ; 532 | 263 -> 264 ; 533 | 265 [label="pkt_size_max <= 8776.0\ngini = 0.3457\nsamples = 37\nvalue = [0, 12, 42]\nclass = 2", fillcolor="#a572ec"] ; 534 | 263 -> 265 ; 535 | 266 [label="gini = 0.0\nsamples = 2\nvalue = [0, 3, 0]\nclass = 1", fillcolor="#39e581"] ; 536 | 265 -> 266 ; 537 | 267 [label="gini = 0.2907\nsamples = 35\nvalue = [0, 9, 42]\nclass = 2", fillcolor="#9c63eb"] ; 538 | 265 -> 267 ; 539 | 268 [label="bin_5 <= 49.0\ngini = 0.0497\nsamples = 108\nvalue = [0, 4, 153]\nclass = 2", fillcolor="#843ee6"] ; 540 | 256 -> 268 ; 541 | 269 [label="pkt_size_avg <= 1630.0\ngini = 0.0382\nsamples = 105\nvalue = [0, 3, 151]\nclass = 2", fillcolor="#843de6"] ; 542 | 268 -> 269 ; 543 | 270 [label="bin_3 <= 115.5\ngini = 0.142\nsamples = 29\nvalue = [0, 3, 36]\nclass = 2", fillcolor="#8c49e7"] ; 544 | 269 -> 270 ; 545 | 271 [label="gini = 0.32\nsamples = 12\nvalue = [0, 3, 12]\nclass = 2", fillcolor="#a06aec"] ; 546 | 270 -> 271 ; 547 | 272 [label="gini = 0.0\nsamples = 17\nvalue = [0, 0, 24]\nclass = 2", fillcolor="#8139e5"] ; 548 | 270 -> 272 ; 549 | 273 [label="gini = 0.0\nsamples = 76\nvalue = [0, 0, 115]\nclass = 2", fillcolor="#8139e5"] ; 550 | 269 -> 273 ; 551 | 274 [label="bin_3 <= 104.0\ngini = 0.4444\nsamples = 3\nvalue = [0, 1, 2]\nclass = 2", fillcolor="#c09cf2"] ; 552 | 268 -> 274 ; 553 | 275 [label="gini = 0.0\nsamples = 1\nvalue = [0, 1, 0]\nclass = 1", fillcolor="#39e581"] ; 554 | 274 -> 275 ; 555 | 276 [label="gini = 0.0\nsamples = 2\nvalue = [0, 0, 2]\nclass = 2", fillcolor="#8139e5"] ; 556 | 274 -> 276 ; 557 | 277 [label="bin_3 <= 804.0\ngini = 0.375\nsamples = 61\nvalue = [0, 24, 72]\nclass = 2", fillcolor="#ab7bee"] ; 558 | 255 -> 277 ; 559 | 278 [label="gini = 0.0\nsamples = 13\nvalue = [0, 0, 19]\nclass = 2", fillcolor="#8139e5"] ; 560 | 277 -> 278 ; 561 | 279 [label="pkt_size_avg <= 880.5\ngini = 0.4291\nsamples = 48\nvalue = [0, 24, 53]\nclass = 2", fillcolor="#ba93f1"] ; 562 | 277 -> 279 ; 563 | 280 [label="gini = 0.0\nsamples = 3\nvalue = [0, 5, 0]\nclass = 1", fillcolor="#39e581"] ; 564 | 279 -> 280 ; 565 | 281 [label="flow_iat_min <= 4.5\ngini = 0.3885\nsamples = 45\nvalue = [0, 19, 53]\nclass = 2", fillcolor="#ae80ee"] ; 566 | 279 -> 281 ; 567 | 282 [label="gini = 0.0\nsamples = 1\nvalue = [0, 1, 0]\nclass = 1", fillcolor="#39e581"] ; 568 | 281 -> 282 ; 569 | 283 [label="pkt_size_avg <= 1042.5\ngini = 0.3785\nsamples = 44\nvalue = [0, 18, 53]\nclass = 2", fillcolor="#ac7cee"] ; 570 | 281 -> 283 ; 571 | 284 [label="gini = 0.0\nsamples = 8\nvalue = [0, 0, 12]\nclass = 2", fillcolor="#8139e5"] ; 572 | 283 -> 284 ; 573 | 285 [label="gini = 0.424\nsamples = 36\nvalue = [0, 18, 41]\nclass = 2", fillcolor="#b890f0"] ; 574 | 283 -> 285 ; 575 | 286 [label="gini = 0.0\nsamples = 2\nvalue = [0, 4, 0]\nclass = 1", fillcolor="#39e581"] ; 576 | 254 -> 286 ; 577 | } -------------------------------------------------------------------------------- /model_generation/models/class_flow_phase_256pkt_1rf_0.dot: -------------------------------------------------------------------------------- 1 | digraph Tree { 2 | node [shape=box, style="filled, rounded", color="black", fontname=helvetica] ; 3 | edge [fontname=helvetica] ; 4 | 0 [label="pkt_size_avg <= 145.0\ngini = 0.6652\nsamples = 6609\nvalue = [3787, 3227, 3401]\nclass = 0", fillcolor="#fef8f4"] ; 5 | 1 [label="bin_3 <= 9.5\ngini = 0.1176\nsamples = 1389\nvalue = [8, 128, 2040]\nclass = 2", fillcolor="#8946e7"] ; 6 | 0 -> 1 [labeldistance=2.5, labelangle=45, headlabel="True"] ; 7 | 2 [label="pkt_size_avg <= 77.5\ngini = 0.0068\nsamples = 1301\nvalue = [7, 0, 2033]\nclass = 2", fillcolor="#813ae5"] ; 8 | 1 -> 2 ; 9 | 3 [label="gini = 0.0\nsamples = 1238\nvalue = [0, 0, 1944]\nclass = 2", fillcolor="#8139e5"] ; 10 | 2 -> 3 ; 11 | 4 [label="pkt_size_var_approx <= 4294966400.0\ngini = 0.1352\nsamples = 63\nvalue = [7, 0, 89]\nclass = 2", fillcolor="#8b49e7"] ; 12 | 2 -> 4 ; 13 | 5 [label="flow_iat_min <= 12.0\ngini = 0.043\nsamples = 60\nvalue = [2, 0, 89]\nclass = 2", fillcolor="#843de6"] ; 14 | 4 -> 5 ; 15 | 6 [label="gini = 0.0\nsamples = 1\nvalue = [1, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 16 | 5 -> 6 ; 17 | 7 [label="pkt_size_avg <= 95.5\ngini = 0.022\nsamples = 59\nvalue = [1, 0, 89]\nclass = 2", fillcolor="#823be5"] ; 18 | 5 -> 7 ; 19 | 8 [label="pkt_size_avg <= 94.0\ngini = 0.095\nsamples = 16\nvalue = [1, 0, 19]\nclass = 2", fillcolor="#8843e6"] ; 20 | 7 -> 8 ; 21 | 9 [label="gini = 0.0\nsamples = 15\nvalue = [0, 0, 19]\nclass = 2", fillcolor="#8139e5"] ; 22 | 8 -> 9 ; 23 | 10 [label="gini = 0.0\nsamples = 1\nvalue = [1, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 24 | 8 -> 10 ; 25 | 11 [label="gini = 0.0\nsamples = 43\nvalue = [0, 0, 70]\nclass = 2", fillcolor="#8139e5"] ; 26 | 7 -> 11 ; 27 | 12 [label="gini = 0.0\nsamples = 3\nvalue = [5, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 28 | 4 -> 12 ; 29 | 13 [label="pkt_size_max <= 1502.0\ngini = 0.1115\nsamples = 88\nvalue = [1, 128, 7]\nclass = 1", fillcolor="#45e789"] ; 30 | 1 -> 13 ; 31 | 14 [label="pkt_size_var_approx <= 15.0\ngini = 0.0165\nsamples = 78\nvalue = [1, 119, 0]\nclass = 1", fillcolor="#3be582"] ; 32 | 13 -> 14 ; 33 | 15 [label="gini = 0.0\nsamples = 1\nvalue = [1, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 34 | 14 -> 15 ; 35 | 16 [label="gini = 0.0\nsamples = 77\nvalue = [0, 119, 0]\nclass = 1", fillcolor="#39e581"] ; 36 | 14 -> 16 ; 37 | 17 [label="pkt_size_var_approx <= 18400.5\ngini = 0.4922\nsamples = 10\nvalue = [0, 9, 7]\nclass = 1", fillcolor="#d3f9e3"] ; 38 | 13 -> 17 ; 39 | 18 [label="gini = 0.0\nsamples = 6\nvalue = [0, 0, 7]\nclass = 2", fillcolor="#8139e5"] ; 40 | 17 -> 18 ; 41 | 19 [label="gini = 0.0\nsamples = 4\nvalue = [0, 9, 0]\nclass = 1", fillcolor="#39e581"] ; 42 | 17 -> 19 ; 43 | 20 [label="pkt_size_max <= 1471.0\ngini = 0.6209\nsamples = 5220\nvalue = [3779, 3099, 1361]\nclass = 0", fillcolor="#fceee5"] ; 44 | 0 -> 20 [labeldistance=2.5, labelangle=-45, headlabel="False"] ; 45 | 21 [label="pkt_size_min <= 44.0\ngini = 0.278\nsamples = 1566\nvalue = [219, 2098, 174]\nclass = 1", fillcolor="#5be997"] ; 46 | 20 -> 21 ; 47 | 22 [label="pkt_size_avg <= 387.5\ngini = 0.5172\nsamples = 131\nvalue = [130, 29, 42]\nclass = 0", fillcolor="#f1b991"] ; 48 | 21 -> 22 ; 49 | 23 [label="pkt_size_avg <= 339.0\ngini = 0.6602\nsamples = 53\nvalue = [31, 26, 22]\nclass = 0", fillcolor="#fdf3ec"] ; 50 | 22 -> 23 ; 51 | 24 [label="bin_3 <= 13.0\ngini = 0.4882\nsamples = 19\nvalue = [15, 11, 0]\nclass = 0", fillcolor="#f8ddca"] ; 52 | 23 -> 24 ; 53 | 25 [label="gini = 0.0\nsamples = 10\nvalue = [14, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 54 | 24 -> 25 ; 55 | 26 [label="flow_iat_min <= 9.0\ngini = 0.1528\nsamples = 9\nvalue = [1, 11, 0]\nclass = 1", fillcolor="#4be78c"] ; 56 | 24 -> 26 ; 57 | 27 [label="gini = 0.0\nsamples = 1\nvalue = [1, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 58 | 26 -> 27 ; 59 | 28 [label="gini = 0.0\nsamples = 8\nvalue = [0, 11, 0]\nclass = 1", fillcolor="#39e581"] ; 60 | 26 -> 28 ; 61 | 29 [label="pkt_size_avg <= 350.5\ngini = 0.6565\nsamples = 34\nvalue = [16, 15, 22]\nclass = 2", fillcolor="#ebdffb"] ; 62 | 23 -> 29 ; 63 | 30 [label="bin_5 <= 0.5\ngini = 0.1975\nsamples = 5\nvalue = [0, 1, 8]\nclass = 2", fillcolor="#9152e8"] ; 64 | 29 -> 30 ; 65 | 31 [label="gini = 0.0\nsamples = 3\nvalue = [0, 0, 6]\nclass = 2", fillcolor="#8139e5"] ; 66 | 30 -> 31 ; 67 | 32 [label="pkt_size_avg <= 346.0\ngini = 0.4444\nsamples = 2\nvalue = [0, 1, 2]\nclass = 2", fillcolor="#c09cf2"] ; 68 | 30 -> 32 ; 69 | 33 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 2]\nclass = 2", fillcolor="#8139e5"] ; 70 | 32 -> 33 ; 71 | 34 [label="gini = 0.0\nsamples = 1\nvalue = [0, 1, 0]\nclass = 1", fillcolor="#39e581"] ; 72 | 32 -> 34 ; 73 | 35 [label="flow_iat_min <= 14.5\ngini = 0.6653\nsamples = 29\nvalue = [16, 14, 14]\nclass = 0", fillcolor="#fdf7f2"] ; 74 | 29 -> 35 ; 75 | 36 [label="pkt_size_var_approx <= 75878.0\ngini = 0.6148\nsamples = 18\nvalue = [14, 9, 5]\nclass = 0", fillcolor="#f8decb"] ; 76 | 35 -> 36 ; 77 | 37 [label="bin_3 <= 36.0\ngini = 0.48\nsamples = 10\nvalue = [10, 1, 4]\nclass = 0", fillcolor="#f1ba93"] ; 78 | 36 -> 37 ; 79 | 38 [label="gini = 0.1653\nsamples = 8\nvalue = [10, 0, 1]\nclass = 0", fillcolor="#e88e4d"] ; 80 | 37 -> 38 ; 81 | 39 [label="gini = 0.375\nsamples = 2\nvalue = [0, 1, 3]\nclass = 2", fillcolor="#ab7bee"] ; 82 | 37 -> 39 ; 83 | 40 [label="bin_3 <= 26.0\ngini = 0.5207\nsamples = 8\nvalue = [4, 8, 1]\nclass = 1", fillcolor="#a7f3c7"] ; 84 | 36 -> 40 ; 85 | 41 [label="gini = 0.32\nsamples = 4\nvalue = [4, 0, 1]\nclass = 0", fillcolor="#eca06a"] ; 86 | 40 -> 41 ; 87 | 42 [label="gini = 0.0\nsamples = 4\nvalue = [0, 8, 0]\nclass = 1", fillcolor="#39e581"] ; 88 | 40 -> 42 ; 89 | 43 [label="bin_5 <= 0.5\ngini = 0.5703\nsamples = 11\nvalue = [2, 5, 9]\nclass = 2", fillcolor="#d1b7f6"] ; 90 | 35 -> 43 ; 91 | 44 [label="pkt_size_avg <= 358.5\ngini = 0.375\nsamples = 6\nvalue = [0, 2, 6]\nclass = 2", fillcolor="#ab7bee"] ; 92 | 43 -> 44 ; 93 | 45 [label="gini = 0.0\nsamples = 1\nvalue = [0, 2, 0]\nclass = 1", fillcolor="#39e581"] ; 94 | 44 -> 45 ; 95 | 46 [label="gini = 0.0\nsamples = 5\nvalue = [0, 0, 6]\nclass = 2", fillcolor="#8139e5"] ; 96 | 44 -> 46 ; 97 | 47 [label="pkt_size_var_approx <= 88187.0\ngini = 0.6562\nsamples = 5\nvalue = [2, 3, 3]\nclass = 1", fillcolor="#ffffff"] ; 98 | 43 -> 47 ; 99 | 48 [label="gini = 0.6111\nsamples = 4\nvalue = [2, 3, 1]\nclass = 1", fillcolor="#cef8e0"] ; 100 | 47 -> 48 ; 101 | 49 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 2]\nclass = 2", fillcolor="#8139e5"] ; 102 | 47 -> 49 ; 103 | 50 [label="flow_iat_min <= 9.5\ngini = 0.314\nsamples = 78\nvalue = [99, 3, 20]\nclass = 0", fillcolor="#eb9d66"] ; 104 | 22 -> 50 ; 105 | 51 [label="flow_iat_min <= 5.5\ngini = 0.485\nsamples = 13\nvalue = [6, 1, 13]\nclass = 2", fillcolor="#c09cf2"] ; 106 | 50 -> 51 ; 107 | 52 [label="gini = 0.0\nsamples = 1\nvalue = [1, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 108 | 51 -> 52 ; 109 | 53 [label="pkt_size_var_approx <= 420799.5\ngini = 0.4598\nsamples = 12\nvalue = [5, 1, 13]\nclass = 2", fillcolor="#b78ef0"] ; 110 | 51 -> 53 ; 111 | 54 [label="pkt_size_max <= 1431.0\ngini = 0.48\nsamples = 4\nvalue = [3, 0, 2]\nclass = 0", fillcolor="#f6d5bd"] ; 112 | 53 -> 54 ; 113 | 55 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 1]\nclass = 2", fillcolor="#8139e5"] ; 114 | 54 -> 55 ; 115 | 56 [label="bin_5 <= 1.5\ngini = 0.375\nsamples = 3\nvalue = [3, 0, 1]\nclass = 0", fillcolor="#eeab7b"] ; 116 | 54 -> 56 ; 117 | 57 [label="gini = 0.0\nsamples = 2\nvalue = [3, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 118 | 56 -> 57 ; 119 | 58 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 1]\nclass = 2", fillcolor="#8139e5"] ; 120 | 56 -> 58 ; 121 | 59 [label="pkt_size_avg <= 837.5\ngini = 0.3571\nsamples = 8\nvalue = [2, 1, 11]\nclass = 2", fillcolor="#a06bec"] ; 122 | 53 -> 59 ; 123 | 60 [label="flow_iat_min <= 7.0\ngini = 0.5\nsamples = 2\nvalue = [0, 1, 1]\nclass = 1", fillcolor="#ffffff"] ; 124 | 59 -> 60 ; 125 | 61 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 1]\nclass = 2", fillcolor="#8139e5"] ; 126 | 60 -> 61 ; 127 | 62 [label="gini = 0.0\nsamples = 1\nvalue = [0, 1, 0]\nclass = 1", fillcolor="#39e581"] ; 128 | 60 -> 62 ; 129 | 63 [label="bin_3 <= 9.0\ngini = 0.2778\nsamples = 6\nvalue = [2, 0, 10]\nclass = 2", fillcolor="#9a61ea"] ; 130 | 59 -> 63 ; 131 | 64 [label="gini = 0.4444\nsamples = 3\nvalue = [2, 0, 4]\nclass = 2", fillcolor="#c09cf2"] ; 132 | 63 -> 64 ; 133 | 65 [label="gini = 0.0\nsamples = 3\nvalue = [0, 0, 6]\nclass = 2", fillcolor="#8139e5"] ; 134 | 63 -> 65 ; 135 | 66 [label="bin_5 <= 0.5\ngini = 0.1636\nsamples = 65\nvalue = [93, 2, 7]\nclass = 0", fillcolor="#e78d4c"] ; 136 | 50 -> 66 ; 137 | 67 [label="pkt_size_avg <= 403.0\ngini = 0.48\nsamples = 6\nvalue = [4, 0, 6]\nclass = 2", fillcolor="#d5bdf6"] ; 138 | 66 -> 67 ; 139 | 68 [label="gini = 0.0\nsamples = 2\nvalue = [3, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 140 | 67 -> 68 ; 141 | 69 [label="pkt_size_var_approx <= 356386.0\ngini = 0.2449\nsamples = 4\nvalue = [1, 0, 6]\nclass = 2", fillcolor="#965ae9"] ; 142 | 67 -> 69 ; 143 | 70 [label="gini = 0.0\nsamples = 2\nvalue = [0, 0, 4]\nclass = 2", fillcolor="#8139e5"] ; 144 | 69 -> 70 ; 145 | 71 [label="pkt_size_var_approx <= 429403.0\ngini = 0.4444\nsamples = 2\nvalue = [1, 0, 2]\nclass = 2", fillcolor="#c09cf2"] ; 146 | 69 -> 71 ; 147 | 72 [label="gini = 0.0\nsamples = 1\nvalue = [1, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 148 | 71 -> 72 ; 149 | 73 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 2]\nclass = 2", fillcolor="#8139e5"] ; 150 | 71 -> 73 ; 151 | 74 [label="pkt_size_avg <= 486.5\ngini = 0.0636\nsamples = 59\nvalue = [89, 2, 1]\nclass = 0", fillcolor="#e68540"] ; 152 | 66 -> 74 ; 153 | 75 [label="pkt_size_var_approx <= 238209.5\ngini = 0.375\nsamples = 3\nvalue = [3, 0, 1]\nclass = 0", fillcolor="#eeab7b"] ; 154 | 74 -> 75 ; 155 | 76 [label="gini = 0.0\nsamples = 2\nvalue = [3, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 156 | 75 -> 76 ; 157 | 77 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 1]\nclass = 2", fillcolor="#8139e5"] ; 158 | 75 -> 77 ; 159 | 78 [label="flow_iat_min <= 55.0\ngini = 0.0444\nsamples = 56\nvalue = [86, 2, 0]\nclass = 0", fillcolor="#e6843e"] ; 160 | 74 -> 78 ; 161 | 79 [label="pkt_size_var_approx <= 486373.5\ngini = 0.1472\nsamples = 18\nvalue = [23, 2, 0]\nclass = 0", fillcolor="#e78c4a"] ; 162 | 78 -> 79 ; 163 | 80 [label="gini = 0.0799\nsamples = 17\nvalue = [23, 1, 0]\nclass = 0", fillcolor="#e68642"] ; 164 | 79 -> 80 ; 165 | 81 [label="gini = 0.0\nsamples = 1\nvalue = [0, 1, 0]\nclass = 1", fillcolor="#39e581"] ; 166 | 79 -> 81 ; 167 | 82 [label="gini = 0.0\nsamples = 38\nvalue = [63, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 168 | 78 -> 82 ; 169 | 83 [label="pkt_size_min <= 51.5\ngini = 0.1789\nsamples = 1435\nvalue = [89, 2069, 132]\nclass = 1", fillcolor="#4de88e"] ; 170 | 21 -> 83 ; 171 | 84 [label="gini = 0.0\nsamples = 808\nvalue = [0, 1276, 0]\nclass = 1", fillcolor="#39e581"] ; 172 | 83 -> 84 ; 173 | 85 [label="bin_3 <= 5.5\ngini = 0.3637\nsamples = 627\nvalue = [89, 793, 132]\nclass = 1", fillcolor="#6beca1"] ; 174 | 83 -> 85 ; 175 | 86 [label="pkt_size_min <= 127.5\ngini = 0.0886\nsamples = 491\nvalue = [0, 739, 36]\nclass = 1", fillcolor="#43e687"] ; 176 | 85 -> 86 ; 177 | 87 [label="gini = 0.0\nsamples = 411\nvalue = [0, 658, 0]\nclass = 1", fillcolor="#39e581"] ; 178 | 86 -> 87 ; 179 | 88 [label="pkt_size_var_approx <= 11052.0\ngini = 0.426\nsamples = 80\nvalue = [0, 81, 36]\nclass = 1", fillcolor="#91f1b9"] ; 180 | 86 -> 88 ; 181 | 89 [label="pkt_size_min <= 130.5\ngini = 0.4757\nsamples = 42\nvalue = [0, 23, 36]\nclass = 2", fillcolor="#d2b8f6"] ; 182 | 88 -> 89 ; 183 | 90 [label="pkt_size_max <= 361.5\ngini = 0.4654\nsamples = 41\nvalue = [0, 21, 36]\nclass = 2", fillcolor="#caacf4"] ; 184 | 89 -> 90 ; 185 | 91 [label="gini = 0.0\nsamples = 11\nvalue = [0, 18, 0]\nclass = 1", fillcolor="#39e581"] ; 186 | 90 -> 91 ; 187 | 92 [label="gini = 0.142\nsamples = 30\nvalue = [0, 3, 36]\nclass = 2", fillcolor="#8c49e7"] ; 188 | 90 -> 92 ; 189 | 93 [label="gini = 0.0\nsamples = 1\nvalue = [0, 2, 0]\nclass = 1", fillcolor="#39e581"] ; 190 | 89 -> 93 ; 191 | 94 [label="gini = 0.0\nsamples = 38\nvalue = [0, 58, 0]\nclass = 1", fillcolor="#39e581"] ; 192 | 88 -> 94 ; 193 | 95 [label="pkt_size_min <= 54.0\ngini = 0.6489\nsamples = 136\nvalue = [89, 54, 96]\nclass = 2", fillcolor="#f9f6fe"] ; 194 | 85 -> 95 ; 195 | 96 [label="bin_5 <= 1.5\ngini = 0.6456\nsamples = 111\nvalue = [89, 54, 54]\nclass = 0", fillcolor="#f9e0cf"] ; 196 | 95 -> 96 ; 197 | 97 [label="pkt_size_avg <= 354.5\ngini = 0.5702\nsamples = 72\nvalue = [79, 22, 35]\nclass = 0", fillcolor="#f4c8a9"] ; 198 | 96 -> 97 ; 199 | 98 [label="pkt_size_max <= 628.0\ngini = 0.5862\nsamples = 19\nvalue = [5, 14, 21]\nclass = 2", fillcolor="#ddcaf8"] ; 200 | 97 -> 98 ; 201 | 99 [label="gini = 0.6142\nsamples = 17\nvalue = [5, 14, 15]\nclass = 2", fillcolor="#f9f5fe"] ; 202 | 98 -> 99 ; 203 | 100 [label="gini = 0.0\nsamples = 2\nvalue = [0, 0, 6]\nclass = 2", fillcolor="#8139e5"] ; 204 | 98 -> 100 ; 205 | 101 [label="pkt_size_avg <= 811.5\ngini = 0.3776\nsamples = 53\nvalue = [74, 8, 14]\nclass = 0", fillcolor="#eca36e"] ; 206 | 97 -> 101 ; 207 | 102 [label="gini = 0.2856\nsamples = 48\nvalue = [72, 8, 6]\nclass = 0", fillcolor="#ea985d"] ; 208 | 101 -> 102 ; 209 | 103 [label="gini = 0.32\nsamples = 5\nvalue = [2, 0, 8]\nclass = 2", fillcolor="#a06aec"] ; 210 | 101 -> 103 ; 211 | 104 [label="flow_iat_min <= 18.0\ngini = 0.6009\nsamples = 39\nvalue = [10, 32, 19]\nclass = 1", fillcolor="#c2f7d8"] ; 212 | 96 -> 104 ; 213 | 105 [label="pkt_size_avg <= 316.5\ngini = 0.4675\nsamples = 34\nvalue = [0, 32, 19]\nclass = 1", fillcolor="#aff4cc"] ; 214 | 104 -> 105 ; 215 | 106 [label="gini = 0.4991\nsamples = 13\nvalue = [0, 11, 12]\nclass = 2", fillcolor="#f5effd"] ; 216 | 105 -> 106 ; 217 | 107 [label="gini = 0.375\nsamples = 21\nvalue = [0, 21, 7]\nclass = 1", fillcolor="#7beeab"] ; 218 | 105 -> 107 ; 219 | 108 [label="gini = 0.0\nsamples = 5\nvalue = [10, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 220 | 104 -> 108 ; 221 | 109 [label="gini = 0.0\nsamples = 25\nvalue = [0, 0, 42]\nclass = 2", fillcolor="#8139e5"] ; 222 | 95 -> 109 ; 223 | 110 [label="pkt_size_max <= 2966.0\ngini = 0.5434\nsamples = 3654\nvalue = [3560, 1001, 1187]\nclass = 0", fillcolor="#f1bd98"] ; 224 | 20 -> 110 ; 225 | 111 [label="pkt_size_avg <= 731.5\ngini = 0.3307\nsamples = 2818\nvalue = [3554, 528, 328]\nclass = 0", fillcolor="#eb9d65"] ; 226 | 110 -> 111 ; 227 | 112 [label="pkt_size_max <= 2794.0\ngini = 0.5888\nsamples = 415\nvalue = [195, 357, 102]\nclass = 1", fillcolor="#b9f6d3"] ; 228 | 111 -> 112 ; 229 | 113 [label="pkt_size_avg <= 411.5\ngini = 0.6468\nsamples = 216\nvalue = [106, 153, 86]\nclass = 1", fillcolor="#d8fae6"] ; 230 | 112 -> 113 ; 231 | 114 [label="flow_iat_min <= 77.0\ngini = 0.5214\nsamples = 68\nvalue = [16, 78, 28]\nclass = 1", fillcolor="#96f1bc"] ; 232 | 113 -> 114 ; 233 | 115 [label="pkt_size_max <= 1676.0\ngini = 0.4746\nsamples = 65\nvalue = [9, 78, 28]\nclass = 1", fillcolor="#8df0b7"] ; 234 | 114 -> 115 ; 235 | 116 [label="pkt_size_max <= 1486.0\ngini = 0.3404\nsamples = 51\nvalue = [1, 70, 18]\nclass = 1", fillcolor="#6eeca3"] ; 236 | 115 -> 116 ; 237 | 117 [label="gini = 0.0\nsamples = 9\nvalue = [0, 25, 0]\nclass = 1", fillcolor="#39e581"] ; 238 | 116 -> 117 ; 239 | 118 [label="gini = 0.4263\nsamples = 42\nvalue = [1, 45, 18]\nclass = 1", fillcolor="#8bf0b5"] ; 240 | 116 -> 118 ; 241 | 119 [label="pkt_size_avg <= 379.0\ngini = 0.6627\nsamples = 14\nvalue = [8, 8, 10]\nclass = 2", fillcolor="#f1e9fc"] ; 242 | 115 -> 119 ; 243 | 120 [label="gini = 0.4592\nsamples = 7\nvalue = [0, 5, 9]\nclass = 2", fillcolor="#c7a7f3"] ; 244 | 119 -> 120 ; 245 | 121 [label="gini = 0.4861\nsamples = 7\nvalue = [8, 3, 1]\nclass = 0", fillcolor="#f1b991"] ; 246 | 119 -> 121 ; 247 | 122 [label="gini = 0.0\nsamples = 3\nvalue = [7, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 248 | 114 -> 122 ; 249 | 123 [label="pkt_size_var_approx <= 380758.0\ngini = 0.6564\nsamples = 148\nvalue = [90, 75, 58]\nclass = 0", fillcolor="#fcf2eb"] ; 250 | 113 -> 123 ; 251 | 124 [label="pkt_size_max <= 2614.0\ngini = 0.587\nsamples = 76\nvalue = [68, 35, 20]\nclass = 0", fillcolor="#f5d0b5"] ; 252 | 123 -> 124 ; 253 | 125 [label="pkt_size_avg <= 538.0\ngini = 0.6309\nsamples = 62\nvalue = [47, 34, 20]\nclass = 0", fillcolor="#fae7d9"] ; 254 | 124 -> 125 ; 255 | 126 [label="gini = 0.3597\nsamples = 18\nvalue = [3, 22, 3]\nclass = 1", fillcolor="#69eb9f"] ; 256 | 125 -> 126 ; 257 | 127 [label="gini = 0.5555\nsamples = 44\nvalue = [44, 12, 17]\nclass = 0", fillcolor="#f2c2a0"] ; 258 | 125 -> 127 ; 259 | 128 [label="pkt_size_avg <= 542.5\ngini = 0.0868\nsamples = 14\nvalue = [21, 1, 0]\nclass = 0", fillcolor="#e68742"] ; 260 | 124 -> 128 ; 261 | 129 [label="gini = 0.0\nsamples = 13\nvalue = [21, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 262 | 128 -> 129 ; 263 | 130 [label="gini = 0.0\nsamples = 1\nvalue = [0, 1, 0]\nclass = 1", fillcolor="#39e581"] ; 264 | 128 -> 130 ; 265 | 131 [label="flow_iat_min <= 87.5\ngini = 0.6472\nsamples = 72\nvalue = [22, 40, 38]\nclass = 1", fillcolor="#f9fefb"] ; 266 | 123 -> 131 ; 267 | 132 [label="pkt_size_var_approx <= 550134.5\ngini = 0.6204\nsamples = 63\nvalue = [14, 39, 34]\nclass = 1", fillcolor="#ecfdf3"] ; 268 | 131 -> 132 ; 269 | 133 [label="gini = 0.5822\nsamples = 60\nvalue = [8, 39, 34]\nclass = 1", fillcolor="#eafcf2"] ; 270 | 132 -> 133 ; 271 | 134 [label="gini = 0.0\nsamples = 3\nvalue = [6, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 272 | 132 -> 134 ; 273 | 135 [label="pkt_size_avg <= 660.0\ngini = 0.5207\nsamples = 9\nvalue = [8, 1, 4]\nclass = 0", fillcolor="#f3c7a7"] ; 274 | 131 -> 135 ; 275 | 136 [label="gini = 0.0\nsamples = 5\nvalue = [8, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 276 | 135 -> 136 ; 277 | 137 [label="gini = 0.32\nsamples = 4\nvalue = [0, 1, 4]\nclass = 2", fillcolor="#a06aec"] ; 278 | 135 -> 137 ; 279 | 138 [label="bin_5 <= 3.5\ngini = 0.4785\nsamples = 199\nvalue = [89, 204, 16]\nclass = 1", fillcolor="#97f1bd"] ; 280 | 112 -> 138 ; 281 | 139 [label="flow_iat_min <= 20.5\ngini = 0.5251\nsamples = 153\nvalue = [86, 143, 14]\nclass = 1", fillcolor="#b7f6d1"] ; 282 | 138 -> 139 ; 283 | 140 [label="pkt_size_max <= 2862.0\ngini = 0.5371\nsamples = 139\nvalue = [85, 125, 13]\nclass = 1", fillcolor="#c6f7da"] ; 284 | 139 -> 140 ; 285 | 141 [label="flow_iat_min <= 15.5\ngini = 0.1172\nsamples = 13\nvalue = [1, 15, 0]\nclass = 1", fillcolor="#46e789"] ; 286 | 140 -> 141 ; 287 | 142 [label="gini = 0.0\nsamples = 12\nvalue = [0, 15, 0]\nclass = 1", fillcolor="#39e581"] ; 288 | 141 -> 142 ; 289 | 143 [label="gini = 0.0\nsamples = 1\nvalue = [1, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 290 | 141 -> 143 ; 291 | 144 [label="pkt_size_var_approx <= 638098.0\ngini = 0.549\nsamples = 126\nvalue = [84, 110, 13]\nclass = 1", fillcolor="#d5fae4"] ; 292 | 140 -> 144 ; 293 | 145 [label="gini = 0.313\nsamples = 82\nvalue = [15, 108, 9]\nclass = 1", fillcolor="#62ea9b"] ; 294 | 144 -> 145 ; 295 | 146 [label="gini = 0.15\nsamples = 44\nvalue = [69, 2, 4]\nclass = 0", fillcolor="#e78c4a"] ; 296 | 144 -> 146 ; 297 | 147 [label="pkt_size_var_approx <= 619280.5\ngini = 0.185\nsamples = 14\nvalue = [1, 18, 1]\nclass = 1", fillcolor="#4ee88e"] ; 298 | 139 -> 147 ; 299 | 148 [label="gini = 0.0\nsamples = 12\nvalue = [0, 18, 0]\nclass = 1", fillcolor="#39e581"] ; 300 | 147 -> 148 ; 301 | 149 [label="bin_3 <= 43.5\ngini = 0.5\nsamples = 2\nvalue = [1, 0, 1]\nclass = 0", fillcolor="#ffffff"] ; 302 | 147 -> 149 ; 303 | 150 [label="gini = 0.0\nsamples = 1\nvalue = [1, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 304 | 149 -> 150 ; 305 | 151 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 1]\nclass = 2", fillcolor="#8139e5"] ; 306 | 149 -> 151 ; 307 | 152 [label="pkt_size_avg <= 715.5\ngini = 0.1428\nsamples = 46\nvalue = [3, 61, 2]\nclass = 1", fillcolor="#49e78b"] ; 308 | 138 -> 152 ; 309 | 153 [label="pkt_size_avg <= 393.0\ngini = 0.0903\nsamples = 45\nvalue = [1, 61, 2]\nclass = 1", fillcolor="#43e687"] ; 310 | 152 -> 153 ; 311 | 154 [label="pkt_size_max <= 2932.0\ngini = 0.4444\nsamples = 4\nvalue = [0, 4, 2]\nclass = 1", fillcolor="#9cf2c0"] ; 312 | 153 -> 154 ; 313 | 155 [label="gini = 0.0\nsamples = 3\nvalue = [0, 4, 0]\nclass = 1", fillcolor="#39e581"] ; 314 | 154 -> 155 ; 315 | 156 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 2]\nclass = 2", fillcolor="#8139e5"] ; 316 | 154 -> 156 ; 317 | 157 [label="pkt_size_var_approx <= 467580.0\ngini = 0.0339\nsamples = 41\nvalue = [1, 57, 0]\nclass = 1", fillcolor="#3ce583"] ; 318 | 153 -> 157 ; 319 | 158 [label="gini = 0.0768\nsamples = 21\nvalue = [1, 24, 0]\nclass = 1", fillcolor="#41e686"] ; 320 | 157 -> 158 ; 321 | 159 [label="gini = 0.0\nsamples = 20\nvalue = [0, 33, 0]\nclass = 1", fillcolor="#39e581"] ; 322 | 157 -> 159 ; 323 | 160 [label="gini = 0.0\nsamples = 1\nvalue = [2, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 324 | 152 -> 160 ; 325 | 161 [label="bin_5 <= 0.5\ngini = 0.1945\nsamples = 2403\nvalue = [3359, 171, 226]\nclass = 0", fillcolor="#e88f4f"] ; 326 | 111 -> 161 ; 327 | 162 [label="pkt_size_max <= 2407.0\ngini = 0.6133\nsamples = 258\nvalue = [188, 61, 164]\nclass = 0", fillcolor="#fcf3ec"] ; 328 | 161 -> 162 ; 329 | 163 [label="bin_3 <= 79.5\ngini = 0.4955\nsamples = 142\nvalue = [53, 23, 149]\nclass = 2", fillcolor="#b990f0"] ; 330 | 162 -> 163 ; 331 | 164 [label="flow_iat_min <= 5.5\ngini = 0.307\nsamples = 96\nvalue = [6, 22, 127]\nclass = 2", fillcolor="#9c63ea"] ; 332 | 163 -> 164 ; 333 | 165 [label="pkt_size_max <= 1526.0\ngini = 0.4898\nsamples = 3\nvalue = [4, 0, 3]\nclass = 0", fillcolor="#f8e0ce"] ; 334 | 164 -> 165 ; 335 | 166 [label="gini = 0.0\nsamples = 2\nvalue = [0, 0, 3]\nclass = 2", fillcolor="#8139e5"] ; 336 | 165 -> 166 ; 337 | 167 [label="gini = 0.0\nsamples = 1\nvalue = [4, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 338 | 165 -> 167 ; 339 | 168 [label="pkt_size_avg <= 855.5\ngini = 0.2757\nsamples = 93\nvalue = [2, 22, 124]\nclass = 2", fillcolor="#995fea"] ; 340 | 164 -> 168 ; 341 | 169 [label="gini = 0.4204\nsamples = 45\nvalue = [2, 19, 53]\nclass = 2", fillcolor="#b185ef"] ; 342 | 168 -> 169 ; 343 | 170 [label="gini = 0.0778\nsamples = 48\nvalue = [0, 3, 71]\nclass = 2", fillcolor="#8641e6"] ; 344 | 168 -> 170 ; 345 | 171 [label="pkt_size_max <= 1496.0\ngini = 0.4502\nsamples = 46\nvalue = [47, 1, 22]\nclass = 0", fillcolor="#f1bd98"] ; 346 | 163 -> 171 ; 347 | 172 [label="pkt_size_var_approx <= 430176.0\ngini = 0.0997\nsamples = 14\nvalue = [18, 0, 1]\nclass = 0", fillcolor="#e68844"] ; 348 | 171 -> 172 ; 349 | 173 [label="gini = 0.0\nsamples = 13\nvalue = [18, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 350 | 172 -> 173 ; 351 | 174 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 1]\nclass = 2", fillcolor="#8139e5"] ; 352 | 172 -> 174 ; 353 | 175 [label="pkt_size_avg <= 883.5\ngini = 0.5067\nsamples = 32\nvalue = [29, 1, 21]\nclass = 0", fillcolor="#f8ddca"] ; 354 | 171 -> 175 ; 355 | 176 [label="gini = 0.4731\nsamples = 29\nvalue = [29, 1, 15]\nclass = 0", fillcolor="#f3c4a3"] ; 356 | 175 -> 176 ; 357 | 177 [label="gini = 0.0\nsamples = 3\nvalue = [0, 0, 6]\nclass = 2", fillcolor="#8139e5"] ; 358 | 175 -> 177 ; 359 | 178 [label="pkt_size_avg <= 867.5\ngini = 0.4371\nsamples = 116\nvalue = [135, 38, 15]\nclass = 0", fillcolor="#eeae7f"] ; 360 | 162 -> 178 ; 361 | 179 [label="pkt_size_max <= 2954.0\ngini = 0.5289\nsamples = 34\nvalue = [11, 31, 7]\nclass = 1", fillcolor="#97f1bd"] ; 362 | 178 -> 179 ; 363 | 180 [label="pkt_size_var_approx <= 672486.0\ngini = 0.5787\nsamples = 25\nvalue = [11, 20, 5]\nclass = 1", fillcolor="#b8f6d2"] ; 364 | 179 -> 180 ; 365 | 181 [label="gini = 0.5\nsamples = 20\nvalue = [5, 20, 5]\nclass = 1", fillcolor="#88efb3"] ; 366 | 180 -> 181 ; 367 | 182 [label="gini = 0.0\nsamples = 5\nvalue = [6, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 368 | 180 -> 182 ; 369 | 183 [label="pkt_size_avg <= 837.0\ngini = 0.2604\nsamples = 9\nvalue = [0, 11, 2]\nclass = 1", fillcolor="#5dea98"] ; 370 | 179 -> 183 ; 371 | 184 [label="gini = 0.0\nsamples = 7\nvalue = [0, 9, 0]\nclass = 1", fillcolor="#39e581"] ; 372 | 183 -> 184 ; 373 | 185 [label="gini = 0.5\nsamples = 2\nvalue = [0, 2, 2]\nclass = 1", fillcolor="#ffffff"] ; 374 | 183 -> 185 ; 375 | 186 [label="bin_3 <= 51.5\ngini = 0.1983\nsamples = 82\nvalue = [124, 7, 8]\nclass = 0", fillcolor="#e88f50"] ; 376 | 178 -> 186 ; 377 | 187 [label="pkt_size_var_approx <= 654428.0\ngini = 0.5812\nsamples = 21\nvalue = [20, 7, 8]\nclass = 0", fillcolor="#f3c7a7"] ; 378 | 186 -> 187 ; 379 | 188 [label="gini = 0.5952\nsamples = 11\nvalue = [2, 7, 8]\nclass = 2", fillcolor="#f2ebfc"] ; 380 | 187 -> 188 ; 381 | 189 [label="gini = 0.0\nsamples = 10\nvalue = [18, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 382 | 187 -> 189 ; 383 | 190 [label="gini = 0.0\nsamples = 61\nvalue = [104, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 384 | 186 -> 190 ; 385 | 191 [label="pkt_size_var_approx <= 688278.0\ngini = 0.0988\nsamples = 2145\nvalue = [3171, 110, 62]\nclass = 0", fillcolor="#e68844"] ; 386 | 161 -> 191 ; 387 | 192 [label="flow_iat_min <= 18.5\ngini = 0.4181\nsamples = 401\nvalue = [464, 108, 57]\nclass = 0", fillcolor="#eda978"] ; 388 | 191 -> 192 ; 389 | 193 [label="pkt_size_var_approx <= 427110.0\ngini = 0.5862\nsamples = 163\nvalue = [137, 77, 37]\nclass = 0", fillcolor="#f6d4bb"] ; 390 | 192 -> 193 ; 391 | 194 [label="pkt_size_min <= 46.0\ngini = 0.418\nsamples = 90\nvalue = [111, 17, 22]\nclass = 0", fillcolor="#eda775"] ; 392 | 193 -> 194 ; 393 | 195 [label="gini = 0.308\nsamples = 82\nvalue = [111, 13, 11]\nclass = 0", fillcolor="#ea9a60"] ; 394 | 194 -> 195 ; 395 | 196 [label="gini = 0.3911\nsamples = 8\nvalue = [0, 4, 11]\nclass = 2", fillcolor="#af81ee"] ; 396 | 194 -> 196 ; 397 | 197 [label="pkt_size_avg <= 896.5\ngini = 0.5588\nsamples = 73\nvalue = [26, 60, 15]\nclass = 1", fillcolor="#a5f3c6"] ; 398 | 193 -> 197 ; 399 | 198 [label="gini = 0.5478\nsamples = 63\nvalue = [19, 54, 15]\nclass = 1", fillcolor="#9bf2bf"] ; 400 | 197 -> 198 ; 401 | 199 [label="gini = 0.497\nsamples = 10\nvalue = [7, 6, 0]\nclass = 0", fillcolor="#fbede3"] ; 402 | 197 -> 199 ; 403 | 200 [label="pkt_size_avg <= 995.0\ngini = 0.2421\nsamples = 238\nvalue = [327, 31, 20]\nclass = 0", fillcolor="#e99456"] ; 404 | 192 -> 200 ; 405 | 201 [label="flow_iat_min <= 114.5\ngini = 0.1946\nsamples = 230\nvalue = [326, 31, 8]\nclass = 0", fillcolor="#e89050"] ; 406 | 200 -> 201 ; 407 | 202 [label="gini = 0.1736\nsamples = 228\nvalue = [326, 28, 6]\nclass = 0", fillcolor="#e88e4d"] ; 408 | 201 -> 202 ; 409 | 203 [label="gini = 0.48\nsamples = 2\nvalue = [0, 3, 2]\nclass = 1", fillcolor="#bdf6d5"] ; 410 | 201 -> 203 ; 411 | 204 [label="pkt_size_max <= 2216.0\ngini = 0.142\nsamples = 8\nvalue = [1, 0, 12]\nclass = 2", fillcolor="#8c49e7"] ; 412 | 200 -> 204 ; 413 | 205 [label="gini = 0.0\nsamples = 7\nvalue = [0, 0, 12]\nclass = 2", fillcolor="#8139e5"] ; 414 | 204 -> 205 ; 415 | 206 [label="gini = 0.0\nsamples = 1\nvalue = [1, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 416 | 204 -> 206 ; 417 | 207 [label="pkt_size_max <= 2922.0\ngini = 0.0051\nsamples = 1744\nvalue = [2707, 2, 5]\nclass = 0", fillcolor="#e5813a"] ; 418 | 191 -> 207 ; 419 | 208 [label="gini = 0.0\nsamples = 760\nvalue = [1162, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 420 | 207 -> 208 ; 421 | 209 [label="flow_iat_min <= 30.5\ngini = 0.009\nsamples = 984\nvalue = [1545, 2, 5]\nclass = 0", fillcolor="#e5823a"] ; 422 | 207 -> 209 ; 423 | 210 [label="pkt_size_max <= 2954.0\ngini = 0.0039\nsamples = 983\nvalue = [1545, 2, 1]\nclass = 0", fillcolor="#e58139"] ; 424 | 209 -> 210 ; 425 | 211 [label="gini = 0.0\nsamples = 665\nvalue = [1051, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 426 | 210 -> 211 ; 427 | 212 [label="gini = 0.012\nsamples = 318\nvalue = [494, 2, 1]\nclass = 0", fillcolor="#e5823a"] ; 428 | 210 -> 212 ; 429 | 213 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 4]\nclass = 2", fillcolor="#8139e5"] ; 430 | 209 -> 213 ; 431 | 214 [label="pkt_size_max <= 6116.0\ngini = 0.4628\nsamples = 836\nvalue = [6, 473, 859]\nclass = 2", fillcolor="#c7a7f3"] ; 432 | 110 -> 214 ; 433 | 215 [label="pkt_size_max <= 3113.0\ngini = 0.4772\nsamples = 249\nvalue = [6, 245, 138]\nclass = 1", fillcolor="#abf4c9"] ; 434 | 214 -> 215 ; 435 | 216 [label="gini = 0.0\nsamples = 28\nvalue = [0, 43, 0]\nclass = 1", fillcolor="#39e581"] ; 436 | 215 -> 216 ; 437 | 217 [label="pkt_size_var_approx <= 789434.0\ngini = 0.4998\nsamples = 221\nvalue = [6, 202, 138]\nclass = 1", fillcolor="#c2f7d8"] ; 438 | 215 -> 217 ; 439 | 218 [label="bin_3 <= 20.0\ngini = 0.3875\nsamples = 93\nvalue = [1, 103, 35]\nclass = 1", fillcolor="#7eeead"] ; 440 | 217 -> 218 ; 441 | 219 [label="pkt_size_avg <= 717.0\ngini = 0.32\nsamples = 13\nvalue = [0, 3, 12]\nclass = 2", fillcolor="#a06aec"] ; 442 | 218 -> 219 ; 443 | 220 [label="gini = 0.0\nsamples = 1\nvalue = [0, 1, 0]\nclass = 1", fillcolor="#39e581"] ; 444 | 219 -> 220 ; 445 | 221 [label="flow_iat_min <= 25.0\ngini = 0.2449\nsamples = 12\nvalue = [0, 2, 12]\nclass = 2", fillcolor="#965ae9"] ; 446 | 219 -> 221 ; 447 | 222 [label="gini = 0.142\nsamples = 11\nvalue = [0, 1, 12]\nclass = 2", fillcolor="#8c49e7"] ; 448 | 221 -> 222 ; 449 | 223 [label="gini = 0.0\nsamples = 1\nvalue = [0, 1, 0]\nclass = 1", fillcolor="#39e581"] ; 450 | 221 -> 223 ; 451 | 224 [label="pkt_size_avg <= 528.0\ngini = 0.3152\nsamples = 80\nvalue = [1, 100, 23]\nclass = 1", fillcolor="#68eb9f"] ; 452 | 218 -> 224 ; 453 | 225 [label="bin_3 <= 73.5\ngini = 0.426\nsamples = 18\nvalue = [0, 8, 18]\nclass = 2", fillcolor="#b991f1"] ; 454 | 224 -> 225 ; 455 | 226 [label="gini = 0.2907\nsamples = 11\nvalue = [0, 3, 14]\nclass = 2", fillcolor="#9c63eb"] ; 456 | 225 -> 226 ; 457 | 227 [label="gini = 0.4938\nsamples = 7\nvalue = [0, 5, 4]\nclass = 1", fillcolor="#d7fae6"] ; 458 | 225 -> 227 ; 459 | 228 [label="flow_iat_min <= 27.0\ngini = 0.116\nsamples = 62\nvalue = [1, 92, 5]\nclass = 1", fillcolor="#46e789"] ; 460 | 224 -> 228 ; 461 | 229 [label="gini = 0.0986\nsamples = 61\nvalue = [1, 92, 4]\nclass = 1", fillcolor="#44e688"] ; 462 | 228 -> 229 ; 463 | 230 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 1]\nclass = 2", fillcolor="#8139e5"] ; 464 | 228 -> 230 ; 465 | 231 [label="bin_3 <= 30.5\ngini = 0.5231\nsamples = 128\nvalue = [5, 99, 103]\nclass = 2", fillcolor="#faf8fe"] ; 466 | 217 -> 231 ; 467 | 232 [label="flow_iat_min <= 21.0\ngini = 0.3223\nsamples = 27\nvalue = [2, 38, 7]\nclass = 1", fillcolor="#66eb9d"] ; 468 | 231 -> 232 ; 469 | 233 [label="pkt_size_var_approx <= 1714863.0\ngini = 0.2594\nsamples = 23\nvalue = [2, 35, 4]\nclass = 1", fillcolor="#59e995"] ; 470 | 232 -> 233 ; 471 | 234 [label="gini = 0.1139\nsamples = 18\nvalue = [2, 31, 0]\nclass = 1", fillcolor="#46e789"] ; 472 | 233 -> 234 ; 473 | 235 [label="gini = 0.5\nsamples = 5\nvalue = [0, 4, 4]\nclass = 1", fillcolor="#ffffff"] ; 474 | 233 -> 235 ; 475 | 236 [label="bin_3 <= 28.5\ngini = 0.5\nsamples = 4\nvalue = [0, 3, 3]\nclass = 1", fillcolor="#ffffff"] ; 476 | 232 -> 236 ; 477 | 237 [label="gini = 0.375\nsamples = 3\nvalue = [0, 1, 3]\nclass = 2", fillcolor="#ab7bee"] ; 478 | 236 -> 237 ; 479 | 238 [label="gini = 0.0\nsamples = 1\nvalue = [0, 2, 0]\nclass = 1", fillcolor="#39e581"] ; 480 | 236 -> 238 ; 481 | 239 [label="flow_iat_min <= 23.5\ngini = 0.4943\nsamples = 101\nvalue = [3, 61, 96]\nclass = 2", fillcolor="#d2b9f6"] ; 482 | 231 -> 239 ; 483 | 240 [label="pkt_size_avg <= 1031.0\ngini = 0.5192\nsamples = 84\nvalue = [3, 59, 69]\nclass = 2", fillcolor="#eee3fb"] ; 484 | 239 -> 240 ; 485 | 241 [label="gini = 0.5228\nsamples = 73\nvalue = [3, 58, 49]\nclass = 1", fillcolor="#e2fbec"] ; 486 | 240 -> 241 ; 487 | 242 [label="gini = 0.0907\nsamples = 11\nvalue = [0, 1, 20]\nclass = 2", fillcolor="#8743e6"] ; 488 | 240 -> 242 ; 489 | 243 [label="flow_iat_min <= 25.5\ngini = 0.1284\nsamples = 17\nvalue = [0, 2, 27]\nclass = 2", fillcolor="#8a48e7"] ; 490 | 239 -> 243 ; 491 | 244 [label="gini = 0.2778\nsamples = 9\nvalue = [0, 2, 10]\nclass = 2", fillcolor="#9a61ea"] ; 492 | 243 -> 244 ; 493 | 245 [label="gini = 0.0\nsamples = 8\nvalue = [0, 0, 17]\nclass = 2", fillcolor="#8139e5"] ; 494 | 243 -> 245 ; 495 | 246 [label="bin_3 <= 14.5\ngini = 0.3651\nsamples = 587\nvalue = [0, 228, 721]\nclass = 2", fillcolor="#a978ed"] ; 496 | 214 -> 246 ; 497 | 247 [label="flow_iat_min <= 9.5\ngini = 0.2441\nsamples = 170\nvalue = [0, 38, 229]\nclass = 2", fillcolor="#965ae9"] ; 498 | 246 -> 247 ; 499 | 248 [label="bin_3 <= 1.5\ngini = 0.0991\nsamples = 97\nvalue = [0, 8, 145]\nclass = 2", fillcolor="#8844e6"] ; 500 | 247 -> 248 ; 501 | 249 [label="gini = 0.0\nsamples = 1\nvalue = [0, 2, 0]\nclass = 1", fillcolor="#39e581"] ; 502 | 248 -> 249 ; 503 | 250 [label="pkt_size_avg <= 1180.5\ngini = 0.0763\nsamples = 96\nvalue = [0, 6, 145]\nclass = 2", fillcolor="#8641e6"] ; 504 | 248 -> 250 ; 505 | 251 [label="bin_5 <= 0.5\ngini = 0.4688\nsamples = 8\nvalue = [0, 3, 5]\nclass = 2", fillcolor="#cdb0f5"] ; 506 | 250 -> 251 ; 507 | 252 [label="gini = 0.0\nsamples = 3\nvalue = [0, 0, 3]\nclass = 2", fillcolor="#8139e5"] ; 508 | 251 -> 252 ; 509 | 253 [label="gini = 0.48\nsamples = 5\nvalue = [0, 3, 2]\nclass = 1", fillcolor="#bdf6d5"] ; 510 | 251 -> 253 ; 511 | 254 [label="bin_5 <= 0.5\ngini = 0.0411\nsamples = 88\nvalue = [0, 3, 140]\nclass = 2", fillcolor="#843de6"] ; 512 | 250 -> 254 ; 513 | 255 [label="gini = 0.2112\nsamples = 16\nvalue = [0, 3, 22]\nclass = 2", fillcolor="#9254e9"] ; 514 | 254 -> 255 ; 515 | 256 [label="gini = 0.0\nsamples = 72\nvalue = [0, 0, 118]\nclass = 2", fillcolor="#8139e5"] ; 516 | 254 -> 256 ; 517 | 257 [label="pkt_size_var_approx <= 1059226.0\ngini = 0.3878\nsamples = 73\nvalue = [0, 30, 84]\nclass = 2", fillcolor="#ae80ee"] ; 518 | 247 -> 257 ; 519 | 258 [label="gini = 0.0\nsamples = 2\nvalue = [0, 4, 0]\nclass = 1", fillcolor="#39e581"] ; 520 | 257 -> 258 ; 521 | 259 [label="flow_iat_min <= 16.5\ngini = 0.361\nsamples = 71\nvalue = [0, 26, 84]\nclass = 2", fillcolor="#a876ed"] ; 522 | 257 -> 259 ; 523 | 260 [label="pkt_size_avg <= 1457.0\ngini = 0.4297\nsamples = 51\nvalue = [0, 25, 55]\nclass = 2", fillcolor="#ba93f1"] ; 524 | 259 -> 260 ; 525 | 261 [label="gini = 0.4745\nsamples = 19\nvalue = [0, 19, 12]\nclass = 1", fillcolor="#b6f5d1"] ; 526 | 260 -> 261 ; 527 | 262 [label="gini = 0.2149\nsamples = 32\nvalue = [0, 6, 43]\nclass = 2", fillcolor="#9355e9"] ; 528 | 260 -> 262 ; 529 | 263 [label="bin_3 <= 7.5\ngini = 0.0644\nsamples = 20\nvalue = [0, 1, 29]\nclass = 2", fillcolor="#8540e6"] ; 530 | 259 -> 263 ; 531 | 264 [label="gini = 0.1653\nsamples = 7\nvalue = [0, 1, 10]\nclass = 2", fillcolor="#8e4de8"] ; 532 | 263 -> 264 ; 533 | 265 [label="gini = 0.0\nsamples = 13\nvalue = [0, 0, 19]\nclass = 2", fillcolor="#8139e5"] ; 534 | 263 -> 265 ; 535 | 266 [label="bin_3 <= 151.5\ngini = 0.402\nsamples = 417\nvalue = [0, 190, 492]\nclass = 2", fillcolor="#b285ef"] ; 536 | 246 -> 266 ; 537 | 267 [label="pkt_size_avg <= 844.5\ngini = 0.4155\nsamples = 393\nvalue = [0, 189, 453]\nclass = 2", fillcolor="#b68cf0"] ; 538 | 266 -> 267 ; 539 | 268 [label="pkt_size_avg <= 839.5\ngini = 0.4976\nsamples = 63\nvalue = [0, 47, 54]\nclass = 2", fillcolor="#efe5fc"] ; 540 | 267 -> 268 ; 541 | 269 [label="pkt_size_max <= 7320.0\ngini = 0.4906\nsamples = 60\nvalue = [0, 41, 54]\nclass = 2", fillcolor="#e1cff9"] ; 542 | 268 -> 269 ; 543 | 270 [label="gini = 0.4996\nsamples = 49\nvalue = [0, 36, 38]\nclass = 2", fillcolor="#f8f5fe"] ; 544 | 269 -> 270 ; 545 | 271 [label="gini = 0.3628\nsamples = 11\nvalue = [0, 5, 16]\nclass = 2", fillcolor="#a877ed"] ; 546 | 269 -> 271 ; 547 | 272 [label="gini = 0.0\nsamples = 3\nvalue = [0, 6, 0]\nclass = 1", fillcolor="#39e581"] ; 548 | 268 -> 272 ; 549 | 273 [label="pkt_size_avg <= 875.5\ngini = 0.3872\nsamples = 330\nvalue = [0, 142, 399]\nclass = 2", fillcolor="#ae7fee"] ; 550 | 267 -> 273 ; 551 | 274 [label="gini = 0.0\nsamples = 12\nvalue = [0, 0, 24]\nclass = 2", fillcolor="#8139e5"] ; 552 | 273 -> 274 ; 553 | 275 [label="pkt_size_var_approx <= 4016141.5\ngini = 0.3984\nsamples = 318\nvalue = [0, 142, 375]\nclass = 2", fillcolor="#b184ef"] ; 554 | 273 -> 275 ; 555 | 276 [label="gini = 0.4278\nsamples = 229\nvalue = [0, 115, 256]\nclass = 2", fillcolor="#ba92f1"] ; 556 | 275 -> 276 ; 557 | 277 [label="gini = 0.3015\nsamples = 89\nvalue = [0, 27, 119]\nclass = 2", fillcolor="#9e66eb"] ; 558 | 275 -> 277 ; 559 | 278 [label="pkt_size_var_approx <= 973908.5\ngini = 0.0487\nsamples = 24\nvalue = [0, 1, 39]\nclass = 2", fillcolor="#843ee6"] ; 560 | 266 -> 278 ; 561 | 279 [label="gini = 0.0\nsamples = 1\nvalue = [0, 1, 0]\nclass = 1", fillcolor="#39e581"] ; 562 | 278 -> 279 ; 563 | 280 [label="gini = 0.0\nsamples = 23\nvalue = [0, 0, 39]\nclass = 2", fillcolor="#8139e5"] ; 564 | 278 -> 280 ; 565 | } -------------------------------------------------------------------------------- /model_generation/models/class_flow_phase_512pkt_1rf_0.dot: -------------------------------------------------------------------------------- 1 | digraph Tree { 2 | node [shape=box, style="filled, rounded", color="black", fontname=helvetica] ; 3 | edge [fontname=helvetica] ; 4 | 0 [label="pkt_size_avg <= 182.5\ngini = 0.6587\nsamples = 5329\nvalue = [3357, 2287, 2828]\nclass = 0", fillcolor="#fdf3ec"] ; 5 | 1 [label="pkt_size_max <= 311.0\ngini = 0.0748\nsamples = 1102\nvalue = [1, 68, 1705]\nclass = 2", fillcolor="#8641e6"] ; 6 | 0 -> 1 [labeldistance=2.5, labelangle=45, headlabel="True"] ; 7 | 2 [label="flow_iat_min <= 96.5\ngini = 0.0512\nsamples = 1060\nvalue = [1, 44, 1668]\nclass = 2", fillcolor="#843ee6"] ; 8 | 1 -> 2 ; 9 | 3 [label="pkt_size_max <= 191.5\ngini = 0.1833\nsamples = 30\nvalue = [0, 44, 5]\nclass = 1", fillcolor="#50e88f"] ; 10 | 2 -> 3 ; 11 | 4 [label="pkt_size_min <= 59.0\ngini = 0.0832\nsamples = 29\nvalue = [0, 44, 2]\nclass = 1", fillcolor="#42e687"] ; 12 | 3 -> 4 ; 13 | 5 [label="gini = 0.0\nsamples = 28\nvalue = [0, 44, 0]\nclass = 1", fillcolor="#39e581"] ; 14 | 4 -> 5 ; 15 | 6 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 2]\nclass = 2", fillcolor="#8139e5"] ; 16 | 4 -> 6 ; 17 | 7 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 3]\nclass = 2", fillcolor="#8139e5"] ; 18 | 3 -> 7 ; 19 | 8 [label="pkt_size_min <= 76.0\ngini = 0.0012\nsamples = 1030\nvalue = [1, 0, 1663]\nclass = 2", fillcolor="#8139e5"] ; 20 | 2 -> 8 ; 21 | 9 [label="gini = 0.0\nsamples = 1029\nvalue = [0, 0, 1663]\nclass = 2", fillcolor="#8139e5"] ; 22 | 8 -> 9 ; 23 | 10 [label="gini = 0.0\nsamples = 1\nvalue = [1, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 24 | 8 -> 10 ; 25 | 11 [label="pkt_size_min <= 50.0\ngini = 0.4773\nsamples = 42\nvalue = [0, 24, 37]\nclass = 2", fillcolor="#d3b9f6"] ; 26 | 1 -> 11 ; 27 | 12 [label="bin_3 <= 157.0\ngini = 0.0768\nsamples = 17\nvalue = [0, 24, 1]\nclass = 1", fillcolor="#41e686"] ; 28 | 11 -> 12 ; 29 | 13 [label="pkt_size_var_approx <= 7340.5\ngini = 0.2188\nsamples = 5\nvalue = [0, 7, 1]\nclass = 1", fillcolor="#55e993"] ; 30 | 12 -> 13 ; 31 | 14 [label="gini = 0.0\nsamples = 3\nvalue = [0, 5, 0]\nclass = 1", fillcolor="#39e581"] ; 32 | 13 -> 14 ; 33 | 15 [label="flow_iat_min <= 52.0\ngini = 0.4444\nsamples = 2\nvalue = [0, 2, 1]\nclass = 1", fillcolor="#9cf2c0"] ; 34 | 13 -> 15 ; 35 | 16 [label="gini = 0.0\nsamples = 1\nvalue = [0, 2, 0]\nclass = 1", fillcolor="#39e581"] ; 36 | 15 -> 16 ; 37 | 17 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 1]\nclass = 2", fillcolor="#8139e5"] ; 38 | 15 -> 17 ; 39 | 18 [label="gini = 0.0\nsamples = 12\nvalue = [0, 17, 0]\nclass = 1", fillcolor="#39e581"] ; 40 | 12 -> 18 ; 41 | 19 [label="gini = 0.0\nsamples = 25\nvalue = [0, 0, 36]\nclass = 2", fillcolor="#8139e5"] ; 42 | 11 -> 19 ; 43 | 20 [label="pkt_size_max <= 1469.0\ngini = 0.6111\nsamples = 4227\nvalue = [3356, 2219, 1123]\nclass = 0", fillcolor="#f8dfcd"] ; 44 | 0 -> 20 [labeldistance=2.5, labelangle=-45, headlabel="False"] ; 45 | 21 [label="pkt_size_var_approx <= 56835.5\ngini = 0.266\nsamples = 1066\nvalue = [174, 1430, 80]\nclass = 1", fillcolor="#5ae996"] ; 46 | 20 -> 21 ; 47 | 22 [label="gini = 0.0\nsamples = 718\nvalue = [0, 1119, 0]\nclass = 1", fillcolor="#39e581"] ; 48 | 21 -> 22 ; 49 | 23 [label="pkt_size_var_approx <= 443022.0\ngini = 0.5821\nsamples = 348\nvalue = [174, 311, 80]\nclass = 1", fillcolor="#baf6d3"] ; 50 | 21 -> 23 ; 51 | 24 [label="bin_5 <= 5.5\ngini = 0.6038\nsamples = 304\nvalue = [168, 245, 73]\nclass = 1", fillcolor="#cff9e0"] ; 52 | 23 -> 24 ; 53 | 25 [label="flow_iat_min <= 95.0\ngini = 0.6102\nsamples = 261\nvalue = [165, 197, 61]\nclass = 1", fillcolor="#e6fcef"] ; 54 | 24 -> 25 ; 55 | 26 [label="pkt_size_min <= 44.0\ngini = 0.6101\nsamples = 194\nvalue = [165, 101, 57]\nclass = 0", fillcolor="#f8dbc6"] ; 56 | 25 -> 26 ; 57 | 27 [label="pkt_size_avg <= 327.0\ngini = 0.4718\nsamples = 88\nvalue = [99, 18, 26]\nclass = 0", fillcolor="#efb083"] ; 58 | 26 -> 27 ; 59 | 28 [label="gini = 0.0\nsamples = 4\nvalue = [0, 7, 0]\nclass = 1", fillcolor="#39e581"] ; 60 | 27 -> 28 ; 61 | 29 [label="bin_5 <= 0.5\ngini = 0.427\nsamples = 84\nvalue = [99, 11, 26]\nclass = 0", fillcolor="#eeab7c"] ; 62 | 27 -> 29 ; 63 | 30 [label="gini = 0.5917\nsamples = 8\nvalue = [4, 2, 7]\nclass = 2", fillcolor="#d5bdf6"] ; 64 | 29 -> 30 ; 65 | 31 [label="gini = 0.3742\nsamples = 76\nvalue = [95, 9, 19]\nclass = 0", fillcolor="#eca36e"] ; 66 | 29 -> 31 ; 67 | 32 [label="pkt_size_min <= 50.0\ngini = 0.6233\nsamples = 106\nvalue = [66, 83, 31]\nclass = 1", fillcolor="#e1fbec"] ; 68 | 26 -> 32 ; 69 | 33 [label="gini = 0.0\nsamples = 20\nvalue = [0, 37, 0]\nclass = 1", fillcolor="#39e581"] ; 70 | 32 -> 33 ; 71 | 34 [label="bin_5 <= 1.5\ngini = 0.6365\nsamples = 86\nvalue = [66, 46, 31]\nclass = 0", fillcolor="#fae5d6"] ; 72 | 32 -> 34 ; 73 | 35 [label="gini = 0.5736\nsamples = 62\nvalue = [58, 24, 18]\nclass = 0", fillcolor="#f3c7a6"] ; 74 | 34 -> 35 ; 75 | 36 [label="gini = 0.6122\nsamples = 24\nvalue = [8, 22, 13]\nclass = 1", fillcolor="#c4f7d9"] ; 76 | 34 -> 36 ; 77 | 37 [label="pkt_size_min <= 73.0\ngini = 0.0768\nsamples = 67\nvalue = [0, 96, 4]\nclass = 1", fillcolor="#41e686"] ; 78 | 25 -> 37 ; 79 | 38 [label="gini = 0.0\nsamples = 3\nvalue = [0, 0, 4]\nclass = 2", fillcolor="#8139e5"] ; 80 | 37 -> 38 ; 81 | 39 [label="gini = 0.0\nsamples = 64\nvalue = [0, 96, 0]\nclass = 1", fillcolor="#39e581"] ; 82 | 37 -> 39 ; 83 | 40 [label="pkt_size_max <= 1463.0\ngini = 0.381\nsamples = 43\nvalue = [3, 48, 12]\nclass = 1", fillcolor="#73eda6"] ; 84 | 24 -> 40 ; 85 | 41 [label="pkt_size_max <= 1456.0\ngini = 0.5277\nsamples = 29\nvalue = [3, 23, 12]\nclass = 1", fillcolor="#abf4ca"] ; 86 | 40 -> 41 ; 87 | 42 [label="pkt_size_var_approx <= 65950.0\ngini = 0.4199\nsamples = 27\nvalue = [1, 23, 8]\nclass = 1", fillcolor="#83efb0"] ; 88 | 41 -> 42 ; 89 | 43 [label="gini = 0.0\nsamples = 2\nvalue = [0, 0, 3]\nclass = 2", fillcolor="#8139e5"] ; 90 | 42 -> 43 ; 91 | 44 [label="pkt_size_max <= 590.5\ngini = 0.3401\nsamples = 25\nvalue = [1, 23, 5]\nclass = 1", fillcolor="#6aeca0"] ; 92 | 42 -> 44 ; 93 | 45 [label="gini = 0.4734\nsamples = 10\nvalue = [0, 8, 5]\nclass = 1", fillcolor="#b5f5d0"] ; 94 | 44 -> 45 ; 95 | 46 [label="gini = 0.1172\nsamples = 15\nvalue = [1, 15, 0]\nclass = 1", fillcolor="#46e789"] ; 96 | 44 -> 46 ; 97 | 47 [label="pkt_size_max <= 1459.0\ngini = 0.4444\nsamples = 2\nvalue = [2, 0, 4]\nclass = 2", fillcolor="#c09cf2"] ; 98 | 41 -> 47 ; 99 | 48 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 4]\nclass = 2", fillcolor="#8139e5"] ; 100 | 47 -> 48 ; 101 | 49 [label="gini = 0.0\nsamples = 1\nvalue = [2, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 102 | 47 -> 49 ; 103 | 50 [label="gini = 0.0\nsamples = 14\nvalue = [0, 25, 0]\nclass = 1", fillcolor="#39e581"] ; 104 | 40 -> 50 ; 105 | 51 [label="bin_3 <= 78.0\ngini = 0.2884\nsamples = 44\nvalue = [6, 66, 7]\nclass = 1", fillcolor="#5dea98"] ; 106 | 23 -> 51 ; 107 | 52 [label="pkt_size_avg <= 879.5\ngini = 0.4861\nsamples = 7\nvalue = [5, 0, 7]\nclass = 2", fillcolor="#dbc6f8"] ; 108 | 51 -> 52 ; 109 | 53 [label="bin_3 <= 50.0\ngini = 0.4082\nsamples = 5\nvalue = [5, 0, 2]\nclass = 0", fillcolor="#efb388"] ; 110 | 52 -> 53 ; 111 | 54 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 2]\nclass = 2", fillcolor="#8139e5"] ; 112 | 53 -> 54 ; 113 | 55 [label="gini = 0.0\nsamples = 4\nvalue = [5, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 114 | 53 -> 55 ; 115 | 56 [label="gini = 0.0\nsamples = 2\nvalue = [0, 0, 5]\nclass = 2", fillcolor="#8139e5"] ; 116 | 52 -> 56 ; 117 | 57 [label="pkt_size_max <= 1421.0\ngini = 0.0294\nsamples = 37\nvalue = [1, 66, 0]\nclass = 1", fillcolor="#3ce583"] ; 118 | 51 -> 57 ; 119 | 58 [label="gini = 0.0\nsamples = 1\nvalue = [1, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 120 | 57 -> 58 ; 121 | 59 [label="gini = 0.0\nsamples = 36\nvalue = [0, 66, 0]\nclass = 1", fillcolor="#39e581"] ; 122 | 57 -> 59 ; 123 | 60 [label="pkt_size_max <= 2964.0\ngini = 0.5292\nsamples = 3161\nvalue = [3182, 789, 1043]\nclass = 0", fillcolor="#f1bb94"] ; 124 | 20 -> 60 ; 125 | 61 [label="bin_5 <= 1.5\ngini = 0.2724\nsamples = 2379\nvalue = [3175, 289, 289]\nclass = 0", fillcolor="#e9965a"] ; 126 | 60 -> 61 ; 127 | 62 [label="pkt_size_var_approx <= 593659.0\ngini = 0.6249\nsamples = 354\nvalue = [251, 96, 217]\nclass = 0", fillcolor="#fcf3ec"] ; 128 | 61 -> 62 ; 129 | 63 [label="bin_3 <= 51.0\ngini = 0.6091\nsamples = 264\nvalue = [97, 96, 217]\nclass = 2", fillcolor="#cfb3f5"] ; 130 | 62 -> 63 ; 131 | 64 [label="pkt_size_avg <= 974.0\ngini = 0.4115\nsamples = 113\nvalue = [13, 34, 134]\nclass = 2", fillcolor="#a978ed"] ; 132 | 63 -> 64 ; 133 | 65 [label="pkt_size_avg <= 473.5\ngini = 0.3826\nsamples = 110\nvalue = [13, 28, 134]\nclass = 2", fillcolor="#a470ec"] ; 134 | 64 -> 65 ; 135 | 66 [label="pkt_size_avg <= 338.0\ngini = 0.6281\nsamples = 7\nvalue = [5, 4, 2]\nclass = 0", fillcolor="#fbede3"] ; 136 | 65 -> 66 ; 137 | 67 [label="gini = 0.0\nsamples = 1\nvalue = [0, 4, 0]\nclass = 1", fillcolor="#39e581"] ; 138 | 66 -> 67 ; 139 | 68 [label="gini = 0.4082\nsamples = 6\nvalue = [5, 0, 2]\nclass = 0", fillcolor="#efb388"] ; 140 | 66 -> 68 ; 141 | 69 [label="flow_iat_min <= 27.0\ngini = 0.3284\nsamples = 103\nvalue = [8, 24, 132]\nclass = 2", fillcolor="#9e66eb"] ; 142 | 65 -> 69 ; 143 | 70 [label="gini = 0.4122\nsamples = 74\nvalue = [8, 22, 85]\nclass = 2", fillcolor="#aa79ed"] ; 144 | 69 -> 70 ; 145 | 71 [label="gini = 0.0783\nsamples = 29\nvalue = [0, 2, 47]\nclass = 2", fillcolor="#8641e6"] ; 146 | 69 -> 71 ; 147 | 72 [label="gini = 0.0\nsamples = 3\nvalue = [0, 6, 0]\nclass = 1", fillcolor="#39e581"] ; 148 | 64 -> 72 ; 149 | 73 [label="pkt_size_min <= 46.0\ngini = 0.6608\nsamples = 151\nvalue = [84, 62, 83]\nclass = 0", fillcolor="#fffefe"] ; 150 | 63 -> 73 ; 151 | 74 [label="pkt_size_max <= 1962.5\ngini = 0.555\nsamples = 58\nvalue = [8, 50, 31]\nclass = 1", fillcolor="#bef6d6"] ; 152 | 73 -> 74 ; 153 | 75 [label="pkt_size_avg <= 511.5\ngini = 0.5696\nsamples = 33\nvalue = [6, 16, 28]\nclass = 2", fillcolor="#d3b9f6"] ; 154 | 74 -> 75 ; 155 | 76 [label="gini = 0.2778\nsamples = 8\nvalue = [2, 10, 0]\nclass = 1", fillcolor="#61ea9a"] ; 156 | 75 -> 76 ; 157 | 77 [label="gini = 0.4211\nsamples = 25\nvalue = [4, 6, 28]\nclass = 2", fillcolor="#a877ed"] ; 158 | 75 -> 77 ; 159 | 78 [label="pkt_size_var_approx <= 231184.5\ngini = 0.2314\nsamples = 25\nvalue = [2, 34, 3]\nclass = 1", fillcolor="#54e992"] ; 160 | 74 -> 78 ; 161 | 79 [label="gini = 0.6111\nsamples = 5\nvalue = [2, 1, 3]\nclass = 2", fillcolor="#e0cef8"] ; 162 | 78 -> 79 ; 163 | 80 [label="gini = 0.0\nsamples = 20\nvalue = [0, 33, 0]\nclass = 1", fillcolor="#39e581"] ; 164 | 78 -> 80 ; 165 | 81 [label="flow_iat_min <= 38.5\ngini = 0.56\nsamples = 93\nvalue = [76, 12, 52]\nclass = 0", fillcolor="#f8ddc9"] ; 166 | 73 -> 81 ; 167 | 82 [label="pkt_size_max <= 1706.0\ngini = 0.5915\nsamples = 72\nvalue = [47, 12, 50]\nclass = 2", fillcolor="#f9f5fe"] ; 168 | 81 -> 82 ; 169 | 83 [label="gini = 0.5836\nsamples = 35\nvalue = [11, 11, 29]\nclass = 2", fillcolor="#c6a6f3"] ; 170 | 82 -> 83 ; 171 | 84 [label="gini = 0.4834\nsamples = 37\nvalue = [36, 1, 21]\nclass = 0", fillcolor="#f4ccaf"] ; 172 | 82 -> 84 ; 173 | 85 [label="flow_iat_min <= 92.5\ngini = 0.1207\nsamples = 21\nvalue = [29, 0, 2]\nclass = 0", fillcolor="#e78a47"] ; 174 | 81 -> 85 ; 175 | 86 [label="gini = 0.0\nsamples = 20\nvalue = [29, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 176 | 85 -> 86 ; 177 | 87 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 2]\nclass = 2", fillcolor="#8139e5"] ; 178 | 85 -> 87 ; 179 | 88 [label="gini = 0.0\nsamples = 90\nvalue = [154, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 180 | 62 -> 88 ; 181 | 89 [label="pkt_size_min <= 46.0\ngini = 0.1551\nsamples = 2025\nvalue = [2924, 193, 72]\nclass = 0", fillcolor="#e78c4b"] ; 182 | 61 -> 89 ; 183 | 90 [label="pkt_size_var_approx <= 632211.5\ngini = 0.0953\nsamples = 1933\nvalue = [2889, 114, 37]\nclass = 0", fillcolor="#e68843"] ; 184 | 89 -> 90 ; 185 | 91 [label="bin_3 <= 98.5\ngini = 0.3862\nsamples = 386\nvalue = [469, 111, 37]\nclass = 0", fillcolor="#eda673"] ; 186 | 90 -> 91 ; 187 | 92 [label="pkt_size_max <= 2952.0\ngini = 0.2679\nsamples = 328\nvalue = [454, 49, 32]\nclass = 0", fillcolor="#e9965a"] ; 188 | 91 -> 92 ; 189 | 93 [label="pkt_size_avg <= 898.0\ngini = 0.2194\nsamples = 315\nvalue = [452, 32, 30]\nclass = 0", fillcolor="#e89152"] ; 190 | 92 -> 93 ; 191 | 94 [label="gini = 0.1602\nsamples = 296\nvalue = [438, 19, 22]\nclass = 0", fillcolor="#e78c4b"] ; 192 | 93 -> 94 ; 193 | 95 [label="gini = 0.6498\nsamples = 19\nvalue = [14, 13, 8]\nclass = 0", fillcolor="#fef9f6"] ; 194 | 93 -> 95 ; 195 | 96 [label="flow_iat_min <= 8.0\ngini = 0.3265\nsamples = 13\nvalue = [2, 17, 2]\nclass = 1", fillcolor="#63ea9c"] ; 196 | 92 -> 96 ; 197 | 97 [label="gini = 0.4444\nsamples = 2\nvalue = [0, 1, 2]\nclass = 2", fillcolor="#c09cf2"] ; 198 | 96 -> 97 ; 199 | 98 [label="gini = 0.1975\nsamples = 11\nvalue = [2, 16, 0]\nclass = 1", fillcolor="#52e891"] ; 200 | 96 -> 98 ; 201 | 99 [label="flow_iat_min <= 7.5\ngini = 0.3911\nsamples = 58\nvalue = [15, 62, 5]\nclass = 1", fillcolor="#74eda7"] ; 202 | 91 -> 99 ; 203 | 100 [label="bin_3 <= 166.5\ngini = 0.42\nsamples = 6\nvalue = [7, 3, 0]\nclass = 0", fillcolor="#f0b78e"] ; 204 | 99 -> 100 ; 205 | 101 [label="gini = 0.2188\nsamples = 5\nvalue = [7, 1, 0]\nclass = 0", fillcolor="#e99355"] ; 206 | 100 -> 101 ; 207 | 102 [label="gini = 0.0\nsamples = 1\nvalue = [0, 2, 0]\nclass = 1", fillcolor="#39e581"] ; 208 | 100 -> 102 ; 209 | 103 [label="bin_3 <= 126.5\ngini = 0.3113\nsamples = 52\nvalue = [8, 59, 5]\nclass = 1", fillcolor="#61ea9b"] ; 210 | 99 -> 103 ; 211 | 104 [label="gini = 0.5216\nsamples = 28\nvalue = [8, 21, 4]\nclass = 1", fillcolor="#98f1bd"] ; 212 | 103 -> 104 ; 213 | 105 [label="gini = 0.05\nsamples = 24\nvalue = [0, 38, 1]\nclass = 1", fillcolor="#3ee684"] ; 214 | 103 -> 105 ; 215 | 106 [label="pkt_size_var_approx <= 714787.0\ngini = 0.0025\nsamples = 1547\nvalue = [2420, 3, 0]\nclass = 0", fillcolor="#e58139"] ; 216 | 90 -> 106 ; 217 | 107 [label="pkt_size_var_approx <= 713124.0\ngini = 0.1454\nsamples = 24\nvalue = [35, 3, 0]\nclass = 0", fillcolor="#e78c4a"] ; 218 | 106 -> 107 ; 219 | 108 [label="pkt_size_var_approx <= 707300.5\ngini = 0.054\nsamples = 23\nvalue = [35, 1, 0]\nclass = 0", fillcolor="#e6853f"] ; 220 | 107 -> 108 ; 221 | 109 [label="gini = 0.0\nsamples = 19\nvalue = [29, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 222 | 108 -> 109 ; 223 | 110 [label="gini = 0.2449\nsamples = 4\nvalue = [6, 1, 0]\nclass = 0", fillcolor="#e9965a"] ; 224 | 108 -> 110 ; 225 | 111 [label="gini = 0.0\nsamples = 1\nvalue = [0, 2, 0]\nclass = 1", fillcolor="#39e581"] ; 226 | 107 -> 111 ; 227 | 112 [label="gini = 0.0\nsamples = 1523\nvalue = [2385, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 228 | 106 -> 112 ; 229 | 113 [label="pkt_size_max <= 1490.0\ngini = 0.6085\nsamples = 92\nvalue = [35, 79, 35]\nclass = 1", fillcolor="#b3f5ce"] ; 230 | 89 -> 113 ; 231 | 114 [label="flow_iat_min <= 39.5\ngini = 0.1528\nsamples = 10\nvalue = [0, 1, 11]\nclass = 2", fillcolor="#8c4be7"] ; 232 | 113 -> 114 ; 233 | 115 [label="gini = 0.0\nsamples = 1\nvalue = [0, 1, 0]\nclass = 1", fillcolor="#39e581"] ; 234 | 114 -> 115 ; 235 | 116 [label="gini = 0.0\nsamples = 9\nvalue = [0, 0, 11]\nclass = 2", fillcolor="#8139e5"] ; 236 | 114 -> 116 ; 237 | 117 [label="pkt_size_avg <= 972.0\ngini = 0.5799\nsamples = 82\nvalue = [35, 78, 24]\nclass = 1", fillcolor="#acf4ca"] ; 238 | 113 -> 117 ; 239 | 118 [label="bin_5 <= 4.5\ngini = 0.5595\nsamples = 79\nvalue = [28, 78, 24]\nclass = 1", fillcolor="#9ef2c1"] ; 240 | 117 -> 118 ; 241 | 119 [label="pkt_size_var_approx <= 104258.0\ngini = 0.657\nsamples = 40\nvalue = [24, 29, 19]\nclass = 1", fillcolor="#eafcf2"] ; 242 | 118 -> 119 ; 243 | 120 [label="gini = 0.4592\nsamples = 8\nvalue = [0, 9, 5]\nclass = 1", fillcolor="#a7f3c7"] ; 244 | 119 -> 120 ; 245 | 121 [label="gini = 0.6516\nsamples = 32\nvalue = [24, 20, 14]\nclass = 0", fillcolor="#fcf2ea"] ; 246 | 119 -> 121 ; 247 | 122 [label="bin_5 <= 8.5\ngini = 0.2741\nsamples = 39\nvalue = [4, 49, 5]\nclass = 1", fillcolor="#5be996"] ; 248 | 118 -> 122 ; 249 | 123 [label="gini = 0.4537\nsamples = 23\nvalue = [4, 22, 5]\nclass = 1", fillcolor="#7eeead"] ; 250 | 122 -> 123 ; 251 | 124 [label="gini = 0.0\nsamples = 16\nvalue = [0, 27, 0]\nclass = 1", fillcolor="#39e581"] ; 252 | 122 -> 124 ; 253 | 125 [label="gini = 0.0\nsamples = 3\nvalue = [7, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 254 | 117 -> 125 ; 255 | 126 [label="pkt_size_max <= 5976.0\ngini = 0.4852\nsamples = 782\nvalue = [7, 500, 754]\nclass = 2", fillcolor="#d5bdf6"] ; 256 | 60 -> 126 ; 257 | 127 [label="flow_iat_min <= 24.5\ngini = 0.4011\nsamples = 217\nvalue = [7, 253, 85]\nclass = 1", fillcolor="#7feeae"] ; 258 | 126 -> 127 ; 259 | 128 [label="flow_iat_min <= 8.5\ngini = 0.3681\nsamples = 211\nvalue = [4, 253, 75]\nclass = 1", fillcolor="#76eda8"] ; 260 | 127 -> 128 ; 261 | 129 [label="pkt_size_max <= 5864.0\ngini = 0.4978\nsamples = 26\nvalue = [0, 24, 21]\nclass = 1", fillcolor="#e6fcef"] ; 262 | 128 -> 129 ; 263 | 130 [label="bin_5 <= 2.5\ngini = 0.4844\nsamples = 20\nvalue = [0, 14, 20]\nclass = 2", fillcolor="#d9c4f7"] ; 264 | 129 -> 130 ; 265 | 131 [label="pkt_size_max <= 4408.0\ngini = 0.1172\nsamples = 11\nvalue = [0, 1, 15]\nclass = 2", fillcolor="#8946e7"] ; 266 | 130 -> 131 ; 267 | 132 [label="gini = 0.2778\nsamples = 5\nvalue = [0, 1, 5]\nclass = 2", fillcolor="#9a61ea"] ; 268 | 131 -> 132 ; 269 | 133 [label="gini = 0.0\nsamples = 6\nvalue = [0, 0, 10]\nclass = 2", fillcolor="#8139e5"] ; 270 | 131 -> 133 ; 271 | 134 [label="pkt_size_avg <= 540.0\ngini = 0.4012\nsamples = 9\nvalue = [0, 13, 5]\nclass = 1", fillcolor="#85efb1"] ; 272 | 130 -> 134 ; 273 | 135 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 3]\nclass = 2", fillcolor="#8139e5"] ; 274 | 134 -> 135 ; 275 | 136 [label="gini = 0.2311\nsamples = 8\nvalue = [0, 13, 2]\nclass = 1", fillcolor="#57e994"] ; 276 | 134 -> 136 ; 277 | 137 [label="bin_5 <= 5.0\ngini = 0.1653\nsamples = 6\nvalue = [0, 10, 1]\nclass = 1", fillcolor="#4de88e"] ; 278 | 129 -> 137 ; 279 | 138 [label="pkt_size_avg <= 882.0\ngini = 0.2778\nsamples = 4\nvalue = [0, 5, 1]\nclass = 1", fillcolor="#61ea9a"] ; 280 | 137 -> 138 ; 281 | 139 [label="gini = 0.0\nsamples = 3\nvalue = [0, 5, 0]\nclass = 1", fillcolor="#39e581"] ; 282 | 138 -> 139 ; 283 | 140 [label="gini = 0.0\nsamples = 1\nvalue = [0, 0, 1]\nclass = 2", fillcolor="#8139e5"] ; 284 | 138 -> 140 ; 285 | 141 [label="gini = 0.0\nsamples = 2\nvalue = [0, 5, 0]\nclass = 1", fillcolor="#39e581"] ; 286 | 137 -> 141 ; 287 | 142 [label="pkt_size_var_approx <= 180334.5\ngini = 0.3277\nsamples = 185\nvalue = [4, 229, 54]\nclass = 1", fillcolor="#6aeba0"] ; 288 | 128 -> 142 ; 289 | 143 [label="gini = 0.0\nsamples = 6\nvalue = [0, 0, 6]\nclass = 2", fillcolor="#8139e5"] ; 290 | 142 -> 143 ; 291 | 144 [label="pkt_size_var_approx <= 966586.0\ngini = 0.3065\nsamples = 179\nvalue = [4, 229, 48]\nclass = 1", fillcolor="#65eb9d"] ; 292 | 142 -> 144 ; 293 | 145 [label="pkt_size_var_approx <= 495335.5\ngini = 0.2298\nsamples = 140\nvalue = [4, 188, 24]\nclass = 1", fillcolor="#56e993"] ; 294 | 144 -> 145 ; 295 | 146 [label="gini = 0.4234\nsamples = 32\nvalue = [0, 32, 14]\nclass = 1", fillcolor="#90f0b8"] ; 296 | 145 -> 146 ; 297 | 147 [label="gini = 0.1539\nsamples = 108\nvalue = [4, 156, 10]\nclass = 1", fillcolor="#4ae78c"] ; 298 | 145 -> 147 ; 299 | 148 [label="pkt_size_var_approx <= 1667227.0\ngini = 0.4658\nsamples = 39\nvalue = [0, 41, 24]\nclass = 1", fillcolor="#adf4cb"] ; 300 | 144 -> 148 ; 301 | 149 [label="gini = 0.48\nsamples = 37\nvalue = [0, 36, 24]\nclass = 1", fillcolor="#bdf6d5"] ; 302 | 148 -> 149 ; 303 | 150 [label="gini = 0.0\nsamples = 2\nvalue = [0, 5, 0]\nclass = 1", fillcolor="#39e581"] ; 304 | 148 -> 150 ; 305 | 151 [label="pkt_size_var_approx <= 622589.0\ngini = 0.355\nsamples = 6\nvalue = [3, 0, 10]\nclass = 2", fillcolor="#a774ed"] ; 306 | 127 -> 151 ; 307 | 152 [label="gini = 0.0\nsamples = 1\nvalue = [3, 0, 0]\nclass = 0", fillcolor="#e58139"] ; 308 | 151 -> 152 ; 309 | 153 [label="gini = 0.0\nsamples = 5\nvalue = [0, 0, 10]\nclass = 2", fillcolor="#8139e5"] ; 310 | 151 -> 153 ; 311 | 154 [label="pkt_size_var_approx <= 8183042.5\ngini = 0.3939\nsamples = 565\nvalue = [0, 247, 669]\nclass = 2", fillcolor="#b082ef"] ; 312 | 126 -> 154 ; 313 | 155 [label="flow_iat_min <= 17.5\ngini = 0.4336\nsamples = 481\nvalue = [0, 245, 526]\nclass = 2", fillcolor="#bc95f1"] ; 314 | 154 -> 155 ; 315 | 156 [label="pkt_size_avg <= 864.5\ngini = 0.4606\nsamples = 349\nvalue = [0, 205, 365]\nclass = 2", fillcolor="#c8a8f4"] ; 316 | 155 -> 156 ; 317 | 157 [label="flow_iat_min <= 10.5\ngini = 0.489\nsamples = 60\nvalue = [0, 58, 43]\nclass = 1", fillcolor="#ccf8de"] ; 318 | 156 -> 157 ; 319 | 158 [label="bin_5 <= 4.5\ngini = 0.3995\nsamples = 16\nvalue = [0, 8, 21]\nclass = 2", fillcolor="#b184ef"] ; 320 | 157 -> 158 ; 321 | 159 [label="gini = 0.1049\nsamples = 9\nvalue = [0, 1, 17]\nclass = 2", fillcolor="#8845e7"] ; 322 | 158 -> 159 ; 323 | 160 [label="gini = 0.4628\nsamples = 7\nvalue = [0, 7, 4]\nclass = 1", fillcolor="#aaf4c9"] ; 324 | 158 -> 160 ; 325 | 161 [label="pkt_size_var_approx <= 548006.0\ngini = 0.4244\nsamples = 44\nvalue = [0, 50, 22]\nclass = 1", fillcolor="#90f0b8"] ; 326 | 157 -> 161 ; 327 | 162 [label="gini = 0.0\nsamples = 3\nvalue = [0, 0, 4]\nclass = 2", fillcolor="#8139e5"] ; 328 | 161 -> 162 ; 329 | 163 [label="gini = 0.3893\nsamples = 41\nvalue = [0, 50, 18]\nclass = 1", fillcolor="#80eeae"] ; 330 | 161 -> 163 ; 331 | 164 [label="flow_iat_min <= 6.5\ngini = 0.4304\nsamples = 289\nvalue = [0, 147, 322]\nclass = 2", fillcolor="#bb93f1"] ; 332 | 156 -> 164 ; 333 | 165 [label="bin_5 <= 11.5\ngini = 0.3047\nsamples = 53\nvalue = [0, 18, 78]\nclass = 2", fillcolor="#9e67eb"] ; 334 | 164 -> 165 ; 335 | 166 [label="gini = 0.2449\nsamples = 52\nvalue = [0, 13, 78]\nclass = 2", fillcolor="#965ae9"] ; 336 | 165 -> 166 ; 337 | 167 [label="gini = 0.0\nsamples = 1\nvalue = [0, 5, 0]\nclass = 1", fillcolor="#39e581"] ; 338 | 165 -> 167 ; 339 | 168 [label="bin_3 <= 305.5\ngini = 0.4525\nsamples = 236\nvalue = [0, 129, 244]\nclass = 2", fillcolor="#c4a2f3"] ; 340 | 164 -> 168 ; 341 | 169 [label="gini = 0.4587\nsamples = 228\nvalue = [0, 129, 233]\nclass = 2", fillcolor="#c7a7f3"] ; 342 | 168 -> 169 ; 343 | 170 [label="gini = 0.0\nsamples = 8\nvalue = [0, 0, 11]\nclass = 2", fillcolor="#8139e5"] ; 344 | 168 -> 170 ; 345 | 171 [label="pkt_size_var_approx <= 1077428.0\ngini = 0.3188\nsamples = 132\nvalue = [0, 40, 161]\nclass = 2", fillcolor="#a06aeb"] ; 346 | 155 -> 171 ; 347 | 172 [label="gini = 0.0\nsamples = 4\nvalue = [0, 5, 0]\nclass = 1", fillcolor="#39e581"] ; 348 | 171 -> 172 ; 349 | 173 [label="pkt_size_var_approx <= 2633171.0\ngini = 0.2934\nsamples = 128\nvalue = [0, 35, 161]\nclass = 2", fillcolor="#9c64eb"] ; 350 | 171 -> 173 ; 351 | 174 [label="bin_5 <= 5.5\ngini = 0.2127\nsamples = 80\nvalue = [0, 15, 109]\nclass = 2", fillcolor="#9254e9"] ; 352 | 173 -> 174 ; 353 | 175 [label="gini = 0.2604\nsamples = 61\nvalue = [0, 14, 77]\nclass = 2", fillcolor="#985dea"] ; 354 | 174 -> 175 ; 355 | 176 [label="gini = 0.0588\nsamples = 19\nvalue = [0, 1, 32]\nclass = 2", fillcolor="#853fe6"] ; 356 | 174 -> 176 ; 357 | 177 [label="bin_5 <= 1.5\ngini = 0.4012\nsamples = 48\nvalue = [0, 20, 52]\nclass = 2", fillcolor="#b185ef"] ; 358 | 173 -> 177 ; 359 | 178 [label="gini = 0.4932\nsamples = 29\nvalue = [0, 19, 24]\nclass = 2", fillcolor="#e5d6fa"] ; 360 | 177 -> 178 ; 361 | 179 [label="gini = 0.0666\nsamples = 19\nvalue = [0, 1, 28]\nclass = 2", fillcolor="#8640e6"] ; 362 | 177 -> 179 ; 363 | 180 [label="pkt_size_max <= 20424.0\ngini = 0.0272\nsamples = 84\nvalue = [0, 2, 143]\nclass = 2", fillcolor="#833ce5"] ; 364 | 154 -> 180 ; 365 | 181 [label="gini = 0.0\nsamples = 51\nvalue = [0, 0, 78]\nclass = 2", fillcolor="#8139e5"] ; 366 | 180 -> 181 ; 367 | 182 [label="bin_3 <= 4.5\ngini = 0.0579\nsamples = 33\nvalue = [0, 2, 65]\nclass = 2", fillcolor="#853fe6"] ; 368 | 180 -> 182 ; 369 | 183 [label="flow_iat_min <= 5.5\ngini = 0.1653\nsamples = 10\nvalue = [0, 2, 20]\nclass = 2", fillcolor="#8e4de8"] ; 370 | 182 -> 183 ; 371 | 184 [label="pkt_size_avg <= 1977.5\ngini = 0.2778\nsamples = 5\nvalue = [0, 2, 10]\nclass = 2", fillcolor="#9a61ea"] ; 372 | 183 -> 184 ; 373 | 185 [label="gini = 0.4444\nsamples = 3\nvalue = [0, 2, 4]\nclass = 2", fillcolor="#c09cf2"] ; 374 | 184 -> 185 ; 375 | 186 [label="gini = 0.0\nsamples = 2\nvalue = [0, 0, 6]\nclass = 2", fillcolor="#8139e5"] ; 376 | 184 -> 186 ; 377 | 187 [label="gini = 0.0\nsamples = 5\nvalue = [0, 0, 10]\nclass = 2", fillcolor="#8139e5"] ; 378 | 183 -> 187 ; 379 | 188 [label="gini = 0.0\nsamples = 23\nvalue = [0, 0, 45]\nclass = 2", fillcolor="#8139e5"] ; 380 | 182 -> 188 ; 381 | } -------------------------------------------------------------------------------- /model_generation/models/flow_size_predict_1xgb.txt: -------------------------------------------------------------------------------- 1 | booster[0]: 2 | 0:[udp_length<39] yes=1,no=2,missing=1 3 | 1:[total_len<59] yes=3,no=4,missing=3 4 | 3:[ttl<128] yes=7,no=8,missing=7 5 | 7:[tcp_window<3] yes=15,no=16,missing=15 6 | 15:[total_len<43] yes=31,no=32,missing=31 7 | 31:[ttl<73] yes=59,no=60,missing=59 8 | 59:[ttl<49] yes=113,no=114,missing=113 9 | 113:[ttl<47] yes=209,no=210,missing=209 10 | 209:leaf=-0.550411046 11 | 210:leaf=-0.462878793 12 | 114:leaf=-0.575516701 13 | 60:[ttl<122] yes=115,no=116,missing=115 14 | 115:[udp_length<13] yes=211,no=212,missing=211 15 | 211:leaf=-0.33374685 16 | 212:leaf=-0.563029587 17 | 116:leaf=0.507692337 18 | 32:[udp_length<29] yes=61,no=62,missing=61 19 | 61:[total_len<48] yes=117,no=118,missing=117 20 | 117:[ttl<103] yes=213,no=214,missing=213 21 | 213:leaf=0.40359956 22 | 214:leaf=-0.376470625 23 | 118:[ttl<52] yes=215,no=216,missing=215 24 | 215:leaf=0.440884024 25 | 216:leaf=0.559657753 26 | 62:[total_len<57] yes=119,no=120,missing=119 27 | 119:[total_len<56] yes=217,no=218,missing=217 28 | 217:leaf=-0.372496903 29 | 218:leaf=-0.12100251 30 | 120:[ttl<113] yes=219,no=220,missing=219 31 | 219:leaf=0.30791831 32 | 220:leaf=0.386606872 33 | 16:[tcp_window<5860] yes=33,no=34,missing=33 34 | 33:[tcp_window<4950] yes=63,no=64,missing=63 35 | 63:[total_len<51] yes=121,no=122,missing=121 36 | 121:[ttl<49] yes=221,no=222,missing=221 37 | 221:leaf=0.450148672 38 | 222:leaf=0.591092527 39 | 122:leaf=0.598782539 40 | 64:[ttl<49] yes=123,no=124,missing=123 41 | 123:[diffserv<4] yes=223,no=224,missing=223 42 | 223:leaf=0.160096586 43 | 224:leaf=0.344510347 44 | 124:[diffserv<144] yes=225,no=226,missing=225 45 | 225:leaf=0.466498107 46 | 226:leaf=-0.335433066 47 | 34:[ttl<52] yes=65,no=66,missing=65 48 | 65:[ttl<51] yes=125,no=126,missing=125 49 | 125:[ttl<46] yes=227,no=228,missing=227 50 | 227:leaf=0.584097147 51 | 228:leaf=0.553819358 52 | 126:[diffserv<40] yes=229,no=230,missing=229 53 | 229:leaf=0.565535307 54 | 230:leaf=-0.127659589 55 | 66:[tcp_window<65340] yes=127,no=128,missing=127 56 | 127:[tcp_window<65336] yes=231,no=232,missing=231 57 | 231:leaf=0.584374666 58 | 232:leaf=-0.116666675 59 | 128:[ttl<96] yes=233,no=234,missing=233 60 | 233:leaf=0.380357176 61 | 234:leaf=0.592826128 62 | 8:[total_len<42] yes=17,no=18,missing=17 63 | 17:[tcp_window<35] yes=35,no=36,missing=35 64 | 35:[total_len<33] yes=67,no=68,missing=67 65 | 67:[total_len<31] yes=129,no=130,missing=129 66 | 129:leaf=-0.0886956602 67 | 130:leaf=0.287372023 68 | 68:[proto<12] yes=131,no=132,missing=131 69 | 131:[ttl<155] yes=235,no=236,missing=235 70 | 235:leaf=0.283587456 71 | 236:leaf=-0.58005178 72 | 132:leaf=-0.584334254 73 | 36:[ttl<233] yes=69,no=70,missing=69 74 | 69:[tcp_window<65359] yes=133,no=134,missing=133 75 | 133:[tcp_window<65098] yes=237,no=238,missing=237 76 | 237:leaf=0.552246511 77 | 238:leaf=0.199022979 78 | 134:[tcp_window<65525] yes=239,no=240,missing=239 79 | 239:leaf=0.594930232 80 | 240:leaf=0.549384117 81 | 70:[tcp_window<65535] yes=135,no=136,missing=135 82 | 135:[ttl<234] yes=241,no=242,missing=241 83 | 241:leaf=-0.041295547 84 | 242:leaf=0.501098931 85 | 136:[ttl<236] yes=243,no=244,missing=243 86 | 243:leaf=-0.542222261 87 | 244:leaf=-0.37570098 88 | 18:[total_len<57] yes=37,no=38,missing=37 89 | 37:[tcp_dataOffset<8] yes=71,no=72,missing=71 90 | 71:[udp_length<29] yes=137,no=138,missing=137 91 | 137:[total_len<49] yes=245,no=246,missing=245 92 | 245:leaf=-0.0488223657 93 | 246:leaf=0.598845065 94 | 138:[total_len<56] yes=247,no=248,missing=247 95 | 247:leaf=-0.256723732 96 | 248:leaf=-0.464714587 97 | 72:[tcp_window<65364] yes=139,no=140,missing=139 98 | 139:[tcp_window<65124] yes=249,no=250,missing=249 99 | 249:leaf=0.564935088 100 | 250:leaf=0.376991183 101 | 140:leaf=0.582148194 102 | 38:[proto<12] yes=73,no=74,missing=73 103 | 73:leaf=0.574342132 104 | 74:[total_len<58] yes=141,no=142,missing=141 105 | 141:leaf=-0.314999998 106 | 142:[ttl<152] yes=251,no=252,missing=251 107 | 251:leaf=0.326752692 108 | 252:leaf=0.370297015 109 | 4:[tcp_window<3] yes=9,no=10,missing=9 110 | 9:[ttl<110] yes=19,no=20,missing=19 111 | 19:leaf=0.450000018 112 | 20:leaf=-0.597238243 113 | 10:[tcp_window<65535] yes=21,no=22,missing=21 114 | 21:[tcp_dataOffset<11] yes=39,no=40,missing=39 115 | 39:leaf=0.598185778 116 | 40:[total_len<108] yes=75,no=76,missing=75 117 | 75:[tcp_window<65148] yes=143,no=144,missing=143 118 | 143:leaf=0.543341458 119 | 144:leaf=0.272727281 120 | 76:leaf=-0 121 | 22:[ttl<26] yes=41,no=42,missing=41 122 | 41:[ttl<12] yes=77,no=78,missing=77 123 | 77:leaf=-0.296000004 124 | 78:leaf=-0.550000012 125 | 42:[total_len<109] yes=79,no=80,missing=79 126 | 79:[total_len<108] yes=145,no=146,missing=145 127 | 145:[tcp_dataOffset<9] yes=253,no=254,missing=253 128 | 253:leaf=0.596066833 129 | 254:leaf=0.575236142 130 | 146:[ttl<128] yes=255,no=256,missing=255 131 | 255:leaf=0.596615314 132 | 256:leaf=0.504109919 133 | 80:leaf=0.594027162 134 | 2:[total_len<354] yes=5,no=6,missing=5 135 | 5:[total_len<97] yes=11,no=12,missing=11 136 | 11:[total_len<95] yes=23,no=24,missing=23 137 | 23:[total_len<70] yes=43,no=44,missing=43 138 | 43:[ttl<118] yes=81,no=82,missing=81 139 | 81:[total_len<66] yes=147,no=148,missing=147 140 | 147:[total_len<61] yes=257,no=258,missing=257 141 | 257:leaf=-0.557489932 142 | 258:leaf=-0.291369975 143 | 148:[total_len<68] yes=259,no=260,missing=259 144 | 259:leaf=-0.4848921 145 | 260:leaf=-0.554080248 146 | 82:[total_len<63] yes=149,no=150,missing=149 147 | 149:[total_len<61] yes=261,no=262,missing=261 148 | 261:leaf=-0.455335975 149 | 262:leaf=0.565591455 150 | 150:[total_len<64] yes=263,no=264,missing=263 151 | 263:leaf=-0.516011775 152 | 264:leaf=-0.316643894 153 | 44:[total_len<71] yes=83,no=84,missing=83 154 | 83:[ttl<116] yes=151,no=152,missing=151 155 | 151:[ttl<113] yes=265,no=266,missing=265 156 | 265:leaf=-0.0545374267 157 | 266:leaf=-0.00408781227 158 | 152:[ttl<154] yes=267,no=268,missing=267 159 | 267:leaf=0.0651093796 160 | 268:leaf=-0.388235331 161 | 84:[total_len<73] yes=153,no=154,missing=153 162 | 153:[ttl<123] yes=269,no=270,missing=269 163 | 269:leaf=-0.46931538 164 | 270:leaf=-0.508080244 165 | 154:[total_len<74] yes=271,no=272,missing=271 166 | 271:leaf=0.00139274925 167 | 272:leaf=-0.248634845 168 | 24:[ttl<64] yes=45,no=46,missing=45 169 | 45:[total_len<96] yes=85,no=86,missing=85 170 | 85:[ttl<47] yes=155,no=156,missing=155 171 | 155:[diffserv<49] yes=273,no=274,missing=273 172 | 273:leaf=0.242996752 173 | 274:leaf=-0.360000014 174 | 156:[diffserv<44] yes=275,no=276,missing=275 175 | 275:leaf=-0.193043485 176 | 276:leaf=0.0837209374 177 | 86:[ttl<15] yes=157,no=158,missing=157 178 | 157:leaf=-0 179 | 158:leaf=0.521739125 180 | 46:[diffserv<2] yes=87,no=88,missing=87 181 | 87:[total_len<96] yes=159,no=160,missing=159 182 | 159:[ttl<128] yes=277,no=278,missing=277 183 | 277:leaf=0.215094343 184 | 278:leaf=0.352146506 185 | 160:[ttl<122] yes=279,no=280,missing=279 186 | 279:leaf=0.561445832 187 | 280:leaf=0.291208535 188 | 88:[total_len<96] yes=161,no=162,missing=161 189 | 161:[ttl<112] yes=281,no=282,missing=281 190 | 281:leaf=0.305309743 191 | 282:leaf=0.259903401 192 | 162:leaf=0.555555582 193 | 12:[total_len<315] yes=25,no=26,missing=25 194 | 25:[total_len<127] yes=47,no=48,missing=47 195 | 47:[total_len<126] yes=89,no=90,missing=89 196 | 89:[total_len<116] yes=163,no=164,missing=163 197 | 163:[total_len<100] yes=283,no=284,missing=283 198 | 283:leaf=-0.39633128 199 | 284:leaf=-0.300343335 200 | 164:[total_len<117] yes=285,no=286,missing=285 201 | 285:leaf=0.591124892 202 | 286:leaf=-0.0587156005 203 | 90:[ttl<126] yes=165,no=166,missing=165 204 | 165:[ttl<53] yes=287,no=288,missing=287 205 | 287:leaf=-0.56375289 206 | 288:leaf=-0.590832531 207 | 166:[ttl<176] yes=289,no=290,missing=289 208 | 289:leaf=0.433333337 209 | 290:leaf=-0.592258096 210 | 48:[total_len<130] yes=91,no=92,missing=91 211 | 91:[ttl<49] yes=167,no=168,missing=167 212 | 167:[ttl<45] yes=291,no=292,missing=291 213 | 291:leaf=0.0199152548 214 | 292:leaf=0.119241521 215 | 168:[ttl<107] yes=293,no=294,missing=293 216 | 293:leaf=-0.11459481 217 | 294:leaf=-0.048880212 218 | 92:[total_len<132] yes=169,no=170,missing=169 219 | 169:[total_len<131] yes=295,no=296,missing=295 220 | 295:leaf=-0.339360386 221 | 296:leaf=-0.453932643 222 | 170:[total_len<266] yes=297,no=298,missing=297 223 | 297:leaf=-0.269364476 224 | 298:leaf=-0.394893736 225 | 26:[total_len<323] yes=49,no=50,missing=49 226 | 49:[total_len<319] yes=93,no=94,missing=93 227 | 93:[total_len<316] yes=171,no=172,missing=171 228 | 171:[diffserv<16] yes=299,no=300,missing=299 229 | 299:leaf=-0.487688661 230 | 300:leaf=-0.430185974 231 | 172:[diffserv<24] yes=301,no=302,missing=301 232 | 301:leaf=0.343448281 233 | 302:leaf=-0.300000012 234 | 94:[total_len<320] yes=173,no=174,missing=173 235 | 173:[ttl<110] yes=303,no=304,missing=303 236 | 303:leaf=-0 237 | 304:leaf=-0.592124283 238 | 174:[total_len<322] yes=305,no=306,missing=305 239 | 305:leaf=-0 240 | 306:leaf=-0.421338171 241 | 50:[total_len<344] yes=95,no=96,missing=95 242 | 95:[ttl<109] yes=175,no=176,missing=175 243 | 175:[ttl<50] yes=307,no=308,missing=307 244 | 307:leaf=-0.453846157 245 | 308:leaf=-0.304743081 246 | 176:[diffserv<49] yes=309,no=310,missing=309 247 | 309:leaf=-0.180517808 248 | 310:leaf=0.339130431 249 | 96:[total_len<346] yes=177,no=178,missing=177 250 | 177:[ttl<235] yes=311,no=312,missing=311 251 | 311:leaf=-0.391976655 252 | 312:leaf=0.428571463 253 | 178:[ttl<115] yes=313,no=314,missing=313 254 | 313:leaf=0.0614457838 255 | 314:leaf=-0.257765234 256 | 6:[udp_length<812] yes=13,no=14,missing=13 257 | 13:[total_len<396] yes=27,no=28,missing=27 258 | 27:[total_len<361] yes=51,no=52,missing=51 259 | 51:[diffserv<24] yes=97,no=98,missing=97 260 | 97:[total_len<357] yes=179,no=180,missing=179 261 | 179:[ttl<110] yes=315,no=316,missing=315 262 | 315:leaf=-0.0666666701 263 | 316:leaf=0.272727281 264 | 180:[total_len<360] yes=317,no=318,missing=317 265 | 317:leaf=0.557042837 266 | 318:leaf=0.367346942 267 | 98:[total_len<360] yes=181,no=182,missing=181 268 | 181:[total_len<357] yes=319,no=320,missing=319 269 | 319:leaf=-0.0967741981 270 | 320:leaf=0.317647099 271 | 182:leaf=-0.300000012 272 | 52:[total_len<364] yes=99,no=100,missing=99 273 | 99:[total_len<363] yes=183,no=184,missing=183 274 | 183:[ttl<122] yes=321,no=322,missing=321 275 | 321:leaf=-0.432558149 276 | 322:leaf=0.220253184 277 | 184:leaf=-0.394130915 278 | 100:[ttl<34] yes=185,no=186,missing=185 279 | 185:leaf=0.564179122 280 | 186:[diffserv<4] yes=323,no=324,missing=323 281 | 323:leaf=-0.0232465547 282 | 324:leaf=-0.168813556 283 | 28:[total_len<399] yes=53,no=54,missing=53 284 | 53:[total_len<398] yes=101,no=102,missing=101 285 | 101:[ttl<106] yes=187,no=188,missing=187 286 | 187:leaf=-0 287 | 188:[ttl<110] yes=325,no=326,missing=325 288 | 325:leaf=0.400000036 289 | 326:leaf=0.169230789 290 | 102:leaf=0.598099887 291 | 54:[total_len<559] yes=103,no=104,missing=103 292 | 103:[ttl<123] yes=189,no=190,missing=189 293 | 189:[total_len<422] yes=327,no=328,missing=327 294 | 327:leaf=-0.291737616 295 | 328:leaf=-0.147358671 296 | 190:[total_len<547] yes=329,no=330,missing=329 297 | 329:leaf=0.0471262634 298 | 330:leaf=-0.294163436 299 | 104:[ttl<124] yes=191,no=192,missing=191 300 | 191:[total_len<761] yes=331,no=332,missing=331 301 | 331:leaf=0.518877387 302 | 332:leaf=-0.336945832 303 | 192:[ttl<154] yes=333,no=334,missing=333 304 | 333:leaf=0.185531929 305 | 334:leaf=0.537391305 306 | 14:[udp_length<1349] yes=29,no=30,missing=29 307 | 29:[total_len<993] yes=55,no=56,missing=55 308 | 55:[total_len<943] yes=105,no=106,missing=105 309 | 105:[ttl<103] yes=193,no=194,missing=193 310 | 193:[total_len<923] yes=335,no=336,missing=335 311 | 335:leaf=-0.554518998 312 | 336:leaf=-0.389473706 313 | 194:[ttl<123] yes=337,no=338,missing=337 314 | 337:leaf=-0.116587684 315 | 338:leaf=0.0612529032 316 | 106:[diffserv<44] yes=195,no=196,missing=195 317 | 195:[total_len<985] yes=339,no=340,missing=339 318 | 339:leaf=-0.345772624 319 | 340:leaf=-0.45259589 320 | 196:[total_len<991] yes=341,no=342,missing=341 321 | 341:leaf=0.0361445807 322 | 342:leaf=-0.440000027 323 | 56:[total_len<1051] yes=107,no=108,missing=107 324 | 107:[total_len<1033] yes=197,no=198,missing=197 325 | 197:[ttl<107] yes=343,no=344,missing=343 326 | 343:leaf=-0.346153855 327 | 344:leaf=0.00606060633 328 | 198:[ttl<111] yes=345,no=346,missing=345 329 | 345:leaf=0.437288165 330 | 346:leaf=-0.126315802 331 | 108:[total_len<1295] yes=199,no=200,missing=199 332 | 199:[ttl<111] yes=347,no=348,missing=347 333 | 347:leaf=-0.115294121 334 | 348:leaf=-0.325888336 335 | 200:[diffserv<16] yes=349,no=350,missing=349 336 | 349:leaf=-0.0600000024 337 | 350:leaf=-0.280608386 338 | 30:[ttl<117] yes=57,no=58,missing=57 339 | 57:[total_len<1429] yes=109,no=110,missing=109 340 | 109:[diffserv<40] yes=201,no=202,missing=201 341 | 201:[ttl<109] yes=351,no=352,missing=351 342 | 351:leaf=0.323076963 343 | 352:leaf=-0.00942408387 344 | 202:[ttl<107] yes=353,no=354,missing=353 345 | 353:leaf=0.0043795621 346 | 354:leaf=-0.152542382 347 | 110:[udp_length<1468] yes=203,no=204,missing=203 348 | 203:[total_len<1455] yes=355,no=356,missing=355 349 | 355:leaf=0.218037143 350 | 356:leaf=0.561600029 351 | 204:[ttl<102] yes=357,no=358,missing=357 352 | 357:leaf=0.400000036 353 | 358:leaf=-0.176470608 354 | 58:[total_len<1433] yes=111,no=112,missing=111 355 | 111:[total_len<1388] yes=205,no=206,missing=205 356 | 205:[total_len<1385] yes=359,no=360,missing=359 357 | 359:leaf=0.306976765 358 | 360:leaf=-0.0428571478 359 | 206:[total_len<1429] yes=361,no=362,missing=361 360 | 361:leaf=0.375561088 361 | 362:leaf=0.120000005 362 | 112:[diffserv<24] yes=207,no=208,missing=207 363 | 207:leaf=0.569620311 364 | 208:leaf=0.150000006 365 | -------------------------------------------------------------------------------- /model_generation/tree_to_table/rf.py: -------------------------------------------------------------------------------- 1 | from .utils import * 2 | 3 | 4 | 5 | # Get all the thresholds that appear in the tree 6 | def get_rf_feature_thres(model_file,keys,tree_num): 7 | # model_file: tree model file, keys: the list of features, tree_num: the number of trees 8 | feat_dict = {} 9 | for key in keys: 10 | feat_dict[key] = [] 11 | for i in range(tree_num): 12 | with open(model_file+'_{}.dot'.format(i), 'r') as f: 13 | lines = f.readlines() 14 | for line in lines: 15 | if "[" in line: 16 | m = re.search(r".*\[label=\"(.*?) <= (.*?)\\n.*",line.strip(), re.M|re.I) 17 | if m: 18 | feat_dict[m.group(1)].append(float(m.group(2))) 19 | for key in feat_dict.keys(): 20 | for i in range(len(feat_dict[key])): 21 | feat_dict[key][i] = int(feat_dict[key][i])+1 #rounding down, then adding 1 , because the node in rf is f<=a 22 | feat_dict[key] = list(np.unique(np.array(feat_dict[key]))) 23 | return feat_dict 24 | 25 | # Get the model table table entries 26 | def get_rf_trees_table_entries(model_file,keys,feat_dict,key_encode_bits,tree_num,pkts=None): 27 | # model_file: model file，feat_dict: the thresholds of each feature, key_encode_bits: range mark, 28 | # tree_num: the number of trees in the forest, pkts: the first few packets, optional 29 | # The return value is a list, each element represents a table item, the content is the range mark of each feature and the classification result 30 | tree_data = [] 31 | tree_leaves= []#Each row is a leaf node, recording that smallest threshold index in left subtree and smallest threshold index (negative) in right subtree on the path of that leaf node 32 | trees = [] 33 | leaf_index = [] 34 | leaf_info = [] 35 | trees.append(len(tree_leaves)) 36 | for i in range(tree_num): 37 | with open(model_file+'_{}.dot'.format(i), 'r') as f: 38 | lines = f.readlines() 39 | nodes = {} 40 | for j in range(len(lines)): 41 | line = lines[j] 42 | if "label=\"" in line and "->" not in line: 43 | if "[label=\"gini" in line or "[label=\"entropy" in line: 44 | m = re.search(r"(.*?) \[label=.*value = (.*?)\\nclass.*",line.strip(), re.M|re.I) 45 | nodes[m.group(1)] = {} 46 | nodes[m.group(1)]['path'] = [1000,0]*len(keys) # assumption that there are no more than 1000 different feature thresholds. 47 | leaf_info.append(list_to_proba(m.group(2))) 48 | leaf_index.append(int(m.group(1))) 49 | else: 50 | m = re.search(r"(.*?) \[label=\"(.*?) <= (.*?)\\n.*",line.strip(), re.M|re.I) 51 | nodes[m.group(1)] = {} 52 | nodes[m.group(1)]['info'] = [m.group(2),m.group(3)] #feat and threshold 53 | nodes[m.group(1)]['path'] = [1000,0]*len(keys) 54 | nodes[m.group(1)]['have_left'] = False 55 | if "->" in line: 56 | m = re.search(r"(.*?) -> (.*?) ",line.strip(), re.M|re.I) 57 | [feat,thre] = nodes[m.group(1)]['info'] 58 | thre = int(float(thre))+1 59 | nodes[m.group(2)]['path'] = nodes[m.group(1)]['path'].copy() 60 | if not nodes[m.group(1)]['have_left']: #left subtree 61 | nodes[m.group(2)]['path'][keys.index(feat)*2] = min(nodes[m.group(2)]['path'][keys.index(feat)*2], 62 | feat_dict[feat].index(thre)+1) 63 | nodes[m.group(1)]['have_left'] = True 64 | else: 65 | nodes[m.group(2)]['path'][keys.index(feat)*2+1] = min(nodes[m.group(2)]['path'][keys.index(feat)*2+1], 66 | -feat_dict[feat].index(thre)-1) 67 | if 'have_left' not in nodes[m.group(2)].keys(): #leaf node 68 | tree_leaves.append(nodes[m.group(2)]['path']) 69 | trees.append(len(tree_leaves)) 70 | 71 | print("trees: ",trees,len(leaf_info)) 72 | print("judge leaf conflict ...") 73 | loop_val = [] 74 | for i in range(len(trees))[:-1]: 75 | loop_val.append(range(trees[i],trees[i+1])) 76 | print(loop_val) 77 | for tup in product(*loop_val): 78 | 79 | flag = 0 80 | for f in range(len(keys)): #Check for conflicting feature values 81 | a = 1000; b=1000; 82 | for i in tup: 83 | a = min(tree_leaves[i][f*2],a) 84 | b = min(tree_leaves[i][f*2+1],b) 85 | if a+b <= 0: 86 | flag=1 87 | break 88 | # Semantic conflict check can be added here 89 | if flag==0: 90 | #print("-- ",tup,sigmoid(leafs[i]+leafs[j])) 91 | if pkts is None: 92 | tree_data.append([]) # 93 | else: 94 | tree_data.append([pkts]) 95 | for f in range(len(keys)): 96 | a = 1000; b=1000; 97 | for i in tup: 98 | a = min(tree_leaves[i][f*2],a) 99 | b = min(tree_leaves[i][f*2+1],b) 100 | key = keys[f] 101 | te = get_model_table_range_mark(key_encode_bits[key],a,b,len(feat_dict[key])) 102 | tree_data[-1].extend([int(get_value_mask(te,key_encode_bits[key])[0],2),int(get_value_mask(te,key_encode_bits[key])[1],2)]) # The value and mask of each feature 103 | leaf_sum = leaf_info[tup[0]].copy() 104 | for i in tup[1:]: 105 | for j in range(len(leaf_sum)): 106 | leaf_sum[j]+=leaf_info[i][j] 107 | tree_data[-1].append(np.array(leaf_sum)/len(tup)) # classification probabilities list 108 | #print(tup,np.max(leaf_sum)/len(tup)) 109 | return tree_data 110 | -------------------------------------------------------------------------------- /model_generation/tree_to_table/utils.py: -------------------------------------------------------------------------------- 1 | import re,math,time 2 | import numpy as np 3 | import pickle,json,math 4 | from itertools import product 5 | 6 | def find_next_split(minz,maxz): 7 | count=0 8 | while (minz>>count)&1==0 and (minz+(1<maxz: 11 | return 1<<(count-1) 12 | return 1<=a-1: 74 | result[n] = '1' 75 | else: 76 | result[n] ='*' 77 | return result 78 | 79 | trans = lambda x: list(map(float,x.strip('[').strip(']').split(','))) 80 | def list_to_proba(ll): #Turn the value in the rf leaf node into a probability 81 | ll = trans(ll) 82 | re = [] 83 | for i in ll: 84 | re.append(i/np.sum(ll)) 85 | return re 86 | 87 | # Get the feature table entries, including the key and action parameters 88 | def get_feature_table_entries(feat_dict,key_bits,key_encode_bits,pkts=None): 89 | # feat_dict: the threshold value of each feature, key_bits: the number of bits of the feature, key_encode_bits: the number of bits of the range mark, pkts: the number of pkts packets, optional 90 | # return value is a dict, key is feature, value is list, each item in the list is a table item in the corresponding feature table, including: [priority, value, mask, action parameter, (number of packets) 91 | feat_table_datas = {} 92 | for key in feat_dict.keys(): 93 | thres = feat_dict[key] 94 | feat_table = [] 95 | sum1 = 0 96 | priority = 1 97 | for i in range(len(thres)): 98 | best_start = 0 99 | best_end = 0 100 | min_entries = 100000 101 | end = thres[i] 102 | start_time = time.time() 103 | 104 | while (i!=len(thres)-1 and end0 else 0 107 | while start>=0: 108 | temp = range_to_tenary(start,end) 109 | now_entries = len(temp[0])+right_entries 110 | if now_entries1 and temp[1][0]-temp[1][1]<0: 115 | start+=temp[1][0]-temp[1][1] 116 | else: 117 | break 118 | 119 | if len(temp[0])>1 and temp[1][-1]-temp[1][-2]<0: 120 | end+=temp[1][-2]-temp[1][-1] 121 | else: 122 | break 123 | #print(min_entries,thres[i-1],thres[i],best_start,best_end) 124 | temp = range_to_tenary(thres[i],best_end) 125 | for j in range(len(temp[0])): 126 | feat_table.append([priority,temp[0][j],int(get_mask(key_bits[key],temp[1][j]),2), 127 | int(get_feature_table_range_mark(key_encode_bits[key],i+1,len(thres)),2)]) 128 | if pkts is not None: 129 | feat_table[-1].append(pkts) 130 | priority+=1 131 | temp = range_to_tenary(best_start,best_end) 132 | for j in range(len(temp[0])): 133 | feat_table.append([priority,temp[0][j],int(get_mask(key_bits[key],temp[1][j]),2), 134 | int(get_feature_table_range_mark(key_encode_bits[key],i,len(thres)),2)]) 135 | if pkts is not None: 136 | feat_table[-1].append(pkts) 137 | priority+=1 138 | 139 | sum1+=min_entries 140 | print("The entries of {} is {}.".format(key,len(feat_table))) 141 | feat_table_datas[key] = feat_table 142 | return feat_table_datas 143 | 144 | #Converting aggregate feature to table 145 | def get_bin_table(keys,bin_count_bits,QL=4): 146 | bin_table_data = [] 147 | mask_value = (((2**bin_count_bits)-1)>>QL)<=Register_Table_Size/2: #FIFO delete 54 | for i in range(10): #delete first 10 entries 55 | del_key = list(flow_info.keys())[i] 56 | 57 | del_data_dict = flow_info[del_key] 58 | #print(del_key,key1) 59 | 60 | del_flow_index_key_list.append(flow_index_table.make_key([ 61 | client.KeyTuple('hdr.ipv4.src_addr',del_data_dict['src_addr']), 62 | client.KeyTuple('hdr.ipv4.dst_addr',del_data_dict['dst_addr']), 63 | client.KeyTuple('ig_md.src_port',del_data_dict['src_port']), 64 | client.KeyTuple('ig_md.dst_port',del_data_dict['dst_port']), 65 | client.KeyTuple('hdr.ipv4.protocol',del_data_dict['protocol'])])) 66 | del_flow_index_key_list.append(flow_index_table.make_key([ 67 | client.KeyTuple('hdr.ipv4.src_addr',del_data_dict['dst_addr']), 68 | client.KeyTuple('hdr.ipv4.dst_addr',del_data_dict['src_addr']), 69 | client.KeyTuple('ig_md.src_port',del_data_dict['dst_port']), 70 | client.KeyTuple('ig_md.dst_port',del_data_dict['src_port']), 71 | client.KeyTuple('hdr.ipv4.protocol',del_data_dict['protocol'])])) 72 | flow_info.pop(del_key) 73 | flow_index_table.entry_del(target, del_flow_index_key_list) 74 | print("Del flow_result entry finished",len(flow_info)) 75 | 76 | 77 | flow_index_key_list.append(flow_index_table.make_key([ 78 | client.KeyTuple('hdr.ipv4.src_addr',data_dict['src_addr']), 79 | client.KeyTuple('hdr.ipv4.dst_addr',data_dict['dst_addr']), 80 | client.KeyTuple('ig_md.src_port',data_dict['src_port']), 81 | client.KeyTuple('ig_md.dst_port',data_dict['dst_port']), 82 | client.KeyTuple('hdr.ipv4.protocol',data_dict['protocol'])])) 83 | flow_index_data_list.append(flow_index_table.make_data([client.DataTuple('result', data_dict['result'])], 84 | "SwitchIngress.Set_flow_result")) 85 | #if (data_dict['src_port']!=data_dict['dst_port']): 86 | flow_index_key_list.append(flow_index_table.make_key([ 87 | client.KeyTuple('hdr.ipv4.src_addr',data_dict['dst_addr']), 88 | client.KeyTuple('hdr.ipv4.dst_addr',data_dict['src_addr']), 89 | client.KeyTuple('ig_md.src_port',data_dict['dst_port']), 90 | client.KeyTuple('ig_md.dst_port',data_dict['src_port']), 91 | client.KeyTuple('hdr.ipv4.protocol',data_dict['protocol'])])) 92 | flow_index_data_list.append(flow_index_table.make_data([client.DataTuple('result', data_dict['result'])], 93 | "SwitchIngress.Set_flow_result")) 94 | 95 | flow_index_table.entry_add(target, flow_index_key_list, flow_index_data_list) 96 | flow_info[key1] = data_dict 97 | print("Add flow_result entry finished ".format(len(flow_info))) 98 | 99 | def receive_digest(): 100 | print("receive_digest......") 101 | signal.signal(signal.SIGINT, quit) 102 | signal.signal(signal.SIGTERM, quit) 103 | count = 0 104 | start_time = time.time() 105 | while True: 106 | digest = None 107 | try: 108 | digest = GRPC_CLIENT.digest_get() 109 | except KeyboardInterrupt: 110 | break 111 | except Exception as e: 112 | if 'Digest list not received' not in str(e): 113 | print('Unexpected error receiving digest - [%s]', e) 114 | 115 | if digest: 116 | data_list = learn_filter.make_data_list(digest) 117 | if not data_list or len(data_list) == 0: 118 | data_list = learn_filter.make_data_list(digest) 119 | for data_item in data_list: 120 | data_dict = data_item.to_dict() 121 | #print(data_dict) 122 | add_tb_entry_flow_result(data_dict) 123 | 124 | def load_tb_bin(table_data): 125 | print("load_bin_tb_Feat.......") 126 | for i in range(len(table_data)): 127 | table_name = "pkt_bin{}".format(i+1) 128 | update_action_name = "Update_bin{}".format(i+1) 129 | read_action_name = "Read_bin{}".format(i+1) 130 | tcam_table = bfrt_info.table_get(table_name) 131 | key_list = [tcam_table.make_key([client.KeyTuple('$MATCH_PRIORITY', 1), 132 | client.KeyTuple('hdr.ipv4.total_len',table_data[i][0],table_data[i][1])]), 133 | tcam_table.make_key([client.KeyTuple('$MATCH_PRIORITY', 2), 134 | client.KeyTuple('hdr.ipv4.total_len',0,0)])]#match anything 135 | data_list = [tcam_table.make_data([],update_action_name), 136 | tcam_table.make_data([],read_action_name)] 137 | tcam_table.entry_add(target, key_list, data_list) 138 | 139 | table_name = "Init_bin{}_table".format(i+1) 140 | update_action_name = "Init1_bin{}".format(i+1) 141 | read_action_name = "Init0_bin{}".format(i+1) 142 | tcam_table = bfrt_info.table_get(table_name) 143 | key_list = [tcam_table.make_key([client.KeyTuple('$MATCH_PRIORITY', 1), 144 | client.KeyTuple('hdr.ipv4.total_len',table_data[i][0],table_data[i][1])]), 145 | tcam_table.make_key([client.KeyTuple('$MATCH_PRIORITY', 2), 146 | client.KeyTuple('hdr.ipv4.total_len',0,0)])] 147 | data_list = [tcam_table.make_data([],update_action_name), 148 | tcam_table.make_data([],read_action_name)] 149 | tcam_table.entry_add(target, key_list, data_list) 150 | 151 | 152 | 153 | def load_tb_Feat(table_data,table_name,feat_name,action_name,is_total_pkts = True): 154 | # is_total_pkts: Whether to include the number of packets parameter 155 | print("load_tb_Feat--{}.......".format(table_name)) 156 | 157 | tcam_table = bfrt_info.table_get(table_name) 158 | 159 | KeyTuple_list=[] 160 | DataTuple_List=[] 161 | 162 | for x in range(len(table_data)): 163 | if is_total_pkts: 164 | KeyTuple_list.append(tcam_table.make_key([client.KeyTuple('$MATCH_PRIORITY', table_data[x][0]), 165 | client.KeyTuple("ig_md.total_pkts", table_data[x][4]), 166 | client.KeyTuple(feat_name, 167 | int(table_data[x][1]), 168 | int(table_data[x][2]))])) 169 | else: 170 | KeyTuple_list.append(tcam_table.make_key([client.KeyTuple('$MATCH_PRIORITY', table_data[x][0]), 171 | client.KeyTuple(feat_name, 172 | int(table_data[x][1]), 173 | int(table_data[x][2]))])) 174 | DataTuple_List.append(tcam_table.make_data([client.DataTuple('ind', table_data[x][3])],action_name)) 175 | 176 | tcam_table.entry_add(target, KeyTuple_list, DataTuple_List) 177 | print("load_tb_Feat--{} finished.".format(table_name)) 178 | 179 | def load_tb_flow_size_tree(table_data): 180 | print("load_tb_flow_size_tree.......") 181 | table_name = "SwitchIngress.Flow_Size_Tree" 182 | tcam_table = bfrt_info.table_get(table_name) 183 | 184 | for x in range(len(table_data)): 185 | tcam_table.entry_add( 186 | target, 187 | [tcam_table.make_key([client.KeyTuple("ig_md.feat3_encode",table_data[x][10],table_data[x][11]), 188 | client.KeyTuple("ig_md.feat4_encode",table_data[x][8],table_data[x][9]), 189 | client.KeyTuple("ig_md.feat5_encode",table_data[x][2],table_data[x][3]), 190 | client.KeyTuple("ig_md.feat6_encode",table_data[x][12],table_data[x][13]), 191 | client.KeyTuple("ig_md.feat7_encode",table_data[x][6],table_data[x][7]), 192 | client.KeyTuple("ig_md.feat8_encode",table_data[x][0],table_data[x][1]), 193 | client.KeyTuple("ig_md.feat9_encode",table_data[x][4],table_data[x][5]), 194 | ])], 195 | [tcam_table.make_data([client.DataTuple('result',table_data[x][14])], 196 | "SetFlowSize")]) 197 | 198 | print("load_tb_flow_size_tree finished.") 199 | 200 | def load_tb_pkt_tree(table_data): 201 | print("load_tb_pkt_tree.......") 202 | table_name = "SwitchIngress.Pkt_Tree" 203 | tcam_table = bfrt_info.table_get(table_name) 204 | 205 | for x in range(len(table_data)): 206 | tcam_table.entry_add( 207 | target, 208 | [tcam_table.make_key([client.KeyTuple("ig_md.feat3_encode",table_data[x][10],table_data[x][11]), 209 | client.KeyTuple("ig_md.feat4_encode",table_data[x][8],table_data[x][9]), 210 | client.KeyTuple("ig_md.feat5_encode",table_data[x][2],table_data[x][3]), 211 | client.KeyTuple("ig_md.feat6_encode",table_data[x][12],table_data[x][13]), 212 | client.KeyTuple("ig_md.feat7_encode",table_data[x][6],table_data[x][7]), 213 | client.KeyTuple("ig_md.feat8_encode",table_data[x][0],table_data[x][1]), 214 | client.KeyTuple("ig_md.feat9_encode",table_data[x][4],table_data[x][5]), 215 | ])], 216 | [tcam_table.make_data([client.DataTuple('confidence', int(round(max(table_data[x][14])*100))), 217 | client.DataTuple('result', int(np.argmax(table_data[x][14])+1))], 218 | "SetClass_Pkt_Tree")]) 219 | 220 | print("load_tb_pkt_tree finished.") 221 | 222 | def load_tb_flow_tree(table_data): 223 | print("load_tb_flow_tree.......") 224 | table_name = "SwitchIngress.Flow_Tree" 225 | tcam_table = bfrt_info.table_get(table_name) 226 | 227 | for x in range(len(table_data)): 228 | # 229 | result = int(np.argmax(table_data[x][15])+1) 230 | 231 | # if max(table_data[x][15])>0.45: #set determined threshold here 232 | # result+=50 233 | 234 | if table_data[x][0]==2048: 235 | result+=50 236 | 237 | tcam_table.entry_add( 238 | target, 239 | [tcam_table.make_key([client.KeyTuple("ig_md.total_pkts", table_data[x][0]), 240 | client.KeyTuple("ig_md.feat10_encode",table_data[x][7],table_data[x][8]), 241 | client.KeyTuple("ig_md.feat11_encode",table_data[x][5],table_data[x][6]), 242 | client.KeyTuple("ig_md.feat12_encode",table_data[x][11],table_data[x][12]), 243 | client.KeyTuple("ig_md.feat13_encode",table_data[x][1],table_data[x][2]), 244 | client.KeyTuple("ig_md.feat14_encode",table_data[x][13],table_data[x][14]), 245 | client.KeyTuple("ig_md.feat15_encode",table_data[x][3],table_data[x][4]), 246 | client.KeyTuple("ig_md.feat16_encode",table_data[x][9],table_data[x][10]), 247 | ])], 248 | [tcam_table.make_data([client.DataTuple('confidence', int(round(max(table_data[x][15])*100))), 249 | client.DataTuple('result', result)], 250 | "SetClass_Flow_Tree")]) 251 | 252 | print("load_tb_flow_tree finished.") 253 | 254 | pkt_feat = ['proto','total_len','diffserv', 'ttl', 'tcp_dataOffset', 'tcp_window', 'udp_length'] 255 | pkt_flow_feat = ['pkt_size_max','flow_iat_min','bin_5','bin_3','pkt_size_var_approx','pkt_size_avg','pkt_size_min'] 256 | 257 | with open("./bin_table_and_class_flow.pkl","rb") as f: 258 | [bin_table,feat_table_datas_flow,tree_data_p2p_flow] = pickle.load(f) 259 | 260 | with open("./flow_size_and_class_pkt.pkl","rb") as f: 261 | [feat_table_datas_pkt,tree_data_flow_size, tree_data_p2p_pkt] = pickle.load(f) 262 | 263 | load_tb_bin(bin_table[::-1]) 264 | 265 | load_tb_Feat(feat_table_datas_pkt['tcp_window'],"SwitchIngress.Feat3","ig_md.tcp_window",'SwitchIngress.feat3_hit',is_total_pkts=False) 266 | load_tb_Feat(feat_table_datas_pkt["tcp_dataOffset"],"SwitchIngress.Feat4","ig_md.tcp_data_offset",'SwitchIngress.feat4_hit',is_total_pkts=False) 267 | load_tb_Feat(feat_table_datas_pkt['total_len'],"SwitchIngress.Feat5","hdr.ipv4.total_len",'SwitchIngress.feat5_hit',is_total_pkts=False) 268 | load_tb_Feat(feat_table_datas_pkt['udp_length'],"SwitchIngress.Feat6","ig_md.udp_length",'SwitchIngress.feat6_hit',is_total_pkts=False) 269 | load_tb_Feat(feat_table_datas_pkt['ttl'],"SwitchIngress.Feat7","hdr.ipv4.ttl",'SwitchIngress.feat7_hit',is_total_pkts=False) 270 | load_tb_Feat(feat_table_datas_pkt['proto'],"SwitchIngress.Feat8","hdr.ipv4.protocol",'SwitchIngress.feat8_hit',is_total_pkts=False) 271 | load_tb_Feat(feat_table_datas_pkt['diffserv'],"SwitchIngress.Feat9","hdr.ipv4.diffserv",'SwitchIngress.feat9_hit',is_total_pkts=False) 272 | 273 | load_tb_Feat(feat_table_datas_flow['bin_3'],"SwitchIngress.Feat10","ig_md.bin1",'SwitchIngress.feat10_hit') 274 | load_tb_Feat(feat_table_datas_flow['bin_5'],"SwitchIngress.Feat11","ig_md.bin2",'SwitchIngress.feat11_hit') 275 | load_tb_Feat(feat_table_datas_flow['pkt_size_avg'],"SwitchIngress.Feat12","ig_md.pkt_size_avg",'SwitchIngress.feat12_hit') 276 | load_tb_Feat(feat_table_datas_flow['pkt_size_max'],"SwitchIngress.Feat13","ig_md.max_pkt_length",'SwitchIngress.feat13_hit') 277 | load_tb_Feat(feat_table_datas_flow['pkt_size_min'],"SwitchIngress.Feat14","ig_md.min_pkt_length",'SwitchIngress.feat14_hit') 278 | load_tb_Feat(feat_table_datas_flow['flow_iat_min'],"SwitchIngress.Feat15","ig_md.min_ipd",'SwitchIngress.feat15_hit') 279 | load_tb_Feat(feat_table_datas_flow['pkt_size_var_approx'],"SwitchIngress.Feat16","ig_md.pkt_length_power_sum",'SwitchIngress.feat16_hit') 280 | 281 | 282 | load_tb_flow_size_tree(tree_data_flow_size) 283 | load_tb_pkt_tree(tree_data_p2p_pkt) 284 | load_tb_flow_tree(tree_data_p2p_flow) 285 | 286 | receive_digest() -------------------------------------------------------------------------------- /switch/control_plane/flow_size_and_class_pkt.pkl: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/IDP-code/NetBeacon/06c61277a415275780018e61de201fc496520e6f/switch/control_plane/flow_size_and_class_pkt.pkl -------------------------------------------------------------------------------- /switch/data_plane/headers.p4: -------------------------------------------------------------------------------- 1 | /* -*- P4_16 -*- */ 2 | 3 | /******************************************************************************* 4 | * BAREFOOT NETWORKS CONFIDENTIAL & PROPRIETARY 5 | * 6 | * Copyright (c) Intel Corporation 7 | * SPDX-License-Identifier: CC-BY-ND-4.0 8 | */ 9 | 10 | 11 | #ifndef _HEADERS_ 12 | #define _HEADERS_ 13 | 14 | typedef bit<48> mac_addr_t; 15 | typedef bit<32> ipv4_addr_t; 16 | typedef bit<128> ipv6_addr_t; 17 | typedef bit<12> vlan_id_t; 18 | 19 | typedef bit<16> ether_type_t; 20 | const ether_type_t ETHERTYPE_IPV4 = 16w0x0800; 21 | const ether_type_t ETHERTYPE_ARP = 16w0x0806; 22 | const ether_type_t ETHERTYPE_IPV6 = 16w0x86dd; 23 | const ether_type_t ETHERTYPE_VLAN = 16w0x8100; 24 | 25 | typedef bit<8> ip_protocol_t; 26 | const ip_protocol_t IP_PROTOCOLS_ICMP = 1; 27 | const ip_protocol_t IP_PROTOCOLS_TCP = 6; 28 | const ip_protocol_t IP_PROTOCOLS_UDP = 17; 29 | 30 | #define egress_port 65 31 | #define recirculate_port 68 32 | 33 | typedef bit<32> flow_index_t; 34 | 35 | #define Register_Table_Size 65536 //register array size 36 | #define Register_Index_Size 16 //register array index bits 37 | 38 | #define timeout_thres 256 //timeout threshold 39 | 40 | 41 | // The actual numeric value 42 | // * is not important, it just needs to be consistent between what it set in the 43 | // * ingress pipeline and what is checked in the ingress deparser. */ 44 | const bit<3> DPRSR_DIGEST_TYPE_A = 2; 45 | const bit<8> RESUB_TYPE_A = 255; 46 | 47 | /* Define a few different resubmit digests. Note that each must be exactly 8 48 | * bytes on Tofino-1 and 16 bytes on Tofino-2. In order to allow the ingress 49 | * parser to identify which resubmit digest type a packet has, one byte is used 50 | * to carry a type. */ 51 | header resubmit_type_a { 52 | bit<8> result; 53 | bit<8> confidence; 54 | bit<48> pad2; 55 | } 56 | 57 | header ethernet_h { 58 | mac_addr_t dst_addr; 59 | mac_addr_t src_addr; 60 | bit<16> ether_type; 61 | } 62 | 63 | header vlan_tag_h { 64 | bit<3> pcp; 65 | bit<1> cfi; 66 | vlan_id_t vid; 67 | bit<16> ether_type; 68 | } 69 | 70 | header mpls_h { 71 | bit<20> label; 72 | bit<3> exp; 73 | bit<1> bos; 74 | bit<8> ttl; 75 | } 76 | 77 | header ipv4_h { 78 | bit<4> version; 79 | bit<4> ihl; 80 | bit<8> diffserv; 81 | bit<16> total_len; 82 | bit<16> identification; 83 | bit<3> flags; 84 | bit<13> frag_offset; 85 | bit<8> ttl; 86 | bit<8> protocol; 87 | bit<16> hdr_checksum; 88 | ipv4_addr_t src_addr; 89 | ipv4_addr_t dst_addr; 90 | } 91 | 92 | header ipv6_h { 93 | bit<4> version; 94 | bit<8> traffic_class; 95 | bit<20> flow_label; 96 | bit<16> payload_len; 97 | bit<8> next_hdr; 98 | bit<8> hop_limit; 99 | ipv6_addr_t src_addr; 100 | ipv6_addr_t dst_addr; 101 | } 102 | 103 | header tcp_h { 104 | bit<16> src_port; 105 | bit<16> dst_port; 106 | bit<32> seq_no; 107 | bit<32> ack_no; 108 | bit<4> data_offset; 109 | bit<4> res; 110 | bit<8> flags; 111 | bit<16> window; 112 | bit<16> checksum; 113 | bit<16> urgent_ptr; 114 | } 115 | 116 | header udp_h { 117 | bit<16> src_port; 118 | bit<16> dst_port; 119 | bit<16> hdr_length; 120 | bit<16> checksum; 121 | } 122 | 123 | header icmp_h { 124 | bit<8> type_; 125 | bit<8> code; 126 | bit<16> hdr_checksum; 127 | } 128 | 129 | // Address Resolution Protocol -- RFC 6747 130 | header arp_h { 131 | bit<16> hw_type; 132 | bit<16> proto_type; 133 | bit<8> hw_addr_len; 134 | bit<8> proto_addr_len; 135 | bit<16> opcode; 136 | // ... 137 | } 138 | 139 | // Segment Routing Extension (SRH) -- IETFv7 140 | header ipv6_srh_h { 141 | bit<8> next_hdr; 142 | bit<8> hdr_ext_len; 143 | bit<8> routing_type; 144 | bit<8> seg_left; 145 | bit<8> last_entry; 146 | bit<8> flags; 147 | bit<16> tag; 148 | } 149 | 150 | // VXLAN -- RFC 7348 151 | header vxlan_h { 152 | bit<8> flags; 153 | bit<24> reserved; 154 | bit<24> vni; 155 | bit<8> reserved2; 156 | } 157 | 158 | // Generic Routing Encapsulation (GRE) -- RFC 1701 159 | header gre_h { 160 | bit<1> C; 161 | bit<1> R; 162 | bit<1> K; 163 | bit<1> S; 164 | bit<1> s; 165 | bit<3> recurse; 166 | bit<5> flags; 167 | bit<3> version; 168 | bit<16> proto; 169 | } 170 | 171 | struct header_t { 172 | ethernet_h ethernet; 173 | vlan_tag_h vlan_tag; 174 | ipv4_h ipv4; 175 | ipv6_h ipv6; 176 | tcp_h tcp; 177 | udp_h udp; 178 | 179 | // Add more headers here. 180 | } 181 | 182 | struct empty_header_t {} 183 | 184 | struct empty_metadata_t {} 185 | 186 | struct metadata_t { 187 | bit<16> src_port; 188 | bit<16> dst_port; 189 | bit<32> flow_hash; 190 | bit<32> flow_hash1; 191 | bit flow_index; 192 | 193 | bit<16> total_pkts; 194 | bit<32> total_bytes; 195 | bit<16> zoom_pkt_length; 196 | 197 | bit<16> tcp_window; 198 | bit<4> tcp_data_offset; 199 | bit<16> udp_length; 200 | 201 | bit<16> bin1; 202 | bit<8> bin2; 203 | bit<16> max_pkt_length; 204 | bit<16> min_pkt_length; 205 | bit<32> pkt_size_avg; 206 | 207 | bit<32> pkt_length_power_sum; 208 | bit<32> total_bytes_power; 209 | bit<32> last_pkt_timestamp; 210 | bit<32> ipd; 211 | bit<32> min_ipd; 212 | 213 | bit<32> last_classified; 214 | bit<32> now_timestamp; 215 | bit<32> interval; 216 | 217 | // bit<16> feat1_encode; 218 | // bit<16> feat2_encode; 219 | bit<48> feat3_encode; 220 | bit<8> feat4_encode; 221 | bit<144> feat5_encode; 222 | bit<72> feat6_encode; 223 | bit<64> feat7_encode; 224 | bit<8> feat8_encode; 225 | bit<24> feat9_encode; 226 | 227 | bit<32> feat10_encode; 228 | bit<24> feat11_encode; 229 | bit<72> feat12_encode; 230 | bit<80> feat13_encode; 231 | bit<48> feat14_encode; 232 | bit<72> feat15_encode; 233 | bit<80> feat16_encode; 234 | 235 | bit<8> tree1_confidence; 236 | bit<8> result; 237 | bit<8> flow_size; 238 | } 239 | 240 | 241 | struct digest_a_t { 242 | ipv4_addr_t src_addr; 243 | ipv4_addr_t dst_addr; 244 | bit<16> src_port; 245 | bit<16> dst_port; 246 | bit<8> protocol; 247 | bit<8> result; 248 | } 249 | 250 | #endif /* _HEADERS_ */ -------------------------------------------------------------------------------- /switch/data_plane/parsers.p4: -------------------------------------------------------------------------------- 1 | /* -*- P4_16 -*- */ 2 | 3 | /******************************************************************************* 4 | * BAREFOOT NETWORKS CONFIDENTIAL & PROPRIETARY 5 | * 6 | * Copyright (c) Intel Corporation 7 | * SPDX-License-Identifier: CC-BY-ND-4.0 8 | */ 9 | 10 | #ifndef _PARSERS_ 11 | #define _PARSERS_ 12 | 13 | 14 | #include "headers.p4" 15 | 16 | // --------------------------------------------------------------------------- 17 | // Ingress parser 18 | // --------------------------------------------------------------------------- 19 | 20 | parser SwitchIngressParser( 21 | packet_in pkt, 22 | out header_t hdr, 23 | out metadata_t ig_md, 24 | out ingress_intrinsic_metadata_t ig_intr_md) { 25 | 26 | TofinoIngressParser() tofino_parser; 27 | Checksum() ipv4_checksum; 28 | 29 | state start { 30 | tofino_parser.apply(pkt, ig_intr_md); 31 | transition parse_ethernet; 32 | } 33 | 34 | 35 | state parse_ethernet { 36 | pkt.extract(hdr.ethernet); 37 | transition select(hdr.ethernet.ether_type) { 38 | ETHERTYPE_IPV4: parse_ipv4; 39 | ETHERTYPE_VLAN: parse_vlan; 40 | ETHERTYPE_ARP: reject; 41 | default: reject; 42 | } 43 | } 44 | 45 | state parse_vlan{ 46 | pkt.extract(hdr.vlan_tag); 47 | transition select(hdr.vlan_tag.ether_type) { 48 | ETHERTYPE_IPV4: parse_ipv4; 49 | default: accept; 50 | } 51 | } 52 | 53 | state parse_ipv4 { 54 | pkt.extract(hdr.ipv4); 55 | ipv4_checksum.add(hdr.ipv4); 56 | 57 | // parse only non-fragmented (hdr.ipv4.frag_offset=0) IP packets with no options(hdr.ipv4.ihl=5) 58 | transition select(hdr.ipv4.ihl, hdr.ipv4.frag_offset, hdr.ipv4.protocol) { 59 | (5, 0, IP_PROTOCOLS_TCP) : parse_tcp; 60 | (5, 0, IP_PROTOCOLS_UDP) : parse_udp; 61 | default: reject; 62 | } 63 | } 64 | 65 | state parse_tcp { 66 | pkt.extract(hdr.tcp); 67 | ig_md.src_port = hdr.tcp.src_port; 68 | ig_md.dst_port = hdr.tcp.dst_port; 69 | ig_md.udp_length=0; 70 | ig_md.tcp_window=hdr.tcp.window; 71 | ig_md.tcp_data_offset=hdr.tcp.data_offset; 72 | transition accept; 73 | } 74 | 75 | state parse_udp { 76 | pkt.extract(hdr.udp); 77 | ig_md.src_port = hdr.udp.src_port; 78 | ig_md.dst_port = hdr.udp.dst_port; 79 | ig_md.tcp_window=0; 80 | ig_md.tcp_data_offset=0; 81 | ig_md.udp_length=hdr.udp.hdr_length; 82 | transition select(hdr.udp.src_port) { 83 | 68: reject; 84 | default: accept; 85 | } 86 | //transition accept; 87 | } 88 | } 89 | 90 | // --------------------------------------------------------------------------- 91 | // Ingress Deparser 92 | // --------------------------------------------------------------------------- 93 | control SwitchIngressDeparser( 94 | packet_out pkt, 95 | inout header_t hdr, 96 | in metadata_t ig_md, 97 | in ingress_intrinsic_metadata_for_deparser_t ig_dprsr_md) { 98 | 99 | Digest() digest_a; 100 | //Digest() digest_b; //maxmum 48 bytes 101 | 102 | apply { 103 | 104 | if (ig_dprsr_md.digest_type == 2) { 105 | digest_a.pack({hdr.ipv4.src_addr, hdr.ipv4.dst_addr, ig_md.src_port, ig_md.dst_port, hdr.ipv4.protocol,ig_md.result}); 106 | } 107 | 108 | pkt.emit(hdr); 109 | } 110 | } 111 | 112 | #endif /* _PARSERS_ */ -------------------------------------------------------------------------------- /switch/data_plane/switch.p4: -------------------------------------------------------------------------------- 1 | #include 2 | //#include 3 | #include 4 | #include "headers.p4" 5 | #include "util.p4" 6 | #include "parsers.p4" 7 | 8 | control SwitchIngress( 9 | inout header_t hdr, 10 | inout metadata_t ig_md, 11 | in ingress_intrinsic_metadata_t ig_intr_md, 12 | in ingress_intrinsic_metadata_from_parser_t ig_prsr_md, 13 | inout ingress_intrinsic_metadata_for_deparser_t ig_dprsr_md, 14 | inout ingress_intrinsic_metadata_for_tm_t ig_tm_md) { 15 | 16 | @symmetric("hdr.ipv4.src_addr", "hdr.ipv4.dst_addr") 17 | @symmetric("ig_md.src_port", "ig_md.dst_port") 18 | Hash>(HashAlgorithm_t.CRC32) my_symmetric_hash; 19 | 20 | Register, bit>(Register_Table_Size) Register_total_bytes; //(index w registersize) 21 | RegisterAction, bit, bit<32>>(Register_total_bytes) Update_Register_total_bytes = { // 22 | void apply(inout bit<32> value, out bit<32> read_value){ 23 | value = value + (bit<32>) hdr.ipv4.total_len; 24 | read_value = value; 25 | } 26 | }; 27 | RegisterAction, bit, bit<32>>(Register_total_bytes) Init_Register_total_bytes = { // 28 | void apply(inout bit<32> value, out bit<32> read_value){ 29 | value = (bit<32>) hdr.ipv4.total_len; 30 | read_value = value; 31 | } 32 | }; 33 | 34 | action Update_total_bytes(){ 35 | ig_md.total_bytes = Update_Register_total_bytes.execute(ig_md.flow_index); 36 | } 37 | action Init_total_bytes(){ 38 | ig_md.total_bytes = Init_Register_total_bytes.execute(ig_md.flow_index); 39 | } 40 | 41 | 42 | Register, bit>(Register_Table_Size) Register_total_pkts; 43 | RegisterAction, bit, bit<16>>(Register_total_pkts) Update_Register_total_pkts = { 44 | void apply(inout bit<16> value, out bit<16> read_value){ 45 | value = value + 1; 46 | read_value = value; 47 | } 48 | }; 49 | RegisterAction, bit, bit<16>>(Register_total_pkts) Init_Register_total_pkts = { 50 | void apply(inout bit<16> value, out bit<16> read_value){ 51 | value = 1; 52 | read_value = value; 53 | } 54 | }; 55 | action Init_total_pkts(){ 56 | ig_md.total_pkts = Init_Register_total_pkts.execute(ig_md.flow_index); 57 | } 58 | action Update_total_pkts(){ 59 | ig_md.total_pkts = Update_Register_total_pkts.execute(ig_md.flow_index); 60 | } 61 | 62 | 63 | Register, bit>(Register_Table_Size) Register_max_pkt_length; 64 | RegisterAction, bit, bit<16>>(Register_max_pkt_length) Update_Register_max_pkt_length = { 65 | void apply(inout bit<16> value, out bit<16> read_value){ 66 | if(hdr.ipv4.total_len > value){ 67 | value = hdr.ipv4.total_len; 68 | } 69 | read_value = value; 70 | } 71 | }; 72 | action Update_max_pkt_length(){ 73 | ig_md.max_pkt_length = Update_Register_max_pkt_length.execute(ig_md.flow_index); 74 | } 75 | RegisterAction, bit, bit<16>>(Register_max_pkt_length) Init_Register_max_pkt_length = { 76 | void apply(inout bit<16> value, out bit<16> read_value){ 77 | value = hdr.ipv4.total_len; 78 | read_value = value; 79 | } 80 | }; 81 | action Init_max_pkt_length(){ 82 | Init_Register_max_pkt_length.execute(ig_md.flow_index); 83 | } 84 | 85 | 86 | Register, bit>(Register_Table_Size) Register_min_pkt_length; 87 | RegisterAction, bit, bit<16>>(Register_min_pkt_length) Update_Register_min_pkt_length = { 88 | void apply(inout bit<16> value, out bit<16> read_value){ 89 | if(hdr.ipv4.total_len < value){ 90 | value = hdr.ipv4.total_len; 91 | } 92 | read_value = value; 93 | } 94 | }; 95 | action Update_min_pkt_length(){ 96 | ig_md.min_pkt_length = Update_Register_min_pkt_length.execute(ig_md.flow_index); 97 | } 98 | RegisterAction, bit, bit<16>>(Register_min_pkt_length) Init_Register_min_pkt_length = { 99 | void apply(inout bit<16> value, out bit<16> read_value){ 100 | value = hdr.ipv4.total_len; 101 | read_value = value; 102 | } 103 | }; 104 | action Init_min_pkt_length(){ 105 | ig_md.min_pkt_length = Init_Register_min_pkt_length.execute(ig_md.flow_index); 106 | } 107 | 108 | 109 | 110 | Register, bit>(Register_Table_Size) Register_bin1; 111 | RegisterAction, bit, bit<16>>(Register_bin1) Update_Register_bin1 = { 112 | void apply(inout bit<16> value, out bit<16> read_value){ value = value + 1; read_value = value;}}; 113 | RegisterAction, bit, bit<16>>(Register_bin1) Read_Register_bin1 = { 114 | void apply(inout bit<16> value, out bit<16> read_value){read_value = value;}}; 115 | RegisterAction, bit, bit<16>>(Register_bin1) Init0_Register_bin1 = { 116 | void apply(inout bit<16> value, out bit<16> read_value){value=0; read_value=value;}}; 117 | RegisterAction, bit, bit<16>>(Register_bin1) Init1_Register_bin1 = { 118 | void apply(inout bit<16> value, out bit<16> read_value){value=1; read_value=value;}}; 119 | action Read_bin1(){ig_md.bin1 = Read_Register_bin1.execute(ig_md.flow_index);} 120 | action Update_bin1(){ig_md.bin1 = Update_Register_bin1.execute(ig_md.flow_index);} 121 | action Init0_bin1(){Init0_Register_bin1.execute(ig_md.flow_index);} 122 | action Init1_bin1(){Init1_Register_bin1.execute(ig_md.flow_index);} 123 | 124 | Register, bit>(Register_Table_Size) Register_bin2; 125 | RegisterAction, bit, bit<8>>(Register_bin2) Update_Register_bin2 = { 126 | void apply(inout bit<8> value, out bit<8> read_value){ value = value + 1; read_value = value;}}; 127 | RegisterAction, bit, bit<8>>(Register_bin2) Read_Register_bin2 = { 128 | void apply(inout bit<8> value, out bit<8> read_value){read_value = value;}}; 129 | RegisterAction, bit, bit<8>>(Register_bin2) Init0_Register_bin2 = { 130 | void apply(inout bit<8> value, out bit<8> read_value){value=0; read_value=value;}}; 131 | RegisterAction, bit, bit<8>>(Register_bin2) Init1_Register_bin2 = { 132 | void apply(inout bit<8> value, out bit<8> read_value){value=1; read_value=value;}}; 133 | action Read_bin2(){ig_md.bin2 = Read_Register_bin2.execute(ig_md.flow_index);} 134 | action Update_bin2(){ig_md.bin2 = Update_Register_bin2.execute(ig_md.flow_index);} 135 | action Init0_bin2(){Init0_Register_bin2.execute(ig_md.flow_index);} 136 | action Init1_bin2(){Init1_Register_bin2.execute(ig_md.flow_index);} 137 | 138 | 139 | Register, bit>(Register_Table_Size) Register_last_pkt_timestamp; 140 | RegisterAction, bit, bit<32>>(Register_last_pkt_timestamp) Update_Register_last_pkt_timestamp = { 141 | void apply(inout bit<32> value, out bit<32> read_value){ 142 | read_value = ig_md.ipd-value; 143 | value = ig_md.ipd; 144 | } 145 | }; 146 | RegisterAction, bit, bit<32>>(Register_last_pkt_timestamp) Init_Register_last_pkt_timestamp = { 147 | void apply(inout bit<32> value, out bit<32> read_value){ 148 | read_value = 0; 149 | value = ig_md.ipd; 150 | } 151 | }; 152 | action Init_last_pkt_timestamp(){ 153 | ig_md.ipd = Init_Register_last_pkt_timestamp.execute(ig_md.flow_index); 154 | } 155 | action Update_last_pkt_timestamp(){ 156 | ig_md.ipd = Update_Register_last_pkt_timestamp.execute(ig_md.flow_index); 157 | } 158 | 159 | Register, bit>(Register_Table_Size) Register_min_ipd; 160 | RegisterAction, bit, bit<32>>(Register_min_ipd) Update_Register_min_ipd = { 161 | void apply(inout bit<32> value, out bit<32> read_value){ 162 | if(ig_md.ipd, bit, bit<32>>(Register_min_ipd) Init_Register_min_ipd = { 169 | void apply(inout bit<32> value, out bit<32> read_value){ 170 | value = 4294967295; 171 | read_value = value; 172 | } 173 | }; 174 | action Init_min_ipd(){ 175 | ig_md.min_ipd = Init_Register_min_ipd.execute(ig_md.flow_index); 176 | } 177 | action Update_min_ipd(){ 178 | ig_md.min_ipd = Update_Register_min_ipd.execute(ig_md.flow_index); 179 | } 180 | 181 | 182 | MathUnit>(MathOp_t.SQR, 1) square1; 183 | Register, bit>(Register_Table_Size) Register_pkt_length_power_sum; 184 | RegisterAction, bit, bit<32>>(Register_pkt_length_power_sum) Update_Register_pkt_length_power_sum = { 185 | void apply(inout bit<32> value, out bit<32> read_value){ 186 | //value = value + square1.execute((bit<32>) hdr.ipv4.total_len); 187 | value = value + square1.execute((bit<32>) ig_md.zoom_pkt_length); 188 | read_value = value; 189 | } 190 | }; 191 | RegisterAction, bit, bit<32>>(Register_pkt_length_power_sum) Init_Register_pkt_length_power_sum = { 192 | void apply(inout bit<32> value, out bit<32> read_value){ 193 | //value = square1.execute((bit<32>) hdr.ipv4.total_len); 194 | value = square1.execute((bit<32>) ig_md.zoom_pkt_length); 195 | read_value = value; 196 | } 197 | }; 198 | action Update_pkt_length_power_sum(){ 199 | ig_md.pkt_length_power_sum = Update_Register_pkt_length_power_sum.execute(ig_md.flow_index); 200 | } 201 | action Init_pkt_length_power_sum(){ 202 | Init_Register_pkt_length_power_sum.execute(ig_md.flow_index); 203 | } 204 | 205 | 206 | MathUnit>(MathOp_t.SQR, 1) square2; 207 | Register, bit<32>>(1) Register_total_bytes_power; 208 | RegisterAction, bit<32>, bit<32>>(Register_total_bytes_power) Update_Register_total_bytes_power = { 209 | void apply(inout bit<32> value, out bit<32> read_value){ 210 | value = square2.execute(ig_md.pkt_size_avg); 211 | read_value = value; 212 | } 213 | }; 214 | action Update_total_bytes_power(){ 215 | ig_md.total_bytes_power = Update_Register_total_bytes_power.execute(0); 216 | } 217 | 218 | 219 | Register, bit>(Register_Table_Size) Register_result; 220 | RegisterAction, bit, bit<8>>(Register_result) Update_Register_result = { 221 | void apply(inout bit<8> value, out bit<8> read_value){ 222 | value = hdr.ipv4.ttl; 223 | read_value = value; 224 | } 225 | }; 226 | RegisterAction, bit, bit<8>>(Register_result) Read_Register_result = { 227 | void apply(inout bit<8> value, out bit<8> read_value){ 228 | read_value = value; 229 | } 230 | }; 231 | action Update_result(){ 232 | ig_md.result = Update_Register_result.execute(ig_md.flow_index); 233 | } 234 | action Read_result(){ 235 | ig_md.result = Read_Register_result.execute(ig_md.flow_index); 236 | } 237 | 238 | 239 | Register, bit>(Register_Table_Size) Register_full_flow_hash; //hash as flow id 240 | RegisterAction, bit, bit<32>>(Register_full_flow_hash) Read_Register_full_flow_hash = { 241 | void apply(inout bit<32> value, out bit<32> read_value){ 242 | read_value = value; 243 | } 244 | }; 245 | RegisterAction, bit, bit<32>>(Register_full_flow_hash) Update_Register_full_flow_hash = { 246 | void apply(inout bit<32> value, out bit<32> read_value){ 247 | value = ig_md.flow_hash; 248 | read_value = value; 249 | } 250 | }; 251 | action Read_full_flow_hash(){ 252 | ig_md.flow_hash1 = Read_Register_full_flow_hash.execute(ig_md.flow_index); 253 | } 254 | action Update_full_flow_hash(){ 255 | ig_md.flow_hash1 = Update_Register_full_flow_hash.execute(ig_md.flow_index); 256 | } 257 | 258 | 259 | Register, bit>(Register_Table_Size) Register_last_classified_timestamp; 260 | RegisterAction, bit, bit<32>>(Register_last_classified_timestamp) Update_Register_last_classified_timestamp = { 261 | void apply(inout bit<32> value, out bit<32> read_value){ 262 | value = ig_md.now_timestamp; 263 | read_value = value; 264 | } 265 | }; 266 | RegisterAction, bit, bit<32>>(Register_last_classified_timestamp) Read_Register_last_classified_timestamp = { 267 | void apply(inout bit<32> value, out bit<32> read_value){ 268 | read_value = ig_md.now_timestamp - value; 269 | } 270 | }; 271 | action Read_last_classified_timestamp(){ 272 | ig_md.last_classified = Read_Register_last_classified_timestamp.execute(ig_md.flow_index); 273 | } 274 | action Update_last_classified_timestamp(){ 275 | Update_Register_last_classified_timestamp.execute(ig_md.flow_index); 276 | } 277 | 278 | action noaction(){} 279 | 280 | 281 | action feat3_hit(bit<48> ind){ ig_md.feat3_encode = ind;} 282 | @pragma stage 0 283 | table Feat3{ 284 | key = {ig_md.tcp_window: ternary;} 285 | actions={feat3_hit; noaction;} 286 | size = 165; 287 | const default_action = noaction; 288 | } 289 | action feat4_hit(bit<8> ind){ig_md.feat4_encode = ind;} 290 | @pragma stage 0 291 | table Feat4{ 292 | key = {ig_md.tcp_data_offset: ternary;} 293 | actions={feat4_hit; noaction;} 294 | size = 8; 295 | const default_action = noaction; 296 | } 297 | action feat5_hit(bit<144> ind){ig_md.feat5_encode = ind;} 298 | @pragma stage 0 299 | table Feat5{ 300 | key = {hdr.ipv4.total_len: ternary;} 301 | actions={feat5_hit; noaction;} 302 | size = 256; 303 | const default_action = noaction; 304 | } 305 | action feat6_hit(bit<80> ind){ig_md.feat6_encode = (bit<72>) ind;} 306 | @pragma stage 0 307 | table Feat6{ 308 | key = {ig_md.udp_length: ternary;} 309 | actions={feat6_hit; noaction;} 310 | size = 150; 311 | const default_action = noaction; 312 | } 313 | action feat7_hit(bit<64> ind){ig_md.feat7_encode = ind;} 314 | @pragma stage 0 315 | table Feat7{ 316 | key = {hdr.ipv4.ttl: ternary;} 317 | actions={feat7_hit; noaction;} 318 | size = 90; 319 | const default_action = noaction; 320 | } 321 | action feat8_hit(bit<8> ind){ig_md.feat8_encode = ind;} 322 | @pragma stage 0 323 | table Feat8{ 324 | key = {hdr.ipv4.protocol: ternary;} 325 | actions={feat8_hit; noaction;} 326 | size = 4; 327 | const default_action = noaction; 328 | } 329 | action feat9_hit(bit<32> ind){ig_md.feat9_encode = (bit<24>) ind;} 330 | @pragma stage 0 331 | table Feat9{ 332 | key = {hdr.ipv4.diffserv: ternary;} 333 | actions={feat9_hit; noaction;} 334 | size = 30; 335 | const default_action = noaction; 336 | } 337 | 338 | action feat10_hit(bit<32> ind){ig_md.feat10_encode = ind;} 339 | table Feat10{ 340 | key = {ig_md.total_pkts: exact; ig_md.bin1: ternary;} 341 | actions={feat10_hit; noaction;} 342 | size = 180; 343 | const default_action = noaction; 344 | } 345 | 346 | action feat11_hit(bit<32> ind){ig_md.feat11_encode = (bit<24>) ind;} 347 | table Feat11{ 348 | key = {ig_md.total_pkts: exact; ig_md.bin2: ternary;} 349 | actions={feat11_hit; noaction;} 350 | size = 50; 351 | const default_action = noaction; 352 | } 353 | 354 | action feat12_hit(bit<80> ind){ig_md.feat12_encode = (bit<72>) ind;} //pkt_size_avg 355 | table Feat12{ 356 | key = {ig_md.total_pkts: exact; ig_md.pkt_size_avg: ternary;} 357 | actions = {feat12_hit; noaction;} 358 | size = 690; 359 | const default_action = noaction; 360 | } 361 | 362 | action feat13_hit(bit<80> ind){ig_md.feat13_encode = ind; } //pkt_size_max 363 | table Feat13{ 364 | key = {ig_md.total_pkts: exact; ig_md.max_pkt_length: ternary;} 365 | actions = {feat13_hit; noaction;} 366 | size = 850; 367 | const default_action = noaction; 368 | } 369 | 370 | action feat14_hit(bit<48> ind){ig_md.feat14_encode = ind;} //pkt_size_min 371 | table Feat14{ 372 | key = {ig_md.total_pkts: exact; ig_md.min_pkt_length: ternary;} 373 | actions = {feat14_hit; noaction;} 374 | size = 260; 375 | const default_action = noaction; 376 | } 377 | 378 | action feat15_hit(bit<80> ind){ig_md.feat15_encode = (bit<72>) ind; } //flow_ipd_min 379 | table Feat15{ 380 | key = {ig_md.total_pkts: exact; ig_md.min_ipd: ternary;} 381 | actions = {feat15_hit; noaction;} 382 | size = 990; 383 | const default_action = noaction; 384 | } 385 | 386 | action feat16_hit(bit<80> ind){ig_md.feat16_encode = ind;} //pkt_size_var 387 | table Feat16{ 388 | key = {ig_md.total_pkts: exact; ig_md.pkt_length_power_sum: ternary;} 389 | actions={feat16_hit; noaction;} 390 | size = 1740; 391 | const default_action = noaction; 392 | } 393 | 394 | @pragma stage 3 395 | table Update_total_bytes_table{actions={Update_total_bytes;} default_action=Update_total_bytes;} 396 | @pragma stage 3 397 | table Init_total_bytes_table{actions={Init_total_bytes;} default_action=Init_total_bytes;} 398 | 399 | @pragma stage 3 400 | table Update_total_pkts_table{actions={Update_total_pkts;} default_action=Update_total_pkts;} 401 | @pragma stage 3 402 | table Init_total_pkts_table{actions={Init_total_pkts;}default_action=Init_total_pkts;} 403 | 404 | @pragma stage 3 405 | table Update_pkt_length_power_sum_table{actions={Update_pkt_length_power_sum;} default_action=Update_pkt_length_power_sum;} 406 | @pragma stage 3 407 | table Init_pkt_length_power_sum_table{actions={Init_pkt_length_power_sum;}default_action=Init_pkt_length_power_sum;} 408 | 409 | @pragma stage 4 410 | table Init_max_pkt_length_table{actions={Init_max_pkt_length;} default_action=Init_max_pkt_length;} 411 | @pragma stage 4 412 | table Update_max_pkt_length_table{actions={Update_max_pkt_length;}default_action=Update_max_pkt_length;} 413 | 414 | @pragma stage 4 415 | table Init_min_pkt_length_table{actions={Init_min_pkt_length;} default_action=Init_min_pkt_length;} 416 | @pragma stage 4 417 | table Update_min_pkt_length_table{actions={Update_min_pkt_length;}default_action=Update_min_pkt_length;} 418 | 419 | @pragma stage 6 420 | table pkt_bin1{key= {hdr.ipv4.total_len:ternary;} actions={Update_bin1; Read_bin1; noaction;} size = 2; const default_action = noaction; } 421 | @pragma stage 6 422 | table Init_bin1_table{key= {hdr.ipv4.total_len:ternary;} actions={Init0_bin1; Init1_bin1; noaction;} size = 2; const default_action=noaction;} 423 | @pragma stage 6 424 | table pkt_bin2{key= {hdr.ipv4.total_len:ternary;} actions={Update_bin2; Read_bin2; noaction;} size = 2; const default_action = noaction; } 425 | @pragma stage 6 426 | table Init_bin2_table{key= {hdr.ipv4.total_len:ternary;} actions={Init0_bin2; Init1_bin2; noaction;} size = 2; const default_action=noaction;} 427 | 428 | @pragma stage 4 429 | table Init_last_pkt_timestamp_table{ actions={Init_last_pkt_timestamp;} default_action=Init_last_pkt_timestamp;} 430 | @pragma stage 4 431 | table Update_last_pkt_timestamp_table{actions={Update_last_pkt_timestamp;} default_action=Update_last_pkt_timestamp;} 432 | 433 | @pragma stage 6 434 | table Init_min_ipd_table{actions={Init_min_ipd;} default_action=Init_min_ipd;} 435 | @pragma stage 6 436 | table Update_min_ipd_table{actions={Update_min_ipd;} default_action=Update_min_ipd;} 437 | 438 | action SetFlowSize(bit<8> result){ 439 | ig_md.flow_size = result; //long or short flow 440 | } 441 | @pragma stage 1 442 | table Flow_Size_Tree{ 443 | key={ 444 | // ig_md.feat1_encode:ternary; 445 | // ig_md.feat2_encode:ternary; 446 | ig_md.feat3_encode:ternary; 447 | ig_md.feat4_encode:ternary; 448 | ig_md.feat5_encode:ternary; 449 | ig_md.feat6_encode:ternary; 450 | ig_md.feat7_encode:ternary; 451 | ig_md.feat8_encode:ternary; 452 | ig_md.feat9_encode:ternary; 453 | } 454 | actions={ 455 | SetFlowSize; 456 | noaction; 457 | } 458 | size = 185; 459 | const default_action = noaction; 460 | } 461 | 462 | action Set_flow_result(bit<8> result){ 463 | ig_md.result = result; 464 | } 465 | 466 | table Flow_result{ 467 | key={ 468 | hdr.ipv4.src_addr: exact; 469 | hdr.ipv4.dst_addr: exact; 470 | ig_md.src_port:exact; 471 | ig_md.dst_port:exact; 472 | hdr.ipv4.protocol: exact; 473 | } 474 | actions={ 475 | Set_flow_result; 476 | noaction; 477 | } 478 | size = 3000; 479 | const default_action = noaction; 480 | } 481 | 482 | action SetClass_Pkt_Tree(bit<8> result,bit<8> confidence){ 483 | ig_md.result = result; 484 | ig_md.tree1_confidence = confidence; 485 | } 486 | table Pkt_Tree{ 487 | key={ 488 | // ig_md.feat1_encode:ternary; 489 | // ig_md.feat2_encode:ternary; 490 | ig_md.feat3_encode:ternary; 491 | ig_md.feat4_encode:ternary; 492 | ig_md.feat5_encode:ternary; 493 | ig_md.feat6_encode:ternary; 494 | ig_md.feat7_encode:ternary; 495 | ig_md.feat8_encode:ternary; 496 | ig_md.feat9_encode:ternary; 497 | } 498 | actions={ 499 | SetClass_Pkt_Tree; 500 | noaction; 501 | } 502 | size = 390; 503 | const default_action = noaction; 504 | } 505 | 506 | action SetClass_Flow_Tree(bit<8> confidence, bit<8> result){ 507 | ig_md.tree1_confidence = confidence; //0-100 508 | ig_md.result = result; 509 | } 510 | 511 | table Flow_Tree{ 512 | key={ 513 | ig_md.total_pkts: exact; 514 | // ig_md.feat1_encode:ternary; 515 | // ig_md.feat2_encode:ternary; 516 | ig_md.feat10_encode:ternary; 517 | ig_md.feat11_encode:ternary; 518 | ig_md.feat12_encode:ternary; 519 | ig_md.feat13_encode:ternary; 520 | ig_md.feat14_encode:ternary; 521 | ig_md.feat15_encode:ternary; 522 | ig_md.feat16_encode:ternary; 523 | } 524 | actions={ 525 | SetClass_Flow_Tree; 526 | noaction; 527 | } 528 | size = 1710; 529 | const default_action = noaction; 530 | } 531 | 532 | action default_treat(){} 533 | action treat1(){} 534 | action treat2(){} 535 | table Treatment{ 536 | key = {ig_md.result:exact;} 537 | actions={ 538 | default_treat; 539 | treat1; 540 | treat2; 541 | } 542 | size = 10; 543 | const default_action = default_treat; 544 | } 545 | 546 | apply{ 547 | ig_md.flow_hash = my_symmetric_hash.get({hdr.ipv4.src_addr,hdr.ipv4.dst_addr,ig_md.src_port,ig_md.dst_port,hdr.ipv4.protocol}); 548 | ig_md.bin1=0; 549 | ig_md.bin2=0; 550 | ig_md.pkt_length_power_sum=0; 551 | ig_md.ipd = 0; 552 | ig_md.total_pkts=0; 553 | ig_md.total_bytes=0; 554 | ig_md.min_pkt_length=0; 555 | ig_md.max_pkt_length=0; 556 | ig_md.min_ipd=0; 557 | // ig_md.feat1_encode=0; 558 | // ig_md.feat2_encode=0; 559 | ig_md.feat3_encode=0; 560 | ig_md.feat4_encode=0; 561 | ig_md.feat5_encode=0; 562 | ig_md.feat6_encode=0; 563 | ig_md.feat7_encode=0; 564 | ig_md.feat8_encode=0; 565 | ig_md.feat9_encode=0; 566 | ig_md.feat10_encode=0; 567 | ig_md.feat11_encode=0; 568 | ig_md.feat12_encode=0; 569 | ig_md.feat13_encode=0; 570 | ig_md.feat14_encode=0; 571 | ig_md.feat15_encode=0; 572 | ig_md.feat16_encode=0; 573 | 574 | 575 | ig_md.tree1_confidence= 0; 576 | ig_md.result = 0; 577 | ig_md.flow_size = 0; 578 | 579 | ig_md.zoom_pkt_length = hdr.ipv4.total_len >> 2; //Zoom in 4 times, if some datasets have packets larger than 1500, to prevent overflow 580 | 581 | ig_md.now_timestamp = (bit<32>) ig_prsr_md.global_tstamp>>20; // ms 582 | 583 | ig_md.flow_index = ig_md.flow_hash[Register_Index_Size-1:0]; 584 | 585 | Feat3.apply(); 586 | Feat4.apply(); 587 | Feat5.apply(); 588 | Feat6.apply(); 589 | Feat7.apply(); 590 | Feat8.apply(); 591 | Feat9.apply(); 592 | 593 | Flow_Size_Tree.apply(); 594 | ig_tm_md.ucast_egress_port = egress_port; 595 | 596 | if(ig_intr_md.ingress_port == recirculate_port){ //recirculate packet 597 | Update_full_flow_hash(); 598 | Update_result(); 599 | ig_md.tree1_confidence = hdr.ipv4.diffserv; 600 | ig_md.total_pkts = hdr.ipv4.identification; 601 | } 602 | else{ 603 | Read_result(); 604 | Read_full_flow_hash(); 605 | if(!Flow_result.apply().hit){ 606 | if(ig_md.flow_hash!=ig_md.flow_hash1){// new flow 607 | Read_last_classified_timestamp(); 608 | if(ig_md.flow_size>50){ //long flow 609 | if(!(ig_md.result<50 && ig_md.last_classified < timeout_thres)){ //determined result or timeout 610 | Init_bin1_table.apply(); 611 | Init_bin2_table.apply(); 612 | Init_total_pkts_table.apply(); 613 | Init_total_bytes_table.apply(); 614 | Init_min_pkt_length_table.apply(); 615 | Init_max_pkt_length_table.apply(); 616 | Init_pkt_length_power_sum_table.apply(); 617 | ig_md.ipd = (bit<32>) ig_prsr_md.global_tstamp>>10;//us 618 | Init_last_pkt_timestamp_table.apply(); 619 | Init_min_ipd_table.apply(); 620 | ig_tm_md.ucast_egress_port = recirculate_port; //init result register by recirculate 621 | } 622 | } 623 | ig_md.result = 0; 624 | } 625 | else{ 626 | Update_last_classified_timestamp(); 627 | if(ig_md.result<50){ 628 | pkt_bin1.apply(); 629 | pkt_bin2.apply(); 630 | Update_total_pkts_table.apply(); 631 | Update_total_bytes_table.apply(); 632 | Update_min_pkt_length_table.apply(); 633 | Update_max_pkt_length_table.apply(); 634 | Update_pkt_length_power_sum_table.apply(); 635 | ig_md.ipd = (bit<32>) ig_prsr_md.global_tstamp>>10; //Multiplex ipd as current time 636 | Update_last_pkt_timestamp_table.apply(); 637 | Update_min_ipd_table.apply(); 638 | 639 | if (ig_md.total_pkts==2){ 640 | ig_md.pkt_size_avg = ig_md.total_bytes>>1; 641 | //ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum>>1; 642 | ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum<<3; //if zoom before 643 | Update_total_bytes_power(); 644 | ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum-ig_md.total_bytes_power; 645 | ig_md.tree1_confidence = 110; 646 | } 647 | else if (ig_md.total_pkts==4){ 648 | ig_md.pkt_size_avg = ig_md.total_bytes>>2; 649 | //ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum>>2; 650 | ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum<<2; 651 | Update_total_bytes_power(); 652 | ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum-ig_md.total_bytes_power; 653 | ig_md.tree1_confidence = 110; 654 | } 655 | else if (ig_md.total_pkts==8){ 656 | ig_md.pkt_size_avg = ig_md.total_bytes>>3; 657 | //ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum>>3; 658 | ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum<<1; 659 | Update_total_bytes_power(); 660 | ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum-ig_md.total_bytes_power; 661 | ig_md.tree1_confidence = 110; 662 | } 663 | else if(ig_md.total_pkts==32){ 664 | ig_md.pkt_size_avg = ig_md.total_bytes>>5; 665 | //ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum>>5; 666 | ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum>>1; 667 | Update_total_bytes_power(); 668 | ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum-ig_md.total_bytes_power; 669 | ig_md.tree1_confidence = 110; 670 | } 671 | else if (ig_md.total_pkts==256){ 672 | ig_md.pkt_size_avg = ig_md.total_bytes>>8; 673 | //ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum>>8; 674 | ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum>>4; 675 | Update_total_bytes_power(); 676 | ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum-ig_md.total_bytes_power; 677 | ig_md.tree1_confidence = 110; 678 | } 679 | else if(ig_md.total_pkts==512){ 680 | ig_md.pkt_size_avg = ig_md.total_bytes>>9; 681 | //ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum>>9; 682 | ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum>>5; 683 | Update_total_bytes_power(); 684 | ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum-ig_md.total_bytes_power; 685 | ig_md.tree1_confidence = 110; 686 | } 687 | else if (ig_md.total_pkts==1024){ 688 | ig_md.pkt_size_avg = ig_md.total_bytes>>10; 689 | //ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum>>10; 690 | ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum>>6; 691 | Update_total_bytes_power(); 692 | ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum-ig_md.total_bytes_power; 693 | ig_md.tree1_confidence = 110; 694 | } 695 | else if(ig_md.total_pkts==2048){ 696 | ig_md.pkt_size_avg = ig_md.total_bytes>>11; 697 | //ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum>>11; 698 | ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum>>7; 699 | Update_total_bytes_power(); 700 | ig_md.pkt_length_power_sum = ig_md.pkt_length_power_sum-ig_md.total_bytes_power; 701 | ig_md.tree1_confidence = 110; 702 | } 703 | if (ig_md.tree1_confidence==110){ 704 | Feat10.apply(); 705 | Feat11.apply(); 706 | Feat12.apply(); 707 | Feat13.apply(); 708 | Feat14.apply(); 709 | Feat15.apply(); 710 | Feat16.apply(); 711 | Flow_Tree.apply(); 712 | ig_tm_md.ucast_egress_port = recirculate_port; //recirculate 713 | if(ig_md.result>50){ //determined 714 | ig_dprsr_md.digest_type = 2; //digest 715 | } 716 | } 717 | } 718 | } 719 | } 720 | 721 | } 722 | if(ig_md.result==0){ 723 | Pkt_Tree.apply(); 724 | } 725 | 726 | Treatment.apply(); 727 | 728 | // debug 729 | hdr.ipv4.ttl = ig_md.result; //as log 730 | hdr.ethernet.dst_addr = 0; //for filter 731 | ig_tm_md.bypass_egress = 1; 732 | if(hdr.ipv4.src_addr==0){ 733 | ig_dprsr_md.drop_ctl = 1; 734 | } 735 | } 736 | } 737 | 738 | Pipeline(SwitchIngressParser(), 739 | SwitchIngress(), 740 | SwitchIngressDeparser(), 741 | EmptyEgressParser(), 742 | EmptyEgress(), 743 | EmptyEgressDeparser()) pipe; 744 | 745 | Switch(pipe) main; -------------------------------------------------------------------------------- /switch/data_plane/util.p4: -------------------------------------------------------------------------------- 1 | /* -*- P4_16 -*- */ 2 | 3 | /******************************************************************************* 4 | * BAREFOOT NETWORKS CONFIDENTIAL & PROPRIETARY 5 | * 6 | * Copyright (c) Intel Corporation 7 | * SPDX-License-Identifier: CC-BY-ND-4.0 8 | */ 9 | 10 | 11 | 12 | #ifndef _UTIL_ 13 | #define _UTIL_ 14 | 15 | parser TofinoIngressParser( 16 | packet_in pkt, 17 | out ingress_intrinsic_metadata_t ig_intr_md) { 18 | 19 | state start { 20 | pkt.extract(ig_intr_md); 21 | transition select(ig_intr_md.resubmit_flag) { 22 | 1 : parse_resubmit; 23 | 0 : parse_port_metadata; 24 | } 25 | } 26 | 27 | state parse_resubmit { 28 | // Parse resubmitted packet here. 29 | transition reject; 30 | } 31 | 32 | state parse_port_metadata { 33 | pkt.advance(PORT_METADATA_SIZE); 34 | transition accept; 35 | } 36 | } 37 | 38 | parser TofinoEgressParser( 39 | packet_in pkt, 40 | out egress_intrinsic_metadata_t eg_intr_md) { 41 | state start { 42 | pkt.extract(eg_intr_md); 43 | transition accept; 44 | } 45 | } 46 | 47 | // Skip egress 48 | control BypassEgress(inout ingress_intrinsic_metadata_for_tm_t ig_tm_md) { 49 | 50 | action set_bypass_egress() { 51 | ig_tm_md.bypass_egress = 1w1; 52 | } 53 | 54 | table bypass_egress { 55 | actions = { 56 | set_bypass_egress(); 57 | } 58 | const default_action = set_bypass_egress; 59 | } 60 | 61 | apply { 62 | bypass_egress.apply(); 63 | } 64 | } 65 | 66 | // Empty egress parser/control blocks 67 | parser EmptyEgressParser( 68 | packet_in pkt, 69 | out empty_header_t hdr, 70 | out empty_metadata_t eg_md, 71 | out egress_intrinsic_metadata_t eg_intr_md) { 72 | state start { 73 | transition accept; 74 | } 75 | } 76 | 77 | control EmptyEgressDeparser( 78 | packet_out pkt, 79 | inout empty_header_t hdr, 80 | in empty_metadata_t eg_md, 81 | in egress_intrinsic_metadata_for_deparser_t ig_intr_dprs_md) { 82 | apply {} 83 | } 84 | 85 | control EmptyEgress( 86 | inout empty_header_t hdr, 87 | inout empty_metadata_t eg_md, 88 | in egress_intrinsic_metadata_t eg_intr_md, 89 | in egress_intrinsic_metadata_from_parser_t eg_intr_md_from_prsr, 90 | inout egress_intrinsic_metadata_for_deparser_t ig_intr_dprs_md, 91 | inout egress_intrinsic_metadata_for_output_port_t eg_intr_oport_md) { 92 | apply {} 93 | } 94 | 95 | #endif /* _UTIL */ --------------------------------------------------------------------------------