├── .gitattributes ├── LICENSE ├── README.md ├── images ├── image-20240530140503115.png ├── image-20240530140532240.png ├── image-20240530140602240.png ├── image-20240530140622546.png └── image-20240530141656822.png ├── requirements.txt └── web_app ├── app.py ├── ctu13_boruta_X.npy ├── ctu13_boruta_features.csv ├── ctu13_boruta_model_result.csv ├── ctu13_corr_X.npy ├── ctu13_corr_features.csv ├── ctu13_y.npy ├── data ├── CIC-IDS │ ├── Benign_log │ │ ├── Cloudflare │ │ │ ├── conn.log │ │ │ ├── flowmeter.log │ │ │ ├── ssl.log │ │ │ └── x509.log │ │ └── Google │ │ │ ├── conn.log │ │ │ ├── flowmeter.log │ │ │ ├── ssl.log │ │ │ └── x509.log │ ├── Malicious_log │ │ ├── dns2tcp │ │ │ ├── merge │ │ │ │ ├── conn.log │ │ │ │ ├── flowmeter.log │ │ │ │ ├── ssl.log │ │ │ │ └── x509.log │ │ │ ├── merge1201 │ │ │ │ ├── conn.log │ │ │ │ ├── flowmeter.log │ │ │ │ ├── ssl.log │ │ │ │ └── x509.log │ │ │ ├── merge1802 │ │ │ │ ├── conn.log │ │ │ │ ├── flowmeter.log │ │ │ │ ├── ssl.log │ │ │ │ └── x509.log │ │ │ └── merge2402 │ │ │ │ ├── conn.log │ │ │ │ ├── flowmeter.log │ │ │ │ └── ssl.log │ │ ├── dnscat2 │ │ │ ├── dnscat2_1201 │ │ │ │ ├── conn.log │ │ │ │ ├── flowmeter.log │ │ │ │ ├── ssl.log │ │ │ │ └── x509.log │ │ │ └── dnscat2_1802 │ │ │ │ ├── conn.log │ │ │ │ ├── flowmeter.log │ │ │ │ ├── ssl.log │ │ │ │ └── x509.log │ │ └── iodine │ │ │ ├── iodine_1201 │ │ │ ├── conn.log │ │ │ ├── flowmeter.log │ │ │ └── ssl.log │ │ │ └── iodine_1802 │ │ │ ├── conn.log │ │ │ ├── flowmeter.log │ │ │ ├── ssl.log │ │ │ └── x509.log │ └── pcap_sample │ │ ├── Benign │ │ ├── conn.log │ │ ├── flowmeter.log │ │ ├── ssl.log │ │ └── x509.log │ │ └── Malicious │ │ ├── conn.log │ │ ├── flowmeter.log │ │ ├── ssl.log │ │ └── x509.log └── CTU13 │ ├── Bunitu │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log │ ├── Cobalt │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log │ ├── Dridex_ │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log │ ├── Normal │ ├── capture1 │ │ ├── conn.log │ │ ├── flowmeter.log │ │ ├── ssl.log │ │ └── x509.log │ ├── capture2 │ │ ├── conn.log │ │ ├── flowmeter.log │ │ ├── ssl.log │ │ └── x509.log │ └── capture3 │ │ ├── conn.log │ │ ├── flowmeter.log │ │ ├── ssl.log │ │ └── x509.log │ ├── TRasftuby │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log │ ├── Tickbot │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log │ ├── Trojan_Yakes │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log │ └── Vawtrak │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log ├── doh_boruta_X.npy ├── doh_boruta_features.csv ├── doh_boruta_model_result.csv ├── doh_corr_X.npy ├── doh_corr_features.csv ├── doh_y.npy ├── logs ├── Bunitu │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log ├── Cobalt │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log ├── Dridex_ │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log ├── TRasftuby │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log ├── Tickbot │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log ├── Trojan_Yakes │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log ├── Vawtrak │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log ├── benign_small │ ├── conn.log │ ├── dce_rpc.log │ ├── dns.log │ ├── files.log │ ├── flowmeter.log │ ├── http.log │ ├── kerberos.log │ ├── ldap.log │ ├── ldap_search.log │ ├── ntlm.log │ ├── ntp.log │ ├── ocsp.log │ ├── packet_filter.log │ ├── smb_files.log │ ├── smb_mapping.log │ ├── ssl.log │ ├── weird.log │ └── x509.log ├── capture1 │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log ├── capture2 │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log ├── capture3 │ ├── conn.log │ ├── flowmeter.log │ ├── ssl.log │ └── x509.log └── malicious_small │ ├── analyzer.log │ ├── conn.log │ ├── dce_rpc.log │ ├── dns.log │ ├── files.log │ ├── flowmeter.log │ ├── ftp.log │ ├── http.log │ ├── ldap.log │ ├── ldap_search.log │ ├── ntp.log │ ├── ocsp.log │ ├── packet_filter.log │ ├── pe.log │ ├── smb_files.log │ ├── smb_mapping.log │ ├── ssh.log │ ├── ssl.log │ ├── weird.log │ └── x509.log ├── model ├── __init__.py ├── load_data_ctu13.py └── load_data_doh.py ├── static ├── css │ └── style.css └── imgs │ ├── ctu13_corr_heatmap.png │ ├── doh_corr_heatmap.png │ ├── icon.svg │ ├── p1.jpg │ ├── p2.jpg │ ├── p3.jpg │ ├── p4.jpg │ ├── p5.jpg │ ├── p6.jpg │ ├── p7.jpg │ └── p8.jpg ├── templates ├── boruta_ML_ctu-13.html ├── boruta_ML_doh.html ├── corr_analyze_ctu-13.html ├── corr_analyze_doh.html ├── feature_LT_ctu-13.html ├── feature_LT_doh.html ├── files.html ├── index.html ├── parse.html ├── show_data_ctu-13.html ├── show_data_doh.html ├── student.html ├── teacher.html └── upload.html └── uploads ├── benign_small.pcap ├── malicious_small.pcap └── ssl.log /.gitattributes: -------------------------------------------------------------------------------- 1 | *.pcap filter=lfs diff=lfs merge=lfs -text 2 | *.log filter=lfs diff=lfs merge=lfs -text 3 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2024 LRC_iu 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Graduate_Design 2 | ## 说明 3 | 本项目是：基于机器学习的加密恶意流量检测
参考项目：https://github.com/Timeless-zfqi/AS-DMF-framework 4 | ## 简介 5 | 本项目是本科毕设题目，依托参考项目课题组完成，首先向课题组表示感谢；其次，项目是关于机器学习的加密恶意流量检测，本人首次接触这个方向，是纯小白，内容不是很饱满，但是本项目针对自己的论文结构进行了web页面展示，方便熟悉论文结构框架的同时，呈现了一个基本的加密恶意流量检测的流程。最后，希望有不足之处可以得到谅解、有问题之处可以提出并相互学习！ 6 | ## 环境 7 | 所需环境：Python 3.8(ubuntu20.04)、zeek version 7.0.0-dev.102，Zeek flowmeter
8 | 安装所需要的包——requirements.txt中罗列主要的包，如遇到相关包未安装的报错问题，自行安装即可。 9 | ## web界面 10 | 本项目是基于Flask和bootstrap进行开发，是一个简单的可视化任务。
11 | 运行项目：终端中进入项目的文件夹，执行指令“python app.py”。 12 | ### 基础功能展示 13 | #### 主页 14 | ![image](https://github.com/face-gold/Graduate_Design/blob/main/images/image-20240530140503115.png) 15 | #### 上传文件 16 | ![image](https://github.com/face-gold/Graduate_Design/blob/main/images/image-20240530140532240.png) 17 | #### 解析文件 18 | ![image](https://github.com/face-gold/Graduate_Design/blob/main/images/image-20240530140602240.png) 19 | #### 解析结果 20 | ![image](https://github.com/face-gold/Graduate_Design/blob/main/images/image-20240530140622546.png) 21 | #### 实验数据展示 22 | ![image](https://github.com/face-gold/Graduate_Design/blob/main/images/image-20240530141656822.png) 23 | ### 注意 24 | 本项目的可视化任务目的是为了毕业答辩时更好地展示本人的论文实现框架。
25 | 运行指令后进入web页面，在进入CTU-13或者是DOH模块时，其执行的顺序应该是：
26 | 1. 数据展示 27 | 2. 相关性分析 28 | 3. Boruta特征选择 29 | 4. 特征轻量化 30 | 31 | 为了更好演示，本项目在代码中设置了缓存，其缓存时限设置了永久，可按需修改。
32 | 注意整个web项目的实现逻辑是：上传的pcap流量包保存在uploads文件夹下，在页面上选择要解析的pcap文件，所得到的解析结果保存在logs文件夹下，所以在读取数据时，需要根据logs文件夹下的文件路径来读取数据。
33 | 本项目由于时间原因，直接把解析后的数据保存在data文件夹下，所以在读取数据时，使用的是data文件夹下的文件路径来读取数据。 34 | -------------------------------------------------------------------------------- /images/image-20240530140503115.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/images/image-20240530140503115.png -------------------------------------------------------------------------------- /images/image-20240530140532240.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/images/image-20240530140532240.png -------------------------------------------------------------------------------- /images/image-20240530140602240.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/images/image-20240530140602240.png -------------------------------------------------------------------------------- /images/image-20240530140622546.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/images/image-20240530140622546.png -------------------------------------------------------------------------------- /images/image-20240530141656822.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/images/image-20240530141656822.png -------------------------------------------------------------------------------- /requirements.txt: -------------------------------------------------------------------------------- 1 | scikit-learn 2 | xgboost 3 | scipy 4 | pandas 5 | seaborn 6 | Boruta 7 | flask 8 | Flask-Bootstrap 9 | topsispy 10 | zat -------------------------------------------------------------------------------- /web_app/ctu13_boruta_X.npy: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/ctu13_boruta_X.npy -------------------------------------------------------------------------------- /web_app/ctu13_boruta_model_result.csv: -------------------------------------------------------------------------------- 1 | ,accuracy,precision,f1,auc,TPR,FPR,run_time 2 | RF,1.0,1.0,1.0,1.0,1.0,0.0,6.445943832397461 3 | XGB,1.0,1.0,1.0,1.0,1.0,0.0,0.22814536094665527 4 | GNB,0.7696728932465556,0.9786940343296123,0.7053353229957395,0.7696692024573785,0.5513405686851269,0.01200216377036987,0.02354264259338379 5 | SVC,0.9677288479418477,0.9843498354456971,0.9671648979170607,0.9677285578757764,0.95056969942861,0.015112583677057272,48.719125270843506 6 | -------------------------------------------------------------------------------- /web_app/ctu13_corr_X.npy: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/ctu13_corr_X.npy -------------------------------------------------------------------------------- /web_app/ctu13_y.npy: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/ctu13_y.npy -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Benign_log/Cloudflare/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:91b936dc73c6b343a23a9d126617494a98dd02122b7ffefb9182f1fd51a00c48 3 | size 7265526 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Benign_log/Cloudflare/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:ef1d4d5171e5ed4c388c1c96b4e2fbd1fcb64a3f667688689c355816ea47ebe5 3 | size 32872996 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Benign_log/Cloudflare/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:74fc2a4abf553d382614e3b9d5923cb41639dfd118b74ae2c1325cffafc66425 3 | size 18316667 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Benign_log/Cloudflare/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:a9a5729a6bbf102770b0a0cb8dbc9deccd763a3a39a30c62aed6fe7f4aad7bed 3 | size 2510570 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Benign_log/Google/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:f0d8a6ae2dc4162c570edf32e404828c56aa5312679589399e3d4a1b6c931f8e 3 | size 7311630 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Benign_log/Google/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:80095a74835ac5f7ff6a39bc7b3c3f3fdd979126e7da9de38f72ef800c7b6348 3 | size 33007916 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Benign_log/Google/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:0651fd47f5a5791559395b25c83da563d0f76bc534f4bedc429bbf48b26b97bd 3 | size 18110278 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Benign_log/Google/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:a8f2fdb13981df0438ffd470cada1afe1541cdf699c54f3d6e338902ca28dde0 3 | size 2372604 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dns2tcp/merge/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:5eb15e896a606f0b8107736bdb51a09468ad93b83815dee023c4564f3883e075 3 | size 288896 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dns2tcp/merge/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:a792da0974f9b31844913c90dc1a20793ce82d8ac7b4ff4b96a411a4ff50ba58 3 | size 1392305 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dns2tcp/merge/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:e274d4dd22a78591281381c0fbc3e65883c20acfebff204399aaca685f96bcd9 3 | size 268134 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dns2tcp/merge/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:b6f696bbef0dadbbe708092ad27056c9ec0db4d818578b0c1d6351dd61ac60d7 3 | size 3770 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dns2tcp/merge1201/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:375471f63a7c399e549713998394f28ac18ef6d7429e9f21fc53c3e9cc4c3883 3 | size 14417503 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dns2tcp/merge1201/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:eb85f735d3aa50a985dc81773f5dcaa2118f36c7b332548c3682db7cbf7b085c 3 | size 69191707 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dns2tcp/merge1201/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:851cc4bfddb154c17e20ecf06685932082b6a4b6e834f0b6f996dc9432e2688c 3 | size 14676690 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dns2tcp/merge1201/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:63b45579e6ee9e1e603e6af1057e2273026b85aba0497ca791e6d1b9890e56bf 3 | size 6847 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dns2tcp/merge1802/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:355057ffe618c288989310bae2bc63861e77d52337e9ced319ba87475b7ed0b1 3 | size 4389441 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dns2tcp/merge1802/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:35c3927a21174441f15ea2e16778016416f942b9f3361b28929402bc59f3fc80 3 | size 21585484 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dns2tcp/merge1802/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:98a244c7722ed8247bd7d49dc9a76ef004e98a6227bb309d3e3bd48ad6772efb 3 | size 4459296 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dns2tcp/merge1802/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:f07d211722a771dc8469a7368b64dd4eb69fc50ae7b007732b5d6998c3841272 3 | size 3770 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dns2tcp/merge2402/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:6da157455bda970a120a9b8f6bd01871903ec53a2a0bf40cbaf2c74fecfc2251 3 | size 1666738 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dns2tcp/merge2402/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:b074bce122c0bed62b11eba17f0e671127d0bdde929b0e5e84f3303fa905cd7f 3 | size 7322389 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dns2tcp/merge2402/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:c6900dda1c128d2934b8cb80081b073d1748fc0f7398fb9fce913c9a8ff60ff5 3 | size 1807379 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dnscat2/dnscat2_1201/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:6cf1f305355fd127ef8cd62444f1e6046420e8e9475d5a3b914d3377c80f6737 3 | size 200910 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dnscat2/dnscat2_1201/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:2b9a72c0b9355ec018d0d072bd616ab7f10c949e6dd4d8edb868740129f96617 3 | size 959484 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dnscat2/dnscat2_1201/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:f91a23bfe62c0fbcacdc938be9dea723a3ccde58e15dc2b2596e45fe35f46732 3 | size 193337 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dnscat2/dnscat2_1201/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:ac5d6704256a62f310c456310d144e950cb234e9aadd88cb7c187777ecbea7e0 3 | size 6847 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dnscat2/dnscat2_1802/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:7b60378269db06c97cda6f6cd039b2b46740dd538ec28b51535b928f1f50f0de 3 | size 201209 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dnscat2/dnscat2_1802/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:747eb8a82c7f747c6cc6beaf1288450e8863881862d34b54d3ea08964cd393c6 3 | size 935144 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dnscat2/dnscat2_1802/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:a20a4f28435cf57d6abb76416a1ac1efd15d078fa9455d546b98305184c359bd 3 | size 208830 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/dnscat2/dnscat2_1802/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:75ce59ceab2ad29760171659fb7a299bbf6c0b94ce9194cb7fed138191cbc867 3 | size 3770 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/iodine/iodine_1201/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:ca3ff20527e8f24e058c0e694552460f57e5c540fc32b59e6a3017f264245660 3 | size 184380 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/iodine/iodine_1201/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:1fb471bbea80035d312f9c0257a17185fcfe1c219d341ba6aa49857aba606751 3 | size 865078 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/iodine/iodine_1201/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:ec8fa64d2d055432c3027df31698b6c22e3a14c79ac55cab1c9eddd235efe52f 3 | size 179992 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/iodine/iodine_1802/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:8f7014abbc87c660969ee9029d925d3c3cce4995172ba0ec5c187253a34cbb3e 3 | size 203522 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/iodine/iodine_1802/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:fb7a776a116b3fb1e6b668d00dfa200458ca35453907ed783f5e98377196ca61 3 | size 924991 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/iodine/iodine_1802/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:f1ed36431dfd8a3ac7c4aa729cb7e414086103ee4bc73045c4c12cfbb33df891 3 | size 198847 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/Malicious_log/iodine/iodine_1802/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:013e62c297d2c800b39865a1b03cfbba6172f8457dc9fc8827667251b4ba2174 3 | size 3770 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/pcap_sample/Benign/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:fc00673c93a41144e5f3de5d5fe33b310bfd6e928eff3ff8f3e13306ada52d68 3 | size 149295 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/pcap_sample/Benign/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:7f180d306f5902d178448ee7a4dcf1cde5047056ca6cf4297130007a703b4f61 3 | size 601434 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/pcap_sample/Benign/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:9cfbb2cfbecab3fcabfdcc15726d44d908e5ea6591837e6818be577b1be25120 3 | size 66635 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/pcap_sample/Benign/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:74e793317c174e89d0db314d217153d60e62d239e34cc92644882981d8de3f3c 3 | size 45074 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/pcap_sample/Malicious/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:b493e33cab5cc81efe0d112b379712b05431fdce5e45da12f5ee5e7609697580 3 | size 385817 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/pcap_sample/Malicious/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:7660885de6cd36f2a424090b982abd5ee41d59f02b18a1df4d4683af2c4c9d76 3 | size 1564989 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/pcap_sample/Malicious/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:158c8fd6f1904c178f6bde22485d235e9e80225d315f5737b27a627fe956a2a6 3 | size 114716 4 | -------------------------------------------------------------------------------- /web_app/data/CIC-IDS/pcap_sample/Malicious/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:aba28786ac9d1c2322012d1439fb379f44221114e72ef615757f851733e0517a 3 | size 53843 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Bunitu/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:504dfc81aace49984f95e5833b43dae073b4b045c5adfdecac9ddbfc65aa935f 3 | size 14088167 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Bunitu/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:6c8e2c5b9c1a7f46dd70e1c06fcb52cba846a887f6f0f644664ce5aec7b63e94 3 | size 58536169 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Bunitu/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:54de92f3b2328ee9c9c02ba1d22002382a05065817fed358840433cc13be5dff 3 | size 2883012 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Bunitu/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:b2b3418c813b0123a2578dadee9d7beccf4baa02f5312353f898023db767d296 3 | size 662345 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Cobalt/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:458b8eed2290407455774d71ecd7ed0b0f26931950ae9b0c0bf2f2f2732a3688 3 | size 106999974 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Cobalt/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:5809fca76957062154ae77df88dae1642ac26d87d38941098a1efe7e105ceac0 3 | size 283696543 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Cobalt/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:5daf90e27bc84cbcef0bda903d5a9656e31e054fc9cc50341d210e12489a73de 3 | size 85769 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Cobalt/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:4f2bff550d5cc3c11f6d23e03fc21f39094f3a3fcfef5331445551eacb43f7fd 3 | size 1178 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Dridex_/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:8a2d28b3eac2a38324ee4ec296935acdf5be9ff5bb79f9db68ccc215c36c7c9c 3 | size 239880211 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Dridex_/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:0d44aed58fb0f51c0b00205c179f91408455677301dfe27ce2bf70e8fc8532af 3 | size 691964327 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Dridex_/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:2e6c677871578823f5e2e97b30b2798ea3d23c92a981a234a64b90edd9ec58d7 3 | size 6729738 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Dridex_/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:7a7ff3b9c91eba69889d0ac1e6cb72160d266b9a9e546283157c3d3da10c9b8b 3 | size 82804 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Normal/capture1/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:4dc0a852dfdc05c2c261a85597255319d2254dc48e8e2295ae94d8b1ee53b267 3 | size 326195 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Normal/capture1/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:e15156af9c073cd2b206479200b01ed5e24d4dbe03e9627577238addb52a2f78 3 | size 1182212 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Normal/capture1/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:8dfea3e3ac75794af60d2f26df411f048cfc0dbc29c48bcad70578f9603c1e3c 3 | size 39920 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Normal/capture1/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:c96a5ab3b8acefbde4ffe794892638e513cd2b5f5a7ec36d785b2814d04f71fe 3 | size 19306 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Normal/capture2/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:144adeb30865bfed419be83d7791edc64b63ee469ccb322434c1b67da4ac71ca 3 | size 9954707 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Normal/capture2/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:41f07bc647eeb566c49f866f7fb025733852956b0d0fb47d094047f13488a5f4 3 | size 42106808 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Normal/capture2/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:5c480dd2f7a7d22f6bbf3945887075c877d4ab620ce4b03dc7ebb5ea3d201963 3 | size 4594360 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Normal/capture2/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:e31e678a4f7b384229a2c354150d2a5948d08903b75bfd9f306877cc00d1b63e 3 | size 504346 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Normal/capture3/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:604b134a3a739fcbe2c5aac77a4ddda8bbce8fa25014b5685e90c71ccbaade23 3 | size 11348958 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Normal/capture3/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:e125ba22f56d1d5d8368dba2a77ed8243917574f98e9b35fb518ecce48cb8900 3 | size 48027185 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Normal/capture3/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:aa12c5b6757934d000b1232e24800b22ce66f922d4ef4a39d6fd7875dd57cd3a 3 | size 5645542 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Normal/capture3/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:4f49441763282c2da61ad7e50e65bb840debbf74cdc19d4ce4626622c0298249 3 | size 565369 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/TRasftuby/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:a6557dbb4b9766a3fbb03e5e5be70bd9bc1793e179ac33daf848dbcb31d56308 3 | size 129789035 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/TRasftuby/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:bec3a79b438f988fde7991eaa84ba7346fd1c316c2b09755402d9c94f7582d43 3 | size 444283186 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/TRasftuby/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:586bf3d0888884c4036c620275e5836914e256b8b8297c086a3bbd235b7648fc 3 | size 20090 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/TRasftuby/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:8b314ed7b79bcee58f821516505f95556a4dcceb21124b066351dece9419f04b 3 | size 9425 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Tickbot/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:a1f2ab90ced7d31c34ba5ac2da983728b4af9e747c9ec103b38559112358ed4c 3 | size 41098368 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Tickbot/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:f3021f22ac83a7cee14cc17ef341e6bff2caeada27ea1f74cc8ca047d5e8b5b3 3 | size 173847480 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Tickbot/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:fd666c1bca1d5a3b77f761822d7ccc70296443dc6f9935a7fc0240218e487586 3 | size 54505281 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Tickbot/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:38e6df38eeda58ad961e25d20b631b9a6bfd91a4f4510dcfa477ec7662976374 3 | size 209476 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Trojan_Yakes/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:53afc3f4fe2a20a7f3b29ca6b319cdbb5422e9753737bdbec5cf2d64df25bee1 3 | size 198678533 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Trojan_Yakes/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:d940fc7b2850ccc16ce247aa0815eb901723ba46f579e0c7fe9e0f862e9ac05f 3 | size 592755804 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Trojan_Yakes/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:b5df7510557cecc95abad703fef6b01acb8fed29eac43d4a97258c749d2e45f2 3 | size 619380 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Trojan_Yakes/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:4793da41d6694d9ca2603b0f3efdd91618203920f3f70743ce9f892114a61039 3 | size 8700 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Vawtrak/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:149008ff930aca3ed1ff6bcc450a5cd23cf58124565dec5be36bd657a712f173 3 | size 263306724 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Vawtrak/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:107f231fd3aabda6b2351c01ea5f6a20c5b8546307daa83db6c40c907b60f3c7 3 | size 768566622 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Vawtrak/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:896c022e7ffc3b5d426a05086d237441dc086253fbc671e8fef5661284a94016 3 | size 48938004 4 | -------------------------------------------------------------------------------- /web_app/data/CTU13/Vawtrak/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:c729199d6cac10a5403cdcf5a3bd2d95dead22b8bbfda716369956f3ad334ad3 3 | size 166940 4 | -------------------------------------------------------------------------------- /web_app/doh_boruta_X.npy: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/doh_boruta_X.npy -------------------------------------------------------------------------------- /web_app/doh_boruta_model_result.csv: -------------------------------------------------------------------------------- 1 | ,accuracy,precision,f1,auc,TPR,FPR,run_time 2 | RF,1.0,1.0,1.0,1.0,1.0,0.0,19.634328365325928 3 | XGB,1.0,1.0,1.0,1.0,1.0,0.0,0.3386712074279785 4 | GNB,0.8893040564940016,0.8264266790024812,0.8990287620032299,0.8893040564940016,0.9856156963447418,0.20700758335673874,0.09713554382324219 5 | SVC,0.9937958913453436,0.9940982224408066,0.9937939926651717,0.9937958913453437,0.9934899490430527,0.005898166352365285,270.05676007270813 6 | -------------------------------------------------------------------------------- /web_app/doh_corr_X.npy: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/doh_corr_X.npy -------------------------------------------------------------------------------- /web_app/doh_y.npy: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/doh_y.npy -------------------------------------------------------------------------------- /web_app/logs/Bunitu/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:504dfc81aace49984f95e5833b43dae073b4b045c5adfdecac9ddbfc65aa935f 3 | size 14088167 4 | -------------------------------------------------------------------------------- /web_app/logs/Bunitu/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:6c8e2c5b9c1a7f46dd70e1c06fcb52cba846a887f6f0f644664ce5aec7b63e94 3 | size 58536169 4 | -------------------------------------------------------------------------------- /web_app/logs/Bunitu/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:54de92f3b2328ee9c9c02ba1d22002382a05065817fed358840433cc13be5dff 3 | size 2883012 4 | -------------------------------------------------------------------------------- /web_app/logs/Bunitu/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:b2b3418c813b0123a2578dadee9d7beccf4baa02f5312353f898023db767d296 3 | size 662345 4 | -------------------------------------------------------------------------------- /web_app/logs/Cobalt/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:458b8eed2290407455774d71ecd7ed0b0f26931950ae9b0c0bf2f2f2732a3688 3 | size 106999974 4 | -------------------------------------------------------------------------------- /web_app/logs/Cobalt/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:5809fca76957062154ae77df88dae1642ac26d87d38941098a1efe7e105ceac0 3 | size 283696543 4 | -------------------------------------------------------------------------------- /web_app/logs/Cobalt/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:5daf90e27bc84cbcef0bda903d5a9656e31e054fc9cc50341d210e12489a73de 3 | size 85769 4 | -------------------------------------------------------------------------------- /web_app/logs/Cobalt/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:4f2bff550d5cc3c11f6d23e03fc21f39094f3a3fcfef5331445551eacb43f7fd 3 | size 1178 4 | -------------------------------------------------------------------------------- /web_app/logs/Dridex_/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:8a2d28b3eac2a38324ee4ec296935acdf5be9ff5bb79f9db68ccc215c36c7c9c 3 | size 239880211 4 | -------------------------------------------------------------------------------- /web_app/logs/Dridex_/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:0d44aed58fb0f51c0b00205c179f91408455677301dfe27ce2bf70e8fc8532af 3 | size 691964327 4 | -------------------------------------------------------------------------------- /web_app/logs/Dridex_/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:2e6c677871578823f5e2e97b30b2798ea3d23c92a981a234a64b90edd9ec58d7 3 | size 6729738 4 | -------------------------------------------------------------------------------- /web_app/logs/Dridex_/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:7a7ff3b9c91eba69889d0ac1e6cb72160d266b9a9e546283157c3d3da10c9b8b 3 | size 82804 4 | -------------------------------------------------------------------------------- /web_app/logs/TRasftuby/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:a6557dbb4b9766a3fbb03e5e5be70bd9bc1793e179ac33daf848dbcb31d56308 3 | size 129789035 4 | -------------------------------------------------------------------------------- /web_app/logs/TRasftuby/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:bec3a79b438f988fde7991eaa84ba7346fd1c316c2b09755402d9c94f7582d43 3 | size 444283186 4 | -------------------------------------------------------------------------------- /web_app/logs/TRasftuby/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:586bf3d0888884c4036c620275e5836914e256b8b8297c086a3bbd235b7648fc 3 | size 20090 4 | -------------------------------------------------------------------------------- /web_app/logs/TRasftuby/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:8b314ed7b79bcee58f821516505f95556a4dcceb21124b066351dece9419f04b 3 | size 9425 4 | -------------------------------------------------------------------------------- /web_app/logs/Tickbot/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:a1f2ab90ced7d31c34ba5ac2da983728b4af9e747c9ec103b38559112358ed4c 3 | size 41098368 4 | -------------------------------------------------------------------------------- /web_app/logs/Tickbot/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:f3021f22ac83a7cee14cc17ef341e6bff2caeada27ea1f74cc8ca047d5e8b5b3 3 | size 173847480 4 | -------------------------------------------------------------------------------- /web_app/logs/Tickbot/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:fd666c1bca1d5a3b77f761822d7ccc70296443dc6f9935a7fc0240218e487586 3 | size 54505281 4 | -------------------------------------------------------------------------------- /web_app/logs/Tickbot/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:38e6df38eeda58ad961e25d20b631b9a6bfd91a4f4510dcfa477ec7662976374 3 | size 209476 4 | -------------------------------------------------------------------------------- /web_app/logs/Trojan_Yakes/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:53afc3f4fe2a20a7f3b29ca6b319cdbb5422e9753737bdbec5cf2d64df25bee1 3 | size 198678533 4 | -------------------------------------------------------------------------------- /web_app/logs/Trojan_Yakes/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:d940fc7b2850ccc16ce247aa0815eb901723ba46f579e0c7fe9e0f862e9ac05f 3 | size 592755804 4 | -------------------------------------------------------------------------------- /web_app/logs/Trojan_Yakes/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:b5df7510557cecc95abad703fef6b01acb8fed29eac43d4a97258c749d2e45f2 3 | size 619380 4 | -------------------------------------------------------------------------------- /web_app/logs/Trojan_Yakes/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:4793da41d6694d9ca2603b0f3efdd91618203920f3f70743ce9f892114a61039 3 | size 8700 4 | -------------------------------------------------------------------------------- /web_app/logs/Vawtrak/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:149008ff930aca3ed1ff6bcc450a5cd23cf58124565dec5be36bd657a712f173 3 | size 263306724 4 | -------------------------------------------------------------------------------- /web_app/logs/Vawtrak/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:107f231fd3aabda6b2351c01ea5f6a20c5b8546307daa83db6c40c907b60f3c7 3 | size 768566622 4 | -------------------------------------------------------------------------------- /web_app/logs/Vawtrak/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:896c022e7ffc3b5d426a05086d237441dc086253fbc671e8fef5661284a94016 3 | size 48938004 4 | -------------------------------------------------------------------------------- /web_app/logs/Vawtrak/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:c729199d6cac10a5403cdcf5a3bd2d95dead22b8bbfda716369956f3ad334ad3 3 | size 166940 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:c93a3cbb964ec2effc3d45b14b76d4390be35d91a69fdc74ccb8b7ffbbdb9ce2 3 | size 149368 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/dce_rpc.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:233819ace04d6ce2a06948944392adfb9f81907f9cb359398fb836f5551cc9e6 3 | size 1632 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/dns.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:6f8ab58f053f9ddd100e5ca9d91ee9c9089565a334887a161ceaae06495a1ecc 3 | size 265638 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/files.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:4572c06e55837944526c4f1e781c182b94af63f54c80003530df63343e46c64a 3 | size 24931 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:67e31c9371c5476e891aaa23cf49bd650d8b2f509b364222a6ba9ebb5919c5e6 3 | size 601452 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/http.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:db7065b3216c137ec6eb862836f3d5eacd285d2cf07d20c3d95c5c9e5fe42b56 3 | size 20716 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/kerberos.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:102a9a15ad215f55d4fe1ed16b4ef2c89188e6bdd51cb7a91bd0484eb01984d0 3 | size 3004 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/ldap.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:c9997bd65879d9b3b730cba8e935ca0c081e92c80d2237ce5ccfd9f0762db800 3 | size 979 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/ldap_search.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:e1a4d30084e78cf61c3378b67944469c90bf1ab54f5f55515bb85326f30a54aa 3 | size 2275 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/ntlm.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:e593f66ee9f1e680eac672b0fbd9f00d6760034d3e2d74f11ad898873702cab6 3 | size 496 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/ntp.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:a1ea8975ba3e8e4658b2cf6c384c3077c03923196a01a14411b65370f387ff46 3 | size 25872 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/ocsp.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:cd37e7a2a3527bd77665141cd6493b146f9eb1a7d8f5a33e5a90b4267aaa4e0b 3 | size 14404 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/packet_filter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:58cb38a2feefffec7ebe6cd54bea311232fc980ca38a8f321c69d443998b64a1 3 | size 278 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/smb_files.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:9b5e7cede05b74dbc8ce1b969b4263e1b7d421ad032861fd4c95aca2c1cead26 3 | size 962 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/smb_mapping.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:a45398919444fdadd122d65fefe017e095130fab07a0e344f672b3c376b30f17 3 | size 734 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:0a02b0b4886af477301fa2a35a8e61fe82c38c3a2af532f65fee5cad23ef2456 3 | size 66665 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/weird.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:b133d6e935e83188e9f898f70813daecba09d9f1a88536b6f77e46885632c84d 3 | size 2124 4 | -------------------------------------------------------------------------------- /web_app/logs/benign_small/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:f33fff2cb1375efe9330fb20abb84ad9ca721ce432a92322b957a7f66f021eef 3 | size 45074 4 | -------------------------------------------------------------------------------- /web_app/logs/capture1/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:4dc0a852dfdc05c2c261a85597255319d2254dc48e8e2295ae94d8b1ee53b267 3 | size 326195 4 | -------------------------------------------------------------------------------- /web_app/logs/capture1/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:e15156af9c073cd2b206479200b01ed5e24d4dbe03e9627577238addb52a2f78 3 | size 1182212 4 | -------------------------------------------------------------------------------- /web_app/logs/capture1/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:8dfea3e3ac75794af60d2f26df411f048cfc0dbc29c48bcad70578f9603c1e3c 3 | size 39920 4 | -------------------------------------------------------------------------------- /web_app/logs/capture1/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:c96a5ab3b8acefbde4ffe794892638e513cd2b5f5a7ec36d785b2814d04f71fe 3 | size 19306 4 | -------------------------------------------------------------------------------- /web_app/logs/capture2/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:144adeb30865bfed419be83d7791edc64b63ee469ccb322434c1b67da4ac71ca 3 | size 9954707 4 | -------------------------------------------------------------------------------- /web_app/logs/capture2/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:41f07bc647eeb566c49f866f7fb025733852956b0d0fb47d094047f13488a5f4 3 | size 42106808 4 | -------------------------------------------------------------------------------- /web_app/logs/capture2/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:5c480dd2f7a7d22f6bbf3945887075c877d4ab620ce4b03dc7ebb5ea3d201963 3 | size 4594360 4 | -------------------------------------------------------------------------------- /web_app/logs/capture2/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:e31e678a4f7b384229a2c354150d2a5948d08903b75bfd9f306877cc00d1b63e 3 | size 504346 4 | -------------------------------------------------------------------------------- /web_app/logs/capture3/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:604b134a3a739fcbe2c5aac77a4ddda8bbce8fa25014b5685e90c71ccbaade23 3 | size 11348958 4 | -------------------------------------------------------------------------------- /web_app/logs/capture3/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:e125ba22f56d1d5d8368dba2a77ed8243917574f98e9b35fb518ecce48cb8900 3 | size 48027185 4 | -------------------------------------------------------------------------------- /web_app/logs/capture3/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:aa12c5b6757934d000b1232e24800b22ce66f922d4ef4a39d6fd7875dd57cd3a 3 | size 5645542 4 | -------------------------------------------------------------------------------- /web_app/logs/capture3/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:4f49441763282c2da61ad7e50e65bb840debbf74cdc19d4ce4626622c0298249 3 | size 565369 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/analyzer.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:78044f150aeb939a6defd17f93f3d60d669f6c307ec2185ea7f73c6b8073d8c0 3 | size 491 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/conn.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:275490d70c6c7c062082c22d495e676087be1c4643b1f86c80cc861003f3e84a 3 | size 385887 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/dce_rpc.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:2a59b7c89537c4f86b4a0289c0d9852eb19a7a0689439d8925d9b3fc2856994d 3 | size 413 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/dns.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:270a50705c32ff4240d6d2795c540afe029ec07febb0c208282282ca9ada14c9 3 | size 781287 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/files.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:4ed60fc0607375a53c9daeb0ba09532e45c82790de9da38a9a52f7245bc24625 3 | size 73426 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/flowmeter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:ca15bd08756400b88fd9b41fcdec68e175564ab90390bc400ee2ec04410c0c07 3 | size 1565039 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/ftp.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:c9b70f2ccc336a8c299b31211b94fa43be781e83df97bc8ed8dc842e4ec4ee00 3 | size 867 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/http.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:4243d263c26b04bad097a494c3c20e3527bbae46202f1b332972d0fbbe83040f 3 | size 231443 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/ldap.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:5a146697cf79fb522ca017d03a088ab2e60e3d18b340dca24f7db725799258cb 3 | size 1039 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/ldap_search.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:2757fbfbaa32e73931680df839d317d7f2f09f55efdfc378519736d1a5a559f8 3 | size 640 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/ntp.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:150f188882c15494adf91e1376ebd39823db8938304c654fe667093185b7559e 3 | size 20258 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/ocsp.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:82df20812d622acb417df9020c4d605825c056e183f33c3df1ac78fcc01e041a 3 | size 15234 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/packet_filter.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:ce2f2316a02749632ac393b65bcc7459876769338a0a94f87a4cfd24338dfe36 3 | size 278 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/pe.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:d7e1765dcc914600a08017ac18e61ddaa48d359eaaa33c07a0f303233f720b67 3 | size 578 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/smb_files.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:887b58859589817cfde911da98a333f9f86cd470a7d5605c4408f8d1d222021c 3 | size 500 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/smb_mapping.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:f65a20deee9820e36f0738bfaad5b09c6b9a9caf0a96f3988b46c16d29e7c914 3 | size 414 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/ssh.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:a557e67d42d870b8b8c1c879785fea41cc0fa79fe6f5c42cf80d3c7426fd402c 3 | size 1435 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:30b28404a6b4839efdd345187720640309011b10dbc81264064d8ac9f2add648 3 | size 114719 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/weird.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:d03d72e66261800822ccdc566ec39023c55c9214f570a82d14f751922ecb4522 3 | size 5146 4 | -------------------------------------------------------------------------------- /web_app/logs/malicious_small/x509.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:5afbfca01e0ff6052e0c954e35b2772cdfeecda032b0012cd42ed68b1c7fe42a 3 | size 53843 4 | -------------------------------------------------------------------------------- /web_app/model/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/model/__init__.py -------------------------------------------------------------------------------- /web_app/model/load_data_ctu13.py: -------------------------------------------------------------------------------- 1 | # 导入所需要的包 2 | import numpy as np 3 | import pandas as pd 4 | import zat 5 | import os 6 | from zat.log_to_dataframe import LogToDataFrame 7 | from zat.dataframe_to_matrix import DataFrameToMatrix 8 | import matplotlib.pyplot as plt 9 | import seaborn as sns 10 | from sklearn.model_selection import learning_curve 11 | import warnings 12 | warnings.filterwarnings("ignore") 13 | 14 | # 将zeek提取到的日志数据读入python中 15 | def data_select(path1,path2,path3): 16 | log_to_df = LogToDataFrame() 17 | df_conn = log_to_df.create_dataframe(path1) 18 | df_ssl = log_to_df.create_dataframe(path2) 19 | df_flow = log_to_df.create_dataframe(path3) 20 | print('Read in conn {:d} Rows...'.format(len(df_conn))) 21 | print('Read in ssl {:d} Rows...'.format(len(df_ssl))) 22 | print('Read in flowmeter {:d} Rows...'.format(len(df_flow))) 23 | 24 | # Feature selection 25 | df_conn['uid_length'] =df_conn['uid'].str.len() 26 | features_conn = ['uid','orig_bytes','service', 'resp_bytes','conn_state', 27 | 'missed_bytes','orig_pkts','orig_ip_bytes','resp_pkts','resp_ip_bytes'] 28 | feature_df_conn = df_conn[features_conn] 29 | 30 | df_ssl['uid_length'] = df_ssl['uid'].str.len() 31 | features_ssl = ['uid','curve','resumed','established','version', 32 | 'cipher','subject','issuer'] 33 | feature_df_ssl= df_ssl[features_ssl] 34 | 35 | df_flow['uid_length'] = df_flow['uid'].str.len() 36 | features_flow = ['uid','flow_duration','fwd_pkts_tot','bwd_pkts_tot','fwd_data_pkts_tot','bwd_data_pkts_tot','fwd_pkts_per_sec','bwd_pkts_per_sec','flow_pkts_per_sec', 37 | 'down_up_ratio','fwd_header_size_tot','fwd_header_size_min','fwd_header_size_max','bwd_header_size_tot','bwd_header_size_min','bwd_header_size_max', 38 | 'flow_FIN_flag_count','flow_SYN_flag_count','flow_RST_flag_count','fwd_PSH_flag_count','bwd_PSH_flag_count','flow_ACK_flag_count', 39 | 'fwd_URG_flag_count','bwd_URG_flag_count','flow_CWR_flag_count','flow_ECE_flag_count', 40 | 'fwd_pkts_payload.max','fwd_pkts_payload.min','fwd_pkts_payload.tot','fwd_pkts_payload.avg','fwd_pkts_payload.std', 41 | 'bwd_pkts_payload.max','bwd_pkts_payload.min','bwd_pkts_payload.tot','bwd_pkts_payload.avg','bwd_pkts_payload.std', 42 | 'flow_pkts_payload.min','flow_pkts_payload.max','flow_pkts_payload.tot','flow_pkts_payload.avg','flow_pkts_payload.std', 43 | 'fwd_iat.min','fwd_iat.max', 'fwd_iat.tot','fwd_iat.avg','fwd_iat.std','bwd_iat.max','bwd_iat.min','bwd_iat.tot','bwd_iat.avg','bwd_iat.std', 44 | 'flow_iat.min','flow_iat.max','flow_iat.tot','flow_iat.avg','flow_iat.std','payload_bytes_per_second','fwd_subflow_pkts','bwd_subflow_pkts','fwd_subflow_bytes','bwd_subflow_bytes', 45 | 'fwd_bulk_bytes','bwd_bulk_bytes','fwd_bulk_packets','bwd_bulk_packets','fwd_bulk_rate','bwd_bulk_rate','active.min','active.max','active.tot','active.avg','active.std', 46 | 'idle.min','idle.max','idle.tot','idle.avg','idle.std','fwd_init_window_size','bwd_init_window_size','fwd_last_window_size','bwd_last_window_size'] 47 | feature_df_flow = df_flow[features_flow] 48 | # merge features with uid 49 | df_f1 = pd.merge(feature_df_flow,feature_df_conn,how='outer',on='uid') 50 | df_fsm= pd.merge(df_f1,feature_df_ssl,how='outer',on='uid') 51 | # only TLS flows 52 | df_onlytls = df_fsm.dropna(subset=['version']) 53 | # make sure a complete TLS connection 54 | df_onlytls1 = df_onlytls.query("established == 'T'") 55 | print(df_onlytls.shape,df_onlytls1.shape) 56 | return df_onlytls1 57 | 58 | # 注意整个web项目的实现逻辑是：上传的pcap流量包保存在uploads文件夹下，在页面上选择要解析的pcap文件， 59 | # 所得到的解析结果保存在logs文件夹下，所以在读取数据时，需要根据logs文件夹下的文件路径来读取数据 60 | # 本项目由于时间原因，直接把解析后的数据保存在data文件夹下，所以在读取数据时，使用的是data文件夹下的文件路径来读取数据 61 | 62 | # Benign 63 | #normal1 64 | # 获取当前脚本的绝对路径 65 | script_dir = os.path.dirname(os.path.abspath(__file__)) 66 | # 计算文件的绝对路径 67 | path1 = os.path.join(script_dir, "../data/CTU13/Normal/capture1/conn.log") 68 | path2 = os.path.join(script_dir, "../data/CTU13/Normal/capture1/ssl.log") 69 | path3 = os.path.join(script_dir, "../data/CTU13/Normal/capture1/flowmeter.log") 70 | ''' 71 | path1 =r"../data/CTU13/Normal/capture1/conn.log" 72 | path2 = r"../data/CTU13/Normal/capture1/ssl.log" 73 | path3 =r"../data/CTU13/Normal/capture1/flowmeter.log" 74 | ''' 75 | #进行数据选择 76 | normal1 = data_select(path1,path2,path3) 77 | print("缺失值判断：",normal1.isnull().any()) 78 | print("含缺失值的行统计：",normal1.isnull().sum()) 79 | print(normal1.shape) 80 | 81 | #normal2 82 | path1 = os.path.join(script_dir, "../data/CTU13/Normal/capture2/conn.log") 83 | path2 = os.path.join(script_dir, "../data/CTU13/Normal/capture2/ssl.log") 84 | path3 = os.path.join(script_dir, "../data/CTU13/Normal/capture2/flowmeter.log") 85 | ''' 86 | path1 =r"../data/CTU13/Normal/capture2/conn.log" 87 | path2 = r"../data/CTU13/Normal/capture2/ssl.log" 88 | path3 =r"../data/CTU13/Normal/capture2/flowmeter.log" 89 | ''' 90 | 91 | #进行数据选择 92 | normal2 = data_select(path1,path2,path3) 93 | print("缺失值判断：",normal2.isnull().any()) 94 | print("含缺失值的行统计：",normal2.isnull().sum()) 95 | print(normal2.shape) 96 | 97 | #normal3 98 | path1 = os.path.join(script_dir, "../data/CTU13/Normal/capture3/conn.log") 99 | path2 = os.path.join(script_dir, "../data/CTU13/Normal/capture3/ssl.log") 100 | path3 = os.path.join(script_dir, "../data/CTU13/Normal/capture3/flowmeter.log") 101 | ''' 102 | path1 =r"../data/CTU13/Normal/capture3/conn.log" 103 | path2 = r"../data/CTU13/Normal/capture3/ssl.log" 104 | path3 =r"../data/CTU13/Normal/capture3/flowmeter.log" 105 | ''' 106 | #进行数据选择 107 | normal3 = data_select(path1,path2,path3) 108 | print("缺失值判断：",normal3.isnull().any()) 109 | print("含缺失值的行统计：",normal3.isnull().sum()) 110 | print(normal3.shape) 111 | 112 | # Malicious 113 | #Bunitu 114 | path1 = os.path.join(script_dir, "../data/CTU13/Bunitu/conn.log") 115 | path2 = os.path.join(script_dir, "../data/CTU13/Bunitu/ssl.log") 116 | path3 = os.path.join(script_dir, "../data/CTU13/Bunitu/flowmeter.log") 117 | ''' 118 | path1 =r"../data/CTU13/Bunitu/conn.log" 119 | path2 = r"../data/CTU13/Bunitu/ssl.log" 120 | path3 =r"../data/CTU13/Bunitu/flowmeter.log" 121 | ''' 122 | 123 | #进行数据选择 124 | Bunitu = data_select(path1,path2,path3) 125 | print("缺失值判断：",Bunitu.isnull().any()) 126 | print("含缺失值的行统计：",Bunitu.isnull().sum()) 127 | print(Bunitu.shape) 128 | 129 | #Cobalt 130 | path1 = os.path.join(script_dir, "../data/CTU13/Cobalt/conn.log") 131 | path2 = os.path.join(script_dir, "../data/CTU13/Cobalt/ssl.log") 132 | path3 = os.path.join(script_dir, "../data/CTU13/Cobalt/flowmeter.log") 133 | ''' 134 | path1 =r"../data/CTU13/Cobalt/conn.log" 135 | path2 = r"../data/CTU13/Cobalt/ssl.log" 136 | path3 =r"../data/CTU13/Cobalt/flowmeter.log" 137 | ''' 138 | 139 | #进行数据选择 140 | Cobalt = data_select(path1,path2,path3) 141 | print("缺失值判断：",Cobalt.isnull().any()) 142 | print("含缺失值的行统计：",Cobalt.isnull().sum()) 143 | print(Cobalt.shape) 144 | 145 | #Dridex 146 | path1 = os.path.join(script_dir, "../data/CTU13/Dridex_/conn.log") 147 | path2 = os.path.join(script_dir, "../data/CTU13/Dridex_/ssl.log") 148 | path3 = os.path.join(script_dir, "../data/CTU13/Dridex_/flowmeter.log") 149 | ''' 150 | path1 =r"../data/CTU13/Dridex_/conn.log" 151 | path2 = r"../data/CTU13/Dridex_/ssl.log" 152 | path3 =r"../data/CTU13/Dridex_/flowmeter.log" 153 | ''' 154 | 155 | #进行数据选择 156 | Dridex = data_select(path1,path2,path3) 157 | Dridex = Dridex.iloc[:6630,:] 158 | print("缺失值判断：",Dridex.isnull().any()) 159 | print("含缺失值的行统计：",Dridex.isnull().sum()) 160 | print(Dridex.shape) 161 | 162 | #Tickbot 163 | path1 = os.path.join(script_dir, "../data/CTU13/Tickbot/conn.log") 164 | path2 = os.path.join(script_dir, "../data/CTU13/Tickbot/ssl.log") 165 | path3 = os.path.join(script_dir, "../data/CTU13/Tickbot/flowmeter.log") 166 | ''' 167 | path1 =r"../data/CTU13/Tickbot/conn.log" 168 | path2 = r"../data/CTU13/Tickbot/ssl.log" 169 | path3 =r"../data/CTU13/Tickbot/flowmeter.log" 170 | ''' 171 | 172 | #进行数据选择 173 | Tickbot = data_select(path1,path2,path3) 174 | Tickbot = Tickbot.iloc[:6630,:] 175 | print("缺失值判断：",Tickbot.isnull().any()) 176 | print("含缺失值的行判断：",Tickbot.isnull().sum()) 177 | print(Tickbot.shape) 178 | 179 | #TRasftuby 180 | path1 = os.path.join(script_dir, "../data/CTU13/TRasftuby/conn.log") 181 | path2 = os.path.join(script_dir, "../data/CTU13/TRasftuby/ssl.log") 182 | path3 = os.path.join(script_dir, "../data/CTU13/TRasftuby/flowmeter.log") 183 | ''' 184 | path1 =r"../data/CTU13/TRasftuby/conn.log" 185 | path2 = r"../data/CTU13/TRasftuby/ssl.log" 186 | path3 =r"../data/CTU13/TRasftuby/flowmeter.log" 187 | ''' 188 | 189 | #进行数据选择 190 | TRasftuby = data_select(path1,path2,path3) 191 | print("缺失值判断：",TRasftuby.isnull().any()) 192 | print("含缺失值的行判断：",TRasftuby.isnull().sum()) 193 | print(TRasftuby.shape) 194 | 195 | #Trojan_Yakes 196 | path1 = os.path.join(script_dir, "../data/CTU13/Trojan_Yakes/conn.log") 197 | path2 = os.path.join(script_dir, "../data/CTU13/Trojan_Yakes/ssl.log") 198 | path3 = os.path.join(script_dir, "../data/CTU13/Trojan_Yakes/flowmeter.log") 199 | ''' 200 | path1 =r"../data/CTU13/Trojan_Yakes/conn.log" 201 | path2 = r"../data/CTU13/Trojan_Yakes/ssl.log" 202 | path3 =r"../data/CTU13/Trojan_Yakes/flowmeter.log" 203 | ''' 204 | 205 | #进行数据选择 206 | Trojan_Yakes = data_select(path1,path2,path3) 207 | print("缺失值判断：",Trojan_Yakes.isnull().any()) 208 | print("含缺失值的行判断：",Trojan_Yakes.isnull().sum()) 209 | print(Trojan_Yakes.shape) 210 | 211 | #Vawtrak 212 | path1 = os.path.join(script_dir, "../data/CTU13/Vawtrak/conn.log") 213 | path2 = os.path.join(script_dir, "../data/CTU13/Vawtrak/ssl.log") 214 | path3 = os.path.join(script_dir, "../data/CTU13/Vawtrak/flowmeter.log") 215 | ''' 216 | path1 =r"../data/CTU13/Vawtrak/conn.log" 217 | path2 = r"../data/CTU13/Vawtrak/ssl.log" 218 | path3 =r"../data/CTU13/Vawtrak/flowmeter.log" 219 | ''' 220 | 221 | #进行数据选择 222 | Vawtrak = data_select(path1,path2,path3) 223 | Vawtrak = Vawtrak.iloc[:6630,:] 224 | print("缺失值判断：",Vawtrak.isnull().any()) 225 | print("含缺失值的行判断：",Vawtrak.isnull().sum()) 226 | print(Vawtrak.shape) 227 | 228 | 229 | # 数据合并 230 | Benign = pd.concat([normal1,normal2,normal3],axis=0) 231 | Malicious = pd.concat([Bunitu,Cobalt,Dridex,Tickbot,TRasftuby,Trojan_Yakes,Vawtrak],axis = 0) 232 | df = pd.concat([Malicious,Benign],axis=0) 233 | print('Malware size: {:d}'.format(len(Malicious))) 234 | print('Benign size: {:d}'.format(len(Benign))) 235 | all_zero_columns = df.apply(lambda x: all(x == 0)) 236 | # 删除包含零值的所有列 237 | df = df.drop(df.columns[all_zero_columns], axis=1) 238 | # 将timedelta64[ns]类型的数据转换为int类型 239 | df['flow_duration'] = df['flow_duration'].dt.total_seconds() 240 | df = df.drop('service',axis=1) 241 | df = df.drop('established',axis = 1) 242 | print(df.shape) 243 | #ob_feature = df.select_dtypes(include='object') 244 | #print(ob_feature.shape) 245 | new_df = df.select_dtypes(exclude='object') 246 | print(new_df.shape) 247 | 248 | # 创建标签 249 | y = np.hstack((np.full((1,len(Malicious)),0),np.full((1,len(Benign)),1))).T 250 | y = y.ravel() 251 | print(y.shape) 252 | 253 | 254 | #相关性分析，阈值选择0.4 255 | corr_matrix = new_df.corr() 256 | 257 | redundant_features = [] 258 | for i in range(len(corr_matrix.columns)): 259 | for j in range(i+1, len(corr_matrix.columns)): 260 | if abs(corr_matrix.iloc[i, j]) >= 0.4: 261 | redundant_features.append(corr_matrix.columns[j]) 262 | 263 | corr_features = new_df.drop(redundant_features, axis=1) 264 | 265 | # 保存corr_features到csv文件 266 | corr_features.to_csv('ctu13_corr_features.csv', index=False) 267 | 268 | print("Remaining features after removing redundancy:") 269 | print(corr_features.columns) 270 | print(corr_features.shape) 271 | 272 | # 绘制热力图 273 | plt.figure(figsize=(20, 20)) 274 | sns.heatmap(corr_features.corr(), annot=True, fmt=".2f") 275 | plt.show() 276 | 277 | 278 | # 标准化数据 279 | to_matrix = zat.dataframe_to_matrix.DataFrameToMatrix() 280 | corr_X = to_matrix.fit_transform(corr_features) 281 | print(corr_X.shape) 282 | 283 | # 保存数据 284 | np.save('ctu13_corr_X.npy', corr_X) 285 | np.save('ctu13_y.npy', y) 286 | -------------------------------------------------------------------------------- /web_app/model/load_data_doh.py: -------------------------------------------------------------------------------- 1 | # 导入所需要的包 2 | import numpy as np 3 | import pandas as pd 4 | import zat 5 | import os 6 | from zat.log_to_dataframe import LogToDataFrame 7 | from zat.dataframe_to_matrix import DataFrameToMatrix 8 | import matplotlib.pyplot as plt 9 | import seaborn as sns 10 | from sklearn.model_selection import learning_curve 11 | import warnings 12 | warnings.filterwarnings("ignore") 13 | 14 | # 将zeek提取到的日志数据读入python中 15 | def data_select(path1,path2,path3): 16 | log_to_df = LogToDataFrame() 17 | df_conn = log_to_df.create_dataframe(path1) 18 | df_ssl = log_to_df.create_dataframe(path2) 19 | df_flow = log_to_df.create_dataframe(path3) 20 | print('Read in conn {:d} Rows...'.format(len(df_conn))) 21 | print('Read in ssl {:d} Rows...'.format(len(df_ssl))) 22 | print('Read in flowmeter {:d} Rows...'.format(len(df_flow))) 23 | 24 | # Feature selection 25 | df_conn['uid_length'] =df_conn['uid'].str.len() 26 | features_conn = ['uid','orig_bytes','service', 'resp_bytes','conn_state', 27 | 'missed_bytes','orig_pkts','orig_ip_bytes','resp_pkts','resp_ip_bytes'] 28 | feature_df_conn = df_conn[features_conn] 29 | 30 | df_ssl['uid_length'] = df_ssl['uid'].str.len() 31 | features_ssl = ['uid','curve','resumed','established','version', 32 | 'cipher','subject','issuer'] 33 | feature_df_ssl= df_ssl[features_ssl] 34 | 35 | df_flow['uid_length'] = df_flow['uid'].str.len() 36 | features_flow = ['uid','flow_duration','fwd_pkts_tot','bwd_pkts_tot','fwd_data_pkts_tot','bwd_data_pkts_tot','fwd_pkts_per_sec','bwd_pkts_per_sec','flow_pkts_per_sec', 37 | 'down_up_ratio','fwd_header_size_tot','fwd_header_size_min','fwd_header_size_max','bwd_header_size_tot','bwd_header_size_min','bwd_header_size_max', 38 | 'flow_FIN_flag_count','flow_SYN_flag_count','flow_RST_flag_count','fwd_PSH_flag_count','bwd_PSH_flag_count','flow_ACK_flag_count', 39 | 'fwd_URG_flag_count','bwd_URG_flag_count','flow_CWR_flag_count','flow_ECE_flag_count', 40 | 'fwd_pkts_payload.max','fwd_pkts_payload.min','fwd_pkts_payload.tot','fwd_pkts_payload.avg','fwd_pkts_payload.std', 41 | 'bwd_pkts_payload.max','bwd_pkts_payload.min','bwd_pkts_payload.tot','bwd_pkts_payload.avg','bwd_pkts_payload.std', 42 | 'flow_pkts_payload.min','flow_pkts_payload.max','flow_pkts_payload.tot','flow_pkts_payload.avg','flow_pkts_payload.std', 43 | 'fwd_iat.min','fwd_iat.max', 'fwd_iat.tot','fwd_iat.avg','fwd_iat.std','bwd_iat.max','bwd_iat.min','bwd_iat.tot','bwd_iat.avg','bwd_iat.std', 44 | 'flow_iat.min','flow_iat.max','flow_iat.tot','flow_iat.avg','flow_iat.std','payload_bytes_per_second','fwd_subflow_pkts','bwd_subflow_pkts','fwd_subflow_bytes','bwd_subflow_bytes', 45 | 'fwd_bulk_bytes','bwd_bulk_bytes','fwd_bulk_packets','bwd_bulk_packets','fwd_bulk_rate','bwd_bulk_rate','active.min','active.max','active.tot','active.avg','active.std', 46 | 'idle.min','idle.max','idle.tot','idle.avg','idle.std','fwd_init_window_size','bwd_init_window_size','fwd_last_window_size','bwd_last_window_size'] 47 | feature_df_flow = df_flow[features_flow] 48 | # merge features with uid 49 | df_f1 = pd.merge(feature_df_flow,feature_df_conn,how='outer',on='uid') 50 | df_fsm= pd.merge(df_f1,feature_df_ssl,how='outer',on='uid') 51 | # only TLS flows 52 | df_onlytls = df_fsm.dropna(subset=['version']) 53 | # make sure a complete TLS connection 54 | df_onlytls1 = df_onlytls.query("established == 'T'") 55 | print(df_onlytls.shape,df_onlytls1.shape) 56 | return df_onlytls1 57 | 58 | # 注意整个web项目的实现逻辑是：上传的pcap流量包保存在uploads文件夹下，在页面上选择要解析的pcap文件， 59 | # 所得到的解析结果保存在logs文件夹下，所以在读取数据时，需要根据logs文件夹下的文件路径来读取数据 60 | # 本项目由于时间原因，直接把解析后的数据保存在data文件夹下，所以在读取数据时，使用的是data文件夹下的文件路径来读取数据 61 | 62 | # Benign 63 | #Google 64 | # 获取当前脚本的绝对路径 65 | script_dir = os.path.dirname(os.path.abspath(__file__)) 66 | # 计算文件的绝对路径 67 | path1 = os.path.join(script_dir, "../data/CIC-IDS/Benign_log/Google/conn.log") 68 | path2 = os.path.join(script_dir, "../data/CIC-IDS/Benign_log/Google/ssl.log") 69 | path3 = os.path.join(script_dir, "../data/CIC-IDS/Benign_log/Google/flowmeter.log") 70 | 71 | #进行数据选择 72 | Google = data_select(path1,path2,path3) 73 | print(Google.shape) 74 | 75 | #Cloudflare 76 | path1 = os.path.join(script_dir, "../data/CIC-IDS/Benign_log/Cloudflare/conn.log") 77 | path2 = os.path.join(script_dir, "../data/CIC-IDS/Benign_log/Cloudflare/ssl.log") 78 | path3 = os.path.join(script_dir, "../data/CIC-IDS/Benign_log/Cloudflare/flowmeter.log") 79 | 80 | 81 | #进行数据选择 82 | Cloudflare = data_select(path1,path2,path3) 83 | print(Cloudflare.shape) 84 | 85 | # Malicious 86 | #dns2tcp1 87 | path1 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dns2tcp/merge/conn.log") 88 | path2 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dns2tcp/merge/ssl.log") 89 | path3 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dns2tcp/merge/flowmeter.log") 90 | 91 | #进行数据选择 92 | dns2tcp1 = data_select(path1,path2,path3) 93 | print(dns2tcp1.shape) 94 | 95 | 96 | #dns2tcp2 97 | path1 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dns2tcp/merge1201/conn.log") 98 | path2 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dns2tcp/merge1201/ssl.log") 99 | path3 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dns2tcp/merge1201/flowmeter.log") 100 | 101 | #进行数据选择 102 | dns2tcp2 = data_select(path1,path2,path3) 103 | dns2tcp2 = dns2tcp2.iloc[:47596,:] 104 | print(dns2tcp2.shape) 105 | 106 | #dns2tcp3 107 | path1 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dns2tcp/merge1802/conn.log") 108 | path2 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dns2tcp/merge1802/ssl.log") 109 | path3 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dns2tcp/merge1802/flowmeter.log") 110 | 111 | #进行数据选择 112 | dns2tcp3 = data_select(path1,path2,path3) 113 | print(dns2tcp3.shape) 114 | 115 | #dns2tcp4 116 | path1 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dns2tcp/merge2402/conn.log") 117 | path2 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dns2tcp/merge2402/ssl.log") 118 | path3 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dns2tcp/merge2402/flowmeter.log") 119 | #进行数据选择 120 | dns2tcp4 = data_select(path1,path2,path3) 121 | print(dns2tcp4.shape) 122 | 123 | #dnscat2_1 124 | path1 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dnscat2/dnscat2_1201/conn.log") 125 | path2 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dnscat2/dnscat2_1201/ssl.log") 126 | path3 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dnscat2/dnscat2_1201/flowmeter.log") 127 | 128 | 129 | #进行数据选择 130 | dnscat2_1 = data_select(path1,path2,path3) 131 | print(dnscat2_1.shape) 132 | 133 | #dnscat2_2 134 | path1 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dnscat2/dnscat2_1802/conn.log") 135 | path2 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dnscat2/dnscat2_1802/ssl.log") 136 | path3 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/dnscat2/dnscat2_1802/flowmeter.log") 137 | 138 | #进行数据选择 139 | dnscat2_2 = data_select(path1,path2,path3) 140 | print(dnscat2_2.shape) 141 | 142 | #iodine1 143 | path1 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/iodine/iodine_1201/conn.log") 144 | path2 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/iodine/iodine_1201/ssl.log") 145 | path3 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/iodine/iodine_1201/flowmeter.log") 146 | 147 | #进行数据选择 148 | iodine1 = data_select(path1,path2,path3) 149 | print(iodine1.shape) 150 | 151 | #iodine2 152 | path1 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/iodine/iodine_1802/conn.log") 153 | path2 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/iodine/iodine_1802/ssl.log") 154 | path3 = os.path.join(script_dir, "../data/CIC-IDS/Malicious_log/iodine/iodine_1802/flowmeter.log") 155 | #进行数据选择 156 | iodine2 = data_select(path1,path2,path3) 157 | print(iodine2.shape) 158 | 159 | 160 | 161 | # 数据合并 162 | Benign = pd.concat([Google,Cloudflare],axis=0) # 合并所有正常样本 163 | Malicious = pd.concat([dns2tcp1,dns2tcp2,dns2tcp3,dns2tcp4,dnscat2_1,dnscat2_2,iodine1,iodine2],axis = 0) 164 | df = pd.concat([Malicious,Benign],axis=0) 165 | print('Malware size: {:d}'.format(len(Malicious))) 166 | print('Benign size: {:d}'.format(len(Benign))) 167 | all_zero_columns = df.apply(lambda x: all(x == 0)) 168 | # 删除包含零值的所有列 169 | df = df.drop(df.columns[all_zero_columns], axis=1) 170 | # 将timedelta64[ns]类型的数据转换为int类型 171 | df['flow_duration'] = df['flow_duration'].dt.total_seconds() 172 | df = df.drop('service',axis=1) 173 | df = df.drop('established',axis = 1) 174 | print(df.shape) 175 | #ob_feature = df.select_dtypes(include='object') 176 | #print(ob_feature.shape) 177 | new_df = df.select_dtypes(exclude='object') 178 | print(new_df.shape) 179 | 180 | # 创建标签 181 | y = np.hstack((np.full((1,len(Malicious)),0),np.full((1,len(Benign)),1))).T 182 | y = y.ravel() 183 | print(y.shape) 184 | 185 | 186 | #相关性分析，阈值选择0.4 187 | corr_matrix = new_df.corr() 188 | 189 | redundant_features = [] 190 | for i in range(len(corr_matrix.columns)): 191 | for j in range(i+1, len(corr_matrix.columns)): 192 | if abs(corr_matrix.iloc[i, j]) >= 0.4: 193 | redundant_features.append(corr_matrix.columns[j]) 194 | 195 | corr_features = new_df.drop(redundant_features, axis=1) 196 | 197 | # 保存corr_features到csv文件 198 | corr_features.to_csv('doh_corr_features.csv', index=False) 199 | 200 | print("Remaining features after removing redundancy:") 201 | print(corr_features.columns) 202 | print(corr_features.shape) 203 | 204 | # 绘制热力图 205 | plt.figure(figsize=(20, 20)) 206 | sns.heatmap(corr_features.corr(), annot=True, fmt=".2f") 207 | plt.show() 208 | 209 | 210 | # 标准化数据 211 | to_matrix = zat.dataframe_to_matrix.DataFrameToMatrix() 212 | corr_X = to_matrix.fit_transform(corr_features) 213 | print(corr_X.shape) 214 | 215 | # 保存数据 216 | np.save('doh_corr_X.npy', corr_X) 217 | np.save('doh_y.npy', y) 218 | -------------------------------------------------------------------------------- /web_app/static/css/style.css: -------------------------------------------------------------------------------- 1 | body { 2 | width: 100%; 3 | height: 100%; 4 | font-family: 'Helvetica'; 5 | background: black; 6 | color: #fff; 7 | text-align: center; 8 | letter-spacing: 1.4px; 9 | font-size: 30px; 10 | /* 背景使用文件夹中的图片 */ 11 | background-image: url('.//background.jpg'); 12 | } 13 | 14 | input { 15 | min-width: 150px; 16 | } 17 | 18 | .grid { 19 | width: 300px; 20 | border: 1px solid #2d2d2d; 21 | display: grid; 22 | justify-content: center; 23 | margin: 20px auto; 24 | } 25 | 26 | .box { 27 | color: #fff; 28 | background: #2d2d2d; 29 | padding: 12px; 30 | display: inline-block; 31 | } -------------------------------------------------------------------------------- /web_app/static/imgs/ctu13_corr_heatmap.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/static/imgs/ctu13_corr_heatmap.png -------------------------------------------------------------------------------- /web_app/static/imgs/doh_corr_heatmap.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/static/imgs/doh_corr_heatmap.png -------------------------------------------------------------------------------- /web_app/static/imgs/icon.svg: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /web_app/static/imgs/p1.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/static/imgs/p1.jpg -------------------------------------------------------------------------------- /web_app/static/imgs/p2.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/static/imgs/p2.jpg -------------------------------------------------------------------------------- /web_app/static/imgs/p3.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/static/imgs/p3.jpg -------------------------------------------------------------------------------- /web_app/static/imgs/p4.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/static/imgs/p4.jpg -------------------------------------------------------------------------------- /web_app/static/imgs/p5.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/static/imgs/p5.jpg -------------------------------------------------------------------------------- /web_app/static/imgs/p6.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/static/imgs/p6.jpg -------------------------------------------------------------------------------- /web_app/static/imgs/p7.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/static/imgs/p7.jpg -------------------------------------------------------------------------------- /web_app/static/imgs/p8.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/face-gold/Graduate_Design/9d2b8550de873ddcb0abe666348440e138fd3e28/web_app/static/imgs/p8.jpg -------------------------------------------------------------------------------- /web_app/templates/boruta_ML_ctu-13.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 加密恶意流量检测系统 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 32 | 33 | 102 | 103 | 104 |
105 |
106 |
107 | 134 | 163 |
164 |

165 | Hi Boruta & ML! 166 |

167 |

168 | This is the stage of feature select in Boruta algorithm and Model Training 169 |

170 |

Boruta特征选择

171 | 172 | {% for feature in features %} 173 |
  • {{ feature }}
    • 174 | {% endfor %} 175 |     176 |

    共选出{{ features | length }}个特征

    177 | 180 |

    最佳的两个模型

    181 |

    其定义: 各评估指标中, precision的值排第一和第二对应的模型

    182 |
      183 | {% for model in best_two_model %} 184 |
    • {{ model }}
      • 185 | {% endfor %} 186 |
    187 |

    模型表现如下：

    188 |
    189 |
    190 |
    191 |
    192 |
    193 |
    194 | 195 | 196 | -------------------------------------------------------------------------------- /web_app/templates/boruta_ML_doh.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 加密恶意流量检测系统 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 32 | 33 | 102 | 103 | 104 |
    105 |
    106 |
    107 | 134 | 163 |
    164 |

    165 | Hi Boruta & ML! 166 |

    167 |

    168 | This is the stage of feature select in Boruta algorithm and Model Training 169 |

    170 |

    Boruta特征选择

    171 | 172 | {% for feature in features %} 173 |
  • {{ feature }}
    • 174 | {% endfor %} 175 |     176 |

    共选出{{ features | length }}个特征

    177 | 180 |

    最佳的两个模型

    181 |

    其定义: 各评估指标中, precision的值排第一和第二对应的模型

    182 |
      183 | {% for model in best_two_model %} 184 |
    • {{ model }}
      • 185 | {% endfor %} 186 |
    187 |

    模型表现如下：

    188 |
    189 |
    190 |
    191 |
    192 |
    193 |
    194 | 195 | 196 | -------------------------------------------------------------------------------- /web_app/templates/corr_analyze_ctu-13.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 加密恶意流量检测系统 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 31 | 32 |
    33 |
    34 |
    35 | 62 | 91 |
    92 |

    93 | Hi Data! 94 |

    95 |

    96 | This is the corr_analyze page of CTU-13! 97 |

    98 | 101 | 102 |

    相关性分析

    103 | Heatmap 104 |

    保留的特征

    105 | 106 | {% for feature in features %} 107 |
  • {{ feature }}
    • 108 | {% endfor %} 109 |     110 |

    共保留{{ features | length }}个特征

    111 |
    112 |
    113 |
    114 |
    115 | 116 | 117 | -------------------------------------------------------------------------------- /web_app/templates/corr_analyze_doh.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 加密恶意流量检测系统 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 31 | 32 |
    33 |
    34 |
    35 | 62 | 91 |
    92 |

    93 | Hi Data! 94 |

    95 |

    96 | This is the corr_analyze page of DOH! 97 |

    98 | 101 | 102 |

    相关性分析

    103 | Heatmap 104 |

    保留的特征

    105 | 106 | {% for feature in features %} 107 |
  • {{ feature }}
    • 108 | {% endfor %} 109 |     110 |

    共保留{{ features | length }}个特征

    111 |
    112 |
    113 |
    114 |
    115 | 116 | 117 | -------------------------------------------------------------------------------- /web_app/templates/feature_LT_ctu-13.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 加密恶意流量检测系统 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 32 | 33 | 101 | 102 | 103 |
    104 |
    105 |
    106 | 133 | 162 |
    163 |

    164 | Hi MI&Chi2! and Feature Lightening! 165 |

    166 |

    167 | This is the stage of feature lightening! 168 |

    169 |

    双层特征选择及特征Stacking

    170 | 171 | {% for feature in features %} 172 |
  • {{ feature }}
    • 173 | {% endfor %} 174 |     175 |

    共选出{{ features | length }}个特征

    176 | 179 |

    模型表现如下：

    180 |
    181 |
    182 |
    183 |
    184 |
    185 |
    186 | 187 | 188 | -------------------------------------------------------------------------------- /web_app/templates/feature_LT_doh.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 加密恶意流量检测系统 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 32 | 33 | 101 | 102 | 103 |
    104 |
    105 |
    106 | 133 | 162 |
    163 |

    164 | Hi MI&Chi2! and Feature Lightening! 165 |

    166 |

    167 | This is the stage of feature lightening! 168 |

    169 |

    双层特征选择及特征Stacking

    170 | 171 | {% for feature in features %} 172 |
  • {{ feature }}
    • 173 | {% endfor %} 174 |     175 |

    共选出{{ features | length }}个特征

    176 | 179 |

    模型表现如下：

    180 |
    181 |
    182 |
    183 |
    184 |
    185 |
    186 | 187 | 188 | -------------------------------------------------------------------------------- /web_app/templates/files.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 加密恶意流量检测系统 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 27 | 28 | 55 | 56 |
    57 |
    58 |
    59 | 87 | 135 |
    136 |

    137 | After Parsing 138 |

    139 |

    140 | This is a page of showing the list of parsed files. 141 |

    142 | 145 |
    146 |
    147 |
    148 |
    149 |
    150 | 151 | 152 | -------------------------------------------------------------------------------- /web_app/templates/index.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 加密恶意流量检测系统 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 29 | 30 |
    31 |
    32 |
    33 | 61 | 109 |
    110 |

    111 | Hello, System! 112 |

    113 |

    114 | This is a system of detection of encrypted malicious traffic 115 |

    116 | 119 |
    120 |
    121 |
    122 |
    123 | 124 | 125 | -------------------------------------------------------------------------------- /web_app/templates/parse.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 加密恶意流量检测系统 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 28 | 29 |
    30 |
    31 |
    32 | 60 | 109 |
    110 |

    111 | File Parse ! 112 |

    113 |

    114 | Here is the file parse page 115 |

    116 | 119 |
    120 | 125 | 126 |
    127 |
    128 |
    129 |
    130 |
    131 | 132 | 133 | -------------------------------------------------------------------------------- /web_app/templates/show_data_ctu-13.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 加密恶意流量检测系统 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 31 | 42 | 43 |
    44 |
    45 |
    46 | 73 | 103 |
    104 |

    105 | Hi Data! 106 |

    107 |

    108 | This is the data of detection of encrypted malicious traffic——CTU-13 109 |

    110 | 111 | 112 | 113 | 114 | 115 | 116 | 117 | 118 | {% for name, size in data.items() %} 119 | 120 | 121 | 122 | 123 | {% endfor %} 124 | 125 |
    Kindsnumbers
    {{ name }}{{ size }}
    126 | 129 | 130 | 189 |
    190 |
    191 |
    192 |
    193 | 194 | 195 | -------------------------------------------------------------------------------- /web_app/templates/show_data_doh.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 加密恶意流量检测系统 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 31 | 42 | 43 |
    44 |
    45 |
    46 | 73 | 103 |
    104 |

    105 | Hi Data! 106 |

    107 |

    108 | This is the data of detection of encrypted malicious traffic——DOH 109 |

    110 | 111 | 112 | 113 | 114 | 115 | 116 | 117 | 118 | {% for name, size in data.items() %} 119 | 120 | 121 | 122 | 123 | {% endfor %} 124 | 125 |
    Kindsnumbers
    {{ name }}{{ size }}
    126 | 129 | 130 | 189 |
    190 |
    191 |
    192 |
    193 | 194 | 195 | -------------------------------------------------------------------------------- /web_app/templates/student.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 加密恶意流量检测系统 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 29 | 30 |
    31 |
    32 |
    33 | 70 | 118 |
    119 |

    120 | Hello, System! 121 |

    122 |

    123 | This is a system of detection of encrypted malicious traffic 124 |

    125 | 128 |
    129 |
    130 |
    131 |
    132 | 133 | 134 | -------------------------------------------------------------------------------- /web_app/templates/teacher.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 加密恶意流量检测系统 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 29 | 30 |
    31 |
    32 |
    33 | 70 | 118 |
    119 |

    120 | Hello, System! 121 |

    122 |

    123 | This is a system of detection of encrypted malicious traffic 124 |

    125 | 128 |
    129 |
    130 |
    131 |
    132 | 133 | 134 | -------------------------------------------------------------------------------- /web_app/templates/upload.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 加密恶意流量检测系统 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 28 | 41 | 51 | 58 | 59 | 60 | {% with messages = get_flashed_messages() %} 61 | {% if messages %} 62 |
    63 | {{ messages[0] }} 64 |
    65 | {% endif %} 66 | {% endwith %} 67 |
    68 |
    69 |
    70 | 98 | 147 |
    148 |

    149 | File Upload ! 150 |

    151 |

    152 | Please upload pcap files! 153 |

    154 | 155 | 174 |
    175 | 176 | 177 |
    178 |
    179 |
    180 |
    181 |
    182 | 183 | 184 | -------------------------------------------------------------------------------- /web_app/uploads/benign_small.pcap: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:2592e58a9c485486e14881e1d0e19f077cb399c686e33cfbb908870a9211d139 3 | size 397765276 4 | -------------------------------------------------------------------------------- /web_app/uploads/malicious_small.pcap: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:b4b8d3c1ecea27c41243272ce8a01e284d1a1f23df27ff467a796da8c4b01a4b 3 | size 372323892 4 | -------------------------------------------------------------------------------- /web_app/uploads/ssl.log: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:b5df7510557cecc95abad703fef6b01acb8fed29eac43d4a97258c749d2e45f2 3 | size 619380 4 | --------------------------------------------------------------------------------