phad-c32.py
def _runScoring(clusters, testData):
    """Run attack detection on test data using clusters from train data."""

    try:
        results = np.load(open("data/phad_results.npy", "rb"))
        print("Loading cached results...", end='')
    except IOError:
        print("Running attack detection...", end='')
        # Initialize last anomaly time to 1 sec before time of first packet.
        # The first column of testData is the timestamp.
        lastAnomaly = {key: testData[0][0] - 1 for key in FEATURES}
        nr = {key: (clusters[key].getTotal(), clusters[key].getDistinct()) for
              key in FEATURES}

        scores = np.zeros(testData.shape)
        for packetNum, packet in enumerate(testData):
            packetHdrs = packet[1:]
            timestamp = packet[0]

            # Score each field
            for i, feature in enumerate(FEATURES):
                # If not anomalous, don't score
                if clusters[feature].contains(packetHdrs[i]):
                    continue
                if packet[i] != -1:
                    t = timestamp - lastAnomaly[feature]
                    scores[packetNum][i] = (t * nr[feature][0] /
                                            nr[feature][1])
                    lastAnomaly[feature] = timestamp

        # Score the packet and store as last element
        scores[:, -1] = np.sum(scores[:, 0:-1], axis=1)

        # If the total score of the packet is very small, set it to one so
        # that the resulting normalization doesn't fail.
        scores[:, -1][scores[:, -1] < 1] = 1

        results = np.hstack((testData, scores))
        np.save(open("data/phad_results.npy", "wb"), results)

    print("Done!")

    return results
Run attack detection on test data using clusters from train data.
Run attack detection on test data using clusters from train data.
Run attack detection on test data using clusters from train data .
def _runScoring(clusters, testData):
    try:
        results = np.load(open("data/phad_results.npy", "rb"))
        print("Loading cached results...", end='')
    except IOError:
        print("Running attack detection...", end='')
        lastAnomaly = {key: testData[0][0] - 1 for key in FEATURES}
        nr = {key: (clusters[key].getTotal(), clusters[key].getDistinct()) for
              key in FEATURES}
        scores = np.zeros(testData.shape)
        for packetNum, packet in enumerate(testData):
            packetHdrs = packet[1:]
            timestamp = packet[0]
            for i, feature in enumerate(FEATURES):
                if clusters[feature].contains(packetHdrs[i]):
                    continue
                if packet[i] != -1:
                    t = timestamp - lastAnomaly[feature]
                    scores[packetNum][i] = (t * nr[feature][0] /
                                            nr[feature][1])
                    lastAnomaly[feature] = timestamp
        scores[:, -1] = np.sum(scores[:, 0:-1], axis=1)
        scores[:, -1][scores[:, -1] < 1] = 1
        results = np.hstack((testData, scores))
        np.save(open("data/phad_results.npy", "wb"), results)
    print("Done!")
    return results
def _runScoring ( clusters , testData ) : try : results = np . load ( open ( "data/phad_results.npy" , "rb" ) ) print ( "Loading cached results..." , end = '' ) except IOError : print ( "Running attack detection..." , end = '' ) lastAnomaly = { key : testData [ 0 ] [ 0 ] - 1 for key in FEATURES } nr = { key : ( clusters [ key ] . getTotal ( ) , clusters [ key ] . getDistinct ( ) ) for key in FEATURES } scores = np . zeros ( testData . shape ) for packetNum , packet in enumerate ( testData ) : packetHdrs = packet [ 1 : ] timestamp = packet [ 0 ] for i , feature in enumerate ( FEATURES ) : if clusters [ feature ] . contains ( packetHdrs [ i ] ) : continue if packet [ i ] != - 1 : t = timestamp - lastAnomaly [ feature ] scores [ packetNum ] [ i ] = ( t * nr [ feature ] [ 0 ] / nr [ feature ] [ 1 ] ) lastAnomaly [ feature ] = timestamp scores [ : , - 1 ] = np . sum ( scores [ : , 0 : - 1 ] , axis = 1 ) scores [ : , - 1 ] [ scores [ : , - 1 ] < 1 ] = 1 results = np . hstack ( ( testData , scores ) ) np . save ( open ( "data/phad_results.npy" , "wb" ) , results ) print ( "Done!" ) return results
Run attack detection on test data using clusters from train data.
Run attack detection on test data using clusters from train data .
"""Run attack detection on test data using clusters from train data.""" # Initialize last anomaly time to 1 sec before time of first packet. # The first column of testData is the timestamp. # Score each field # If not anomalous, don't score # Score the packet and store as last element # If the total score of the packet is very small, set it to one so # that the resulting normalization doesn't fail.
clusters
testData