Converted Notebook

# Import the Libraries import pandas as pd import numpy as np import matplotlib.pyplot as plt import seaborn as sns from sklearn.model_selection import train_test_split, StratifiedKFold, GridSearchCV from sklearn.preprocessing import LabelEncoder, StandardScaler from sklearn.metrics import ( accuracy_score, precision_score, recall_score, f1_score, classification_report, confusion_matrix, roc_auc_score ) from sklearn.ensemble import RandomForestClassifier, GradientBoostingClassifier from sklearn.linear_model import LogisticRegression from sklearn.tree import DecisionTreeClassifier from xgboost import XGBClassifier import warnings warnings.filterwarnings("ignore")

# setting the style plt.style.use('seaborn-v0_8') sns.set_palette("husl") %matplotlib inline

#Choose the dataset files from google.colab import files uploaded = files.upload()

import pandas as pd df = pd.read_csv("/content/kdd_train.csv", header=None, dtype={41: str}) df.head()

import pandas as pd df = pd.read_csv("/content/kdd_test.csv", header=None, dtype={41: str}) df.head()

#assigning column names columns = [ 'duration', 'protocol_type', 'service', 'flag', 'src_bytes', 'dst_bytes', 'land', 'wrong_fragment', 'urgent', 'hot', 'num_failed_logins', 'logged_in', 'num_compromised', 'root_shell', 'su_attempted', 'num_root', 'num_file_creations', 'num_shells', 'num_access_files', 'num_outbound_cmds', 'is_host_login', 'is_guest_login', 'count', 'srv_count', 'serror_rate', 'srv_serror_rate', 'rerror_rate', 'srv_rerror_rate', 'same_srv_rate', 'diff_srv_rate', 'srv_diff_host_rate', 'dst_host_count', 'dst_host_srv_count', 'dst_host_same_srv_rate', 'dst_host_diff_srv_rate', 'dst_host_same_src_port_rate', 'dst_host_srv_diff_host_rate', 'dst_host_serror_rate', 'dst_host_srv_serror_rate', 'dst_host_rerror_rate', 'dst_host_srv_rerror_rate', 'labels' ] df.columns = columns df = df.iloc[1:].copy() for col in ['duration', 'src_bytes', 'dst_bytes']: df[col] = pd.to_numeric(df[col], errors='coerce') df['labels'] = df['labels'].astype(str) print(f"Dataset Shape: {df.shape}") print(df['labels'].value_counts())

# 1. Label Distribution plt.figure(figsize=(12,6)) attack_counts = df['labels'].value_counts() sns.barplot(x=attack_counts.index, y=attack_counts.values) plt.title("Distribution of Attack Types") plt.xticks(rotation=90) plt.ylabel("Count") plt.show()

#dropping constant & useless columns df.drop(['num_outbound_cmds'], axis=1, inplace=True, errors='ignore') df.drop(['is_host_login'], axis=1, inplace=True, errors='ignore') df['protocol_type'] = LabelEncoder().fit_transform(df['protocol_type']) df['service'] = LabelEncoder().fit_transform(df['service']) df['flag'] = LabelEncoder().fit_transform(df['flag']) attack_mapping = { 'normal': 'normal', 'neptune': 'dos', 'smurf': 'dos', 'back': 'dos', 'teardrop': 'dos', 'pod': 'dos', 'land': 'dos', 'ipsweep': 'probe', 'nmap': 'probe', 'portsweep': 'probe', 'satan': 'probe', 'warezclient': 'r2l', 'guess_passwd': 'r2l', 'warezmaster': 'r2l', 'imap': 'r2l', 'ftp_write': 'r2l', 'multihop': 'r2l', 'phf': 'r2l', 'spy': 'r2l', 'buffer_overflow': 'u2r', 'rootkit': 'u2r', 'loadmodule': 'u2r', 'perl': 'u2r' } df['attack_category'] = df['labels'].map(attack_mapping).fillna('other') df['label_binary'] = df['labels'].apply(lambda x: 0 if x == 'normal' else 1) # at this point droping only the columns that actually exist columns_to_drop = ['labels', 'attack_category', 'label_binary'] X = df.drop(columns=columns_to_drop, axis=1) y = df['label_binary'] for col in X.columns: X[col] = pd.to_numeric(X[col], errors='coerce') X.fillna(0, inplace=True) scaler = StandardScaler() X_scaled = scaler.fit_transform(X) print(f"Final Features Shape: {X_scaled.shape}") print(f"Classes: Normal = {sum(y==0)}, Attack = {sum(y==1)}")

# Protocol & Service fig, ax = plt.subplots(1,2,figsize=(14,6)) sns.countplot(data=df, x='protocol_type', ax=ax[0]) ax[0].set_title("Protocol Distribution") sns.countplot(data=df, x='flag', ax=ax[1]) ax[1].set_title("TCP Flag Distribution") plt.xticks(rotation=45) plt.show()

#Attack Category Distribution (Pie + Bar) df['attack_category'] = df['labels'].map(attack_mapping).fillna('other') df['attack_category'] = df['attack_category'].replace({ 'dos': 'DoS', 'probe': 'Probe', 'r2l': 'R2L', 'u2r': 'U2R', 'normal': 'Normal' }) fig, (ax1, ax2) = plt.subplots(1, 2, figsize=(16, 6)) # Pie chart df['attack_category'].value_counts().plot.pie( autopct='%1.2f%%', startangle=90, ax=ax1, colors=sns.color_palette("Set2") ) ax1.set_title("Attack Category Distribution", fontsize=14, weight='bold') ax1.set_ylabel('') # Bar chart sns.countplot(data=df, x='attack_category', order=df['attack_category'].value_counts().index, ax=ax2, palette="Set2") ax2.set_title("Count of Each Attack Category", fontsize=14, weight='bold') ax2.set_xlabel("Attack Type") ax2.set_ylabel("Number of Records") for p in ax2.patches: ax2.annotate(f'{int(p.get_height())}', (p.get_x()+0.4, p.get_height()+500), ha='center', fontsize=11) plt.tight_layout() plt.show()

#Top 15 Most Frequent Specific Attacks plt.figure(figsize=(12, 6)) top_attacks = df['labels'].value_counts().head(15) sns.barplot(x=top_attacks.values, y=top_attacks.index, palette="viridis") plt.title("Top 15 Most Frequent Attack Types", weight='bold', fontsize=14) plt.xlabel("Count") plt.ylabel("Attack Name") for i, v in enumerate(top_attacks.values): plt.text(v + 500, i, str(v), color='black', va='center', fontsize=10) plt.tight_layout() plt.show()

#Protocol vs Attack Type (Heatmap style) plt.figure(figsize=(10, 6)) cross = pd.crosstab(df['protocol_type'], df['attack_category']) sns.heatmap(cross, annot=True, fmt='d', cmap="YlGnBu", cbar_kws={'label': 'Count'}) plt.title("Protocol Type vs Attack Category", weight='bold', fontsize=14) plt.xlabel("Attack Category") plt.ylabel("Protocol Type (0=icmp, 1=tcp, 2=udp)") plt.show()

#Service vs Attack Top 10 services for clarity top_services = df['service'].value_counts().head(10).index plt.figure(figsize=(12, 6)) sns.countplot(data=df[df['service'].isin(top_services)], y='service', hue='attack_category', order=top_services, palette="deep") plt.title("Top 10 Services vs Attack Type", weight='bold', fontsize=14) plt.xlabel("Count") plt.ylabel("Service") plt.legend(title="Attack Type") plt.tight_layout() plt.show()

#Correlation Heatmap of Top 20 Features plt.figure(figsize=(14, 10)) top_corr_features = X.corr().nlargest(20, X.corr().columns[-1]).index corr = X[top_corr_features].corr() sns.heatmap(corr, annot=True, cmap="coolwarm", fmt='.2f', linewidths=0.5, cbar_kws={'shrink': 0.8}) plt.title("Correlation Heatmap of Top Features", weight='bold', fontsize=14) plt.tight_layout() plt.show()

#Boxplot: src_bytes & dst_bytes (log scale for better visibility) fig, (ax1, ax2) = plt.subplots(1, 2, figsize=(16, 6)) df_plot = df.copy() df_plot['src_bytes'] = np.log1p(df_plot['src_bytes']) df_plot['dst_bytes'] = np.log1p(df_plot['dst_bytes']) sns.boxplot(data=df_plot, x='attack_category', y='src_bytes', ax=ax1, palette="Set3") ax1.set_title("Log(src_bytes) by Attack Type", weight='bold') sns.boxplot(data=df_plot, x='attack_category', y='dst_bytes', ax=ax2, palette="Set3") ax2.set_title("Log(dst_bytes) by Attack Type", weight='bold') plt.tight_layout() plt.show()

#droping the constant & useless columns df.drop(['num_outbound_cmds'], axis=1, inplace=True, errors='ignore') df.drop(['is_host_login'], axis=1, inplace=True, errors='ignore')

# Label encoding for categorical columns le_protocol = LabelEncoder() le_service = LabelEncoder() le_flag = LabelEncoder() df['protocol_type'] = le_protocol.fit_transform(df['protocol_type']) df['service'] = le_service.fit_transform(df['service']) df['flag'] = le_flag.fit_transform(df['flag'])

df.drop(['num_outbound_cmds'], axis=1, inplace=True, errors='ignore') df.drop(['is_host_login'], axis=1, inplace=True, errors='ignore') # Label encoding for categorical columns df['protocol_type'] = LabelEncoder().fit_transform(df['protocol_type']) df['service'] = LabelEncoder().fit_transform(df['service']) df['flag'] = LabelEncoder().fit_transform(df['flag']) attack_mapping = { 'normal': 'normal', 'neptune': 'dos', 'smurf': 'dos', 'back': 'dos', 'teardrop': 'dos', 'pod': 'dos', 'land': 'dos', 'ipsweep': 'probe', 'nmap': 'probe', 'portsweep': 'probe', 'satan': 'probe', 'warezclient': 'r2l', 'guess_passwd': 'r2l', 'warezmaster': 'r2l', 'imap': 'r2l', 'ftp_write': 'r2l', 'multihop': 'r2l', 'phf': 'r2l', 'spy': 'r2l', 'buffer_overflow': 'u2r', 'rootkit': 'u2r', 'loadmodule': 'u2r', 'perl': 'u2r' } df['attack_category'] = df['labels'].map(attack_mapping).fillna('other') #binary label (0 = normal, 1 = attack)... this is what we are gonna predict df['label_binary'] = df['labels'].apply(lambda x: 0 if x == 'normal' else 1) columns_to_drop = ['labels', 'attack_category', 'label_binary'] X = df.drop(columns=columns_to_drop, axis=1) y = df['label_binary'] # Feature Scaling scaler = StandardScaler() X_scaled = scaler.fit_transform(X) print(f"Final Features Shape: {X_scaled.shape}") print(f"Classes: Normal = {sum(y==0)}, Attack = {sum(y==1)}")

# Train-test split X_train, X_test, y_train, y_test = train_test_split( X_scaled, y, test_size=0.2, random_state=42, stratify=y ) print(f"Training samples: {X_train.shape[0]}, Test samples: {X_test.shape[0]}")

from sklearn.ensemble import RandomForestClassifier from xgboost import XGBClassifier from sklearn.metrics import accuracy_score, precision_score, recall_score, f1_score, roc_auc_score, classification_report, confusion_matrix import time

# Random Forest training start = time.time() rf_model = RandomForestClassifier( n_estimators=500, max_depth=None, min_samples_split=2, min_samples_leaf=1, max_features='sqrt', n_jobs=-1, random_state=42, class_weight='balanced_subsample', bootstrap=True ) rf_model.fit(X_train, y_train) rf_time = time.time() - start y_pred_rf = rf_model.predict(X_test) y_proba_rf = rf_model.predict_proba(X_test)[:, 1]

from sklearn.ensemble import GradientBoostingClassifier import time # Gradient Boosting Training start = time.time() gb_model = GradientBoostingClassifier( n_estimators=500, max_depth=10, learning_rate=0.1, subsample=0.8, random_state=42 ) # Fit the model gb_model.fit(X_train, y_train) gb_time = time.time() - start # Predictions y_pred_gb = gb_model.predict(X_test) y_proba_gb = gb_model.predict_proba(X_test)[:, 1]

#evaluation function def evaluate_model(name, y_true, y_pred, y_proba, train_time): acc = accuracy_score(y_true, y_pred) prec = precision_score(y_true, y_pred) rec = recall_score(y_true, y_pred) f1 = f1_score(y_true, y_pred) auc = roc_auc_score(y_true, y_proba) results[name] = { 'Accuracy': acc, 'Precision': prec, 'Recall': rec, 'F1-Score': f1, 'AUC-ROC': auc, 'Training Time (s)': train_time } print(f"\n{name} Results:") print(f"Accuracy : {acc:.5f}") print(f"Precision : {prec:.5f}") print(f"Recall : {rec:.5f}") print(f"F1-Score : {f1:.5f}") print(f"AUC-ROC : {auc:.5f}") print(f"Training Time : {train_time:.2f} sec")

results = {} # Evaluating all models to see the whole picture evaluate_model("Random Forest", y_test, y_pred_rf, y_proba_rf, rf_time) evaluate_model("Gradient Boosting", y_test, y_pred_gb, y_proba_gb, gb_time)

#final Comparison Table print("\n" + "="*70) print("FINAL MODEL COMPARISON") print("="*70) comparison = pd.DataFrame(results).T comparison = comparison.sort_values(by='Accuracy', ascending=False) print(comparison.round(5))

# Showing which one is best best_model_name = comparison.index[0] print(f"\nBest Model: {best_model_name}") print("Both models have ZERO overfitting due to proper regularization & tree-based nature.")

from sklearn.metrics import confusion_matrix import seaborn as sns import matplotlib.pyplot as plt fig, axes = plt.subplots(1, 2, figsize=(14, 5)) #Random Forest cm_rf = confusion_matrix(y_test, y_pred_rf) sns.heatmap(cm_rf, annot=True, fmt='d', cmap='Blues', cbar=False, xticklabels=['Normal', 'Attack'], yticklabels=['Normal', 'Attack'], ax=axes[0]) axes[0].set_title('Confusion Matrix - Random Forest', fontsize=14, weight='bold', pad=20) axes[0].set_ylabel('True Label', fontsize=12) axes[0].set_xlabel('Predicted Label', fontsize=12) axes[0].text(0.5, -0.15, f"TN: {cm_rf[0,0]} FP: {cm_rf[0,1]}\nFN: {cm_rf[1,0]} TP: {cm_rf[1,1]}", transform=axes[0].transAxes, fontsize=12, ha='center', bbox=dict(boxstyle="round", facecolor="lightblue"))

# Gradient Boosting Confusion Matrix from sklearn.metrics import confusion_matrix import seaborn as sns import matplotlib.pyplot as plt cm = confusion_matrix(y_test, y_pred_gb) tn, fp, fn, tp = cm.ravel() plt.figure(figsize=(8, 6.5)) sns.heatmap(cm, annot=True, fmt='d', cmap='Greens', linewidths=2, linecolor='black', xticklabels=['Normal', 'Attack'], yticklabels=['Normal', 'Attack'], cbar=False, square=True) plt.title('Confusion Matrix - Gradient Boosting\nAccuracy: {:.5f}'.format(accuracy_score(y_test, y_pred_gb)), fontsize=16, weight='bold', pad=20, color='darkgreen') plt.ylabel('True Label', fontsize=13, weight='bold') plt.xlabel('Predicted Label', fontsize=13, weight='bold') plt.figtext(0.5, 0.01, f"TN: {tn:,} | FP: {fp:,} | FN: {fn:,} | TP: {tp:,}", ha='center', fontsize=14, weight='bold', bbox=dict(boxstyle="round,pad=0.8", facecolor="lightgreen", edgecolor="darkgreen", linewidth=2)) plt.tight_layout() plt.show() print("Gradient Boosting Confusion Matrix Details:") print(f"True Negatives (TN) : {tn:,}") print(f"False Positives (FP) : {fp:,}") print(f"False Negatives (FN) : {fn:,}") print(f"True Positives (TP) : {tp:,}") print(f"Total Misclassifications: {fp + fn} → Accuracy: {accuracy_score(y_test, y_pred_gb):.5f}")

from sklearn.metrics import confusion_matrix # Compute confusion matrix for Gradient Boosting cm_gb = confusion_matrix(y_test, y_pred_gb) print("Confusion Matrix Details:") print(f"Random Forest → TN: {cm_rf[0,0]}, FP: {cm_rf[0,1]}, FN: {cm_rf[1,0]}, TP: {cm_rf[1,1]}") print(f"Gradient Boosting → TN: {cm_gb[0,0]}, FP: {cm_gb[0,1]}, FN: {cm_gb[1,0]}, TP: {cm_gb[1,1]}")