Preprocess.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 42,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Device is cuda!\n"
     ]
    }
   ],
   "source": [
    "import torch\n",
    "import torch.nn as nn\n",
    "import torch.nn.functional as fn\n",
    "import torchvision\n",
    "import numpy as np\n",
    "import matplotlib.pyplot as plt\n",
    "from torch.utils.data import DataLoader, TensorDataset\n",
    "from sklearn.utils import shuffle\n",
    "from sklearn import preprocessing \n",
    "%matplotlib inline\n",
    "device = torch.device('cuda') if torch.cuda.is_available() else torch.device('cpu')\n",
    "print(f\"Device is {device}!\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 35,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>ts</th>\n",
       "      <th>src_ip</th>\n",
       "      <th>src_port</th>\n",
       "      <th>dst_ip</th>\n",
       "      <th>dst_port</th>\n",
       "      <th>proto</th>\n",
       "      <th>service</th>\n",
       "      <th>duration</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>...</th>\n",
       "      <th>http_response_body_len</th>\n",
       "      <th>http_status_code</th>\n",
       "      <th>http_user_agent</th>\n",
       "      <th>http_orig_mime_types</th>\n",
       "      <th>http_resp_mime_types</th>\n",
       "      <th>weird_name</th>\n",
       "      <th>weird_addl</th>\n",
       "      <th>weird_notice</th>\n",
       "      <th>label</th>\n",
       "      <th>type</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>1554198358</td>\n",
       "      <td>3.122.49.24</td>\n",
       "      <td>1883</td>\n",
       "      <td>192.168.1.152</td>\n",
       "      <td>52976</td>\n",
       "      <td>tcp</td>\n",
       "      <td>-</td>\n",
       "      <td>80549.530260</td>\n",
       "      <td>1762852</td>\n",
       "      <td>41933215</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>bad_TCP_checksum</td>\n",
       "      <td>-</td>\n",
       "      <td>F</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>1554198358</td>\n",
       "      <td>192.168.1.79</td>\n",
       "      <td>47260</td>\n",
       "      <td>192.168.1.255</td>\n",
       "      <td>15600</td>\n",
       "      <td>udp</td>\n",
       "      <td>-</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>1554198359</td>\n",
       "      <td>192.168.1.152</td>\n",
       "      <td>1880</td>\n",
       "      <td>192.168.1.152</td>\n",
       "      <td>51782</td>\n",
       "      <td>tcp</td>\n",
       "      <td>-</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>bad_TCP_checksum</td>\n",
       "      <td>-</td>\n",
       "      <td>F</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>1554198359</td>\n",
       "      <td>192.168.1.152</td>\n",
       "      <td>34296</td>\n",
       "      <td>192.168.1.152</td>\n",
       "      <td>10502</td>\n",
       "      <td>tcp</td>\n",
       "      <td>-</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>1554198362</td>\n",
       "      <td>192.168.1.152</td>\n",
       "      <td>46608</td>\n",
       "      <td>192.168.1.190</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>dns</td>\n",
       "      <td>0.000549</td>\n",
       "      <td>0</td>\n",
       "      <td>298</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>bad_UDP_checksum</td>\n",
       "      <td>-</td>\n",
       "      <td>F</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 45 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "           ts         src_ip  src_port         dst_ip  dst_port proto service  \\\n",
       "0  1554198358    3.122.49.24      1883  192.168.1.152     52976   tcp       -   \n",
       "1  1554198358   192.168.1.79     47260  192.168.1.255     15600   udp       -   \n",
       "2  1554198359  192.168.1.152      1880  192.168.1.152     51782   tcp       -   \n",
       "3  1554198359  192.168.1.152     34296  192.168.1.152     10502   tcp       -   \n",
       "4  1554198362  192.168.1.152     46608  192.168.1.190        53   udp     dns   \n",
       "\n",
       "       duration  src_bytes  dst_bytes  ... http_response_body_len  \\\n",
       "0  80549.530260    1762852   41933215  ...                      0   \n",
       "1      0.000000          0          0  ...                      0   \n",
       "2      0.000000          0          0  ...                      0   \n",
       "3      0.000000          0          0  ...                      0   \n",
       "4      0.000549          0        298  ...                      0   \n",
       "\n",
       "   http_status_code  http_user_agent  http_orig_mime_types  \\\n",
       "0                 0                -                     -   \n",
       "1                 0                -                     -   \n",
       "2                 0                -                     -   \n",
       "3                 0                -                     -   \n",
       "4                 0                -                     -   \n",
       "\n",
       "   http_resp_mime_types        weird_name weird_addl  weird_notice  label  \\\n",
       "0                     -  bad_TCP_checksum          -             F      0   \n",
       "1                     -                 -          -             -      0   \n",
       "2                     -  bad_TCP_checksum          -             F      0   \n",
       "3                     -                 -          -             -      0   \n",
       "4                     -  bad_UDP_checksum          -             F      0   \n",
       "\n",
       "     type  \n",
       "0  normal  \n",
       "1  normal  \n",
       "2  normal  \n",
       "3  normal  \n",
       "4  normal  \n",
       "\n",
       "[5 rows x 45 columns]"
      ]
     },
     "execution_count": 35,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "import pandas as pd\n",
    "\n",
    "df = pd.read_csv('./Train_Test_Network.csv')\n",
    "df.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 36,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "type\n",
      "normal        40415\n",
      "xss            3169\n",
      "ddos            734\n",
      "injection       669\n",
      "dos             584\n",
      "mitm            571\n",
      "password        276\n",
      "scanning         75\n",
      "backdoor         47\n",
      "ransomware       24\n",
      "Name: count, dtype: int64\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>conn_state</th>\n",
       "      <th>proto</th>\n",
       "      <th>dns_rejected</th>\n",
       "      <th>service</th>\n",
       "      <th>dns_AA</th>\n",
       "      <th>dns_qtype</th>\n",
       "      <th>dns_rcode</th>\n",
       "      <th>dns_query</th>\n",
       "      <th>dns_RA</th>\n",
       "      <th>dns_RD</th>\n",
       "      <th>dst_ip_bytes</th>\n",
       "      <th>src_pkts</th>\n",
       "      <th>label</th>\n",
       "      <th>type</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>405545</th>\n",
       "      <td>S1</td>\n",
       "      <td>tcp</td>\n",
       "      <td>-</td>\n",
       "      <td>http</td>\n",
       "      <td>-</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>3786</td>\n",
       "      <td>6</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>287784</th>\n",
       "      <td>SF</td>\n",
       "      <td>udp</td>\n",
       "      <td>F</td>\n",
       "      <td>dns</td>\n",
       "      <td>T</td>\n",
       "      <td>12</td>\n",
       "      <td>0</td>\n",
       "      <td>220.5.70.168.in-addr.arpa</td>\n",
       "      <td>T</td>\n",
       "      <td>F</td>\n",
       "      <td>172</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>387208</th>\n",
       "      <td>SF</td>\n",
       "      <td>udp</td>\n",
       "      <td>F</td>\n",
       "      <td>dns</td>\n",
       "      <td>F</td>\n",
       "      <td>12</td>\n",
       "      <td>3</td>\n",
       "      <td>3.3.e.c.4.8.f.f.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0....</td>\n",
       "      <td>F</td>\n",
       "      <td>F</td>\n",
       "      <td>800</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>270500</th>\n",
       "      <td>SF</td>\n",
       "      <td>udp</td>\n",
       "      <td>F</td>\n",
       "      <td>dns</td>\n",
       "      <td>F</td>\n",
       "      <td>43</td>\n",
       "      <td>0</td>\n",
       "      <td>235.135.in-addr.arpa</td>\n",
       "      <td>F</td>\n",
       "      <td>F</td>\n",
       "      <td>525</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>254871</th>\n",
       "      <td>SF</td>\n",
       "      <td>udp</td>\n",
       "      <td>F</td>\n",
       "      <td>dns</td>\n",
       "      <td>F</td>\n",
       "      <td>43</td>\n",
       "      <td>0</td>\n",
       "      <td>170.166.in-addr.arpa</td>\n",
       "      <td>F</td>\n",
       "      <td>F</td>\n",
       "      <td>408</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "       conn_state proto dns_rejected service dns_AA  dns_qtype  dns_rcode  \\\n",
       "405545         S1   tcp            -    http      -          0          0   \n",
       "287784         SF   udp            F     dns      T         12          0   \n",
       "387208         SF   udp            F     dns      F         12          3   \n",
       "270500         SF   udp            F     dns      F         43          0   \n",
       "254871         SF   udp            F     dns      F         43          0   \n",
       "\n",
       "                                                dns_query dns_RA dns_RD  \\\n",
       "405545                                                  -      -      -   \n",
       "287784                          220.5.70.168.in-addr.arpa      T      F   \n",
       "387208  3.3.e.c.4.8.f.f.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0....      F      F   \n",
       "270500                               235.135.in-addr.arpa      F      F   \n",
       "254871                               170.166.in-addr.arpa      F      F   \n",
       "\n",
       "        dst_ip_bytes  src_pkts  label    type  \n",
       "405545          3786         6      0  normal  \n",
       "287784           172         1      0  normal  \n",
       "387208           800         1      0  normal  \n",
       "270500           525         1      0  normal  \n",
       "254871           408         1      0  normal  "
      ]
     },
     "execution_count": 36,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df = df[['conn_state', 'proto', 'dns_rejected', 'service', 'dns_AA', 'dns_qtype', 'dns_rcode', 'dns_query', 'dns_RA', 'dns_RD', 'dst_ip_bytes', 'src_pkts', 'label', 'type']]\n",
    "df.drop_duplicates(subset=None, keep=\"first\", inplace=True)\n",
    "df = shuffle(df)\n",
    "df.isna().sum()\n",
    "print(df['type'].value_counts())\n",
    "df.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 37,
   "metadata": {},
   "outputs": [],
   "source": [
    "label_encoder = preprocessing.LabelEncoder() \n",
    "df['dns_query']= label_encoder.fit_transform(df['dns_query']) "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 38,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>conn_state</th>\n",
       "      <th>proto</th>\n",
       "      <th>dns_rejected</th>\n",
       "      <th>service</th>\n",
       "      <th>dns_AA</th>\n",
       "      <th>dns_qtype</th>\n",
       "      <th>dns_rcode</th>\n",
       "      <th>dns_query</th>\n",
       "      <th>dns_RA</th>\n",
       "      <th>dns_RD</th>\n",
       "      <th>dst_ip_bytes</th>\n",
       "      <th>src_pkts</th>\n",
       "      <th>label</th>\n",
       "      <th>type</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>405545</th>\n",
       "      <td>S1</td>\n",
       "      <td>tcp</td>\n",
       "      <td>-1</td>\n",
       "      <td>http</td>\n",
       "      <td>-1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2</td>\n",
       "      <td>-1</td>\n",
       "      <td>-1</td>\n",
       "      <td>3786</td>\n",
       "      <td>6</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>287784</th>\n",
       "      <td>SF</td>\n",
       "      <td>udp</td>\n",
       "      <td>F</td>\n",
       "      <td>dns</td>\n",
       "      <td>T</td>\n",
       "      <td>12</td>\n",
       "      <td>0</td>\n",
       "      <td>4765</td>\n",
       "      <td>T</td>\n",
       "      <td>F</td>\n",
       "      <td>172</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>387208</th>\n",
       "      <td>SF</td>\n",
       "      <td>udp</td>\n",
       "      <td>F</td>\n",
       "      <td>dns</td>\n",
       "      <td>F</td>\n",
       "      <td>12</td>\n",
       "      <td>3</td>\n",
       "      <td>6112</td>\n",
       "      <td>F</td>\n",
       "      <td>F</td>\n",
       "      <td>800</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>270500</th>\n",
       "      <td>SF</td>\n",
       "      <td>udp</td>\n",
       "      <td>F</td>\n",
       "      <td>dns</td>\n",
       "      <td>F</td>\n",
       "      <td>43</td>\n",
       "      <td>0</td>\n",
       "      <td>5259</td>\n",
       "      <td>F</td>\n",
       "      <td>F</td>\n",
       "      <td>525</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>254871</th>\n",
       "      <td>SF</td>\n",
       "      <td>udp</td>\n",
       "      <td>F</td>\n",
       "      <td>dns</td>\n",
       "      <td>F</td>\n",
       "      <td>43</td>\n",
       "      <td>0</td>\n",
       "      <td>2790</td>\n",
       "      <td>F</td>\n",
       "      <td>F</td>\n",
       "      <td>408</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "       conn_state proto dns_rejected service dns_AA  dns_qtype  dns_rcode  \\\n",
       "405545         S1   tcp           -1    http     -1          0          0   \n",
       "287784         SF   udp            F     dns      T         12          0   \n",
       "387208         SF   udp            F     dns      F         12          3   \n",
       "270500         SF   udp            F     dns      F         43          0   \n",
       "254871         SF   udp            F     dns      F         43          0   \n",
       "\n",
       "        dns_query dns_RA dns_RD  dst_ip_bytes  src_pkts  label    type  \n",
       "405545          2     -1     -1          3786         6      0  normal  \n",
       "287784       4765      T      F           172         1      0  normal  \n",
       "387208       6112      F      F           800         1      0  normal  \n",
       "270500       5259      F      F           525         1      0  normal  \n",
       "254871       2790      F      F           408         1      0  normal  "
      ]
     },
     "execution_count": 38,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df.replace('-', -1, inplace=True)\n",
    "df = df.dropna(axis=1, how='all')\n",
    "df.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 39,
   "metadata": {},
   "outputs": [],
   "source": [
    "def encode_text_dummy(df, name):\n",
    "    dummies = pd.get_dummies(df[name])\n",
    "    for x in dummies.columns:\n",
    "        dummy_name = f\"{name}-{x}\"\n",
    "        df[dummy_name] = dummies[x].astype(int)\n",
    "    df.drop(name, axis=1, inplace=True)\n",
    "    \n",
    "encode_text_dummy(df,'conn_state')\n",
    "encode_text_dummy(df,'proto')\n",
    "encode_text_dummy(df,\"dns_rejected\")\n",
    "encode_text_dummy(df,\"service\")\n",
    "encode_text_dummy(df,\"dns_AA\")\n",
    "encode_text_dummy(df,\"dns_RA\")\n",
    "encode_text_dummy(df,\"dns_RD\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 40,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>dns_qtype</th>\n",
       "      <th>dns_rcode</th>\n",
       "      <th>dns_query</th>\n",
       "      <th>dst_ip_bytes</th>\n",
       "      <th>src_pkts</th>\n",
       "      <th>label</th>\n",
       "      <th>type</th>\n",
       "      <th>conn_state-OTH</th>\n",
       "      <th>conn_state-REJ</th>\n",
       "      <th>conn_state-RSTO</th>\n",
       "      <th>...</th>\n",
       "      <th>service-ssl</th>\n",
       "      <th>dns_AA--1</th>\n",
       "      <th>dns_AA-F</th>\n",
       "      <th>dns_AA-T</th>\n",
       "      <th>dns_RA--1</th>\n",
       "      <th>dns_RA-F</th>\n",
       "      <th>dns_RA-T</th>\n",
       "      <th>dns_RD--1</th>\n",
       "      <th>dns_RD-F</th>\n",
       "      <th>dns_RD-T</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>405545</th>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2</td>\n",
       "      <td>3786</td>\n",
       "      <td>6</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>287784</th>\n",
       "      <td>12</td>\n",
       "      <td>0</td>\n",
       "      <td>4765</td>\n",
       "      <td>172</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>387208</th>\n",
       "      <td>12</td>\n",
       "      <td>3</td>\n",
       "      <td>6112</td>\n",
       "      <td>800</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>270500</th>\n",
       "      <td>43</td>\n",
       "      <td>0</td>\n",
       "      <td>5259</td>\n",
       "      <td>525</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>254871</th>\n",
       "      <td>43</td>\n",
       "      <td>0</td>\n",
       "      <td>2790</td>\n",
       "      <td>408</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>254576</th>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>12284</td>\n",
       "      <td>158</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>229743</th>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2</td>\n",
       "      <td>8462</td>\n",
       "      <td>10</td>\n",
       "      <td>1</td>\n",
       "      <td>ddos</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>247161</th>\n",
       "      <td>12</td>\n",
       "      <td>0</td>\n",
       "      <td>3631</td>\n",
       "      <td>375</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>293839</th>\n",
       "      <td>28</td>\n",
       "      <td>0</td>\n",
       "      <td>9338</td>\n",
       "      <td>712</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>406489</th>\n",
       "      <td>12</td>\n",
       "      <td>3</td>\n",
       "      <td>6528</td>\n",
       "      <td>349</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>normal</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>46564 rows × 45 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "        dns_qtype  dns_rcode  dns_query  dst_ip_bytes  src_pkts  label  \\\n",
       "405545          0          0          2          3786         6      0   \n",
       "287784         12          0       4765           172         1      0   \n",
       "387208         12          3       6112           800         1      0   \n",
       "270500         43          0       5259           525         1      0   \n",
       "254871         43          0       2790           408         1      0   \n",
       "...           ...        ...        ...           ...       ...    ...   \n",
       "254576          1          0      12284           158         1      0   \n",
       "229743          0          0          2          8462        10      1   \n",
       "247161         12          0       3631           375         1      0   \n",
       "293839         28          0       9338           712         1      0   \n",
       "406489         12          3       6528           349         2      0   \n",
       "\n",
       "          type  conn_state-OTH  conn_state-REJ  conn_state-RSTO  ...  \\\n",
       "405545  normal               0               0                0  ...   \n",
       "287784  normal               0               0                0  ...   \n",
       "387208  normal               0               0                0  ...   \n",
       "270500  normal               0               0                0  ...   \n",
       "254871  normal               0               0                0  ...   \n",
       "...        ...             ...             ...              ...  ...   \n",
       "254576  normal               0               0                0  ...   \n",
       "229743    ddos               0               0                0  ...   \n",
       "247161  normal               0               0                0  ...   \n",
       "293839  normal               0               0                0  ...   \n",
       "406489  normal               0               0                0  ...   \n",
       "\n",
       "        service-ssl  dns_AA--1  dns_AA-F  dns_AA-T  dns_RA--1  dns_RA-F  \\\n",
       "405545            0          1         0         0          1         0   \n",
       "287784            0          0         0         1          0         0   \n",
       "387208            0          0         1         0          0         1   \n",
       "270500            0          0         1         0          0         1   \n",
       "254871            0          0         1         0          0         1   \n",
       "...             ...        ...       ...       ...        ...       ...   \n",
       "254576            0          0         0         1          0         1   \n",
       "229743            1          1         0         0          1         0   \n",
       "247161            0          0         1         0          0         1   \n",
       "293839            0          0         1         0          0         1   \n",
       "406489            0          0         1         0          0         1   \n",
       "\n",
       "        dns_RA-T  dns_RD--1  dns_RD-F  dns_RD-T  \n",
       "405545         0          1         0         0  \n",
       "287784         1          0         1         0  \n",
       "387208         0          0         1         0  \n",
       "270500         0          0         1         0  \n",
       "254871         0          0         1         0  \n",
       "...          ...        ...       ...       ...  \n",
       "254576         0          0         1         0  \n",
       "229743         0          1         0         0  \n",
       "247161         0          0         1         0  \n",
       "293839         0          0         1         0  \n",
       "406489         0          0         0         1  \n",
       "\n",
       "[46564 rows x 45 columns]"
      ]
     },
     "execution_count": 40,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 41,
   "metadata": {},
   "outputs": [],
   "source": [
    "df.to_csv('preprocessed.csv', encoding='utf-8', index=False)"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "mykernel",
   "language": "python",
   "name": "mykernel"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.11"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}