基于逻辑回归的入侵检测

1、简介

基于KDDCUP99数据集，利用逻辑回归方法进行入侵检测学习。

2、主要步骤

第一步，数据预处理：对KDDCUP99原始数据集进行处理，使其成为适合进行学习的形式。进行特征选择，降低维度。
第二步，调参：网格搜索最优参数组合。
第三步，模型训练与测试：利用训练集进行模型训练，利用测试集进行测试，计算各种评价指标，绘制ROC曲线等。

3、具体执行

3.1、数据预处理

   由data_processing.py和select_features.py两部分组成。前者对数据集进行处理，得到适合学习的形式。后者进行特征选择，进行降维。
data_processing.py
   首先读取原始数据集；
   然后对其类标进行转换，正常和攻击的标称转化为0和1；
   对连续属性进行离散化处理，使用聚类离散化的方法；
   对标称离散属性进行one-hot独热编码处理；
   全体数据标准化、归一化；
   将处理后的数据集导出。
select_features.py
   首先读取经过data_processing后的数据集；
   利用随机森林进行特征选择；
   将选择的特征输出，以待后续使用。

3.2、调参

   利用网格搜索进行调参，logistic_search.py
logistic_search.py
   首先利用load_data(file_train,file_fea)函数读取经过data_processing后的训练数据集以及选择的特征，然后得到训练数据集x_train和类标集y_train；
   利用optimize_params(x_train,y_train)函数，进行网格参数搜索，得到最优参数。

3.3、模型训练与测试

logisitic_train_test.py
   首先利用load_data(file_train,file_test,file_fea)函数读取经过data_processing后的训练数据集以及选择的特征，然后得到x_train,y_train,x_test,y_test ;
   利用classify(x_train,y_train,x_test)对逻辑回归模型进行训练，得到模型LR，并对测试集x_test进行预测得到y_predict ；
   利用calculate_metrics(y_test, y_predict,y_score)函数计算各种指标（报告）：accuracy_score、confusion_matrix、classification_report、hamming_loss、jaccard_similarity_score、matthews_corrcoef、zero_one_loss、log_loss等；
   利用ROC_curve(X_test,y_test,LR)绘制ROC曲线计算AUC

部分代码

import pandas as pd
import pickle
from sklearn.externals import joblib
from sklearn.metrics import accuracy_score, confusion_matrix, classification_report,\
                            hamming_loss, jaccard_similarity_score, matthews_corrcoef, \
                            zero_one_loss,roc_curve, auc,log_loss
from sklearn.preprocessing import label_binarize
from sklearn.linear_model import LogisticRegression
import matplotlib.pyplot as plt
import numpy as np
from time import time

def load_data(file_train,file_test,file_fea):
    data_train = pd.read_csv(file_train)
    data_test = pd.read_csv(file_test)
    with open(file_fea, 'rb') as f:
        selected_feat_names = pickle.load(f)
    print(selected_feat_names)
    x_train = data_train[selected_feat_names]
    y_train = data_train['label']
    x_test = data_test[selected_feat_names]
    y_test = data_test['label']
    return x_train,y_train,x_test,y_test

def classify(x_train,y_train,x_test):

    X_train, X_test, y_train = x_train,x_test,y_train
    LR = LogisticRegression(solver='saga',max_iter=1000,C=0.8,tol=0.01)
    t0 = time()
    LR.fit(X_train, y_train)
    tt = time() - t0
    print("Los in {} seconds".format(round(tt, 3)))
    y_predict = LR.predict(X_test)
    joblib.dump(LR, r'逻辑回归\dataset\lr_model_params.pkl')
    return y_predict,LR



def calculate_metrics(y_test, y_predict,y_score):

    acc = accuracy_score(y_test, y_predict)
    print("\n\nAccuracy {} %".format(round(acc * 100, 3)))
    confusion = confusion_matrix(y_test, y_predict)
    print("\n\nConfusion Matrix: \n\n {}".format(confusion))
    print("The precision,recall, f-score obtained for this model are")
    classific_report = classification_report(y_test, y_predict)
    print("\n\nClassification Scores: \n\n {}".format(classific_report))
    hamm_loss = hamming_loss(y_test, y_predict)
    print("\n\nHamming Loss {}".format(hamm_loss))
    jaccard_similarity = jaccard_similarity_score(y_test, y_predict)
    print("\n\nJaccard Similarity Score {}".format(jaccard_similarity))
    matthews_corr = matthews_corrcoef(y_test, y_predict)
    print("\n\nMatthews corrcoef {}".format(matthews_corr))
    zero_one_los = zero_one_loss(y_test, y_predict)
    print("\n\nZero-One Loss {}".format(zero_one_los))
    log_los = log_loss(y_test,y_score)#每个样本的 log loss 是给定的分类器的 negative log-likelihood 真正的标签
    print("\n\nlog_Loss {}".format(log_los))

def ROC_curve(X_test,y_test,LR):

    y_score = LR.predict_proba(X_test)
    y_test = [i for i in y_test.values]
    y_test.extend([2])
    y_test = label_binarize(y_test, classes=[0, 1])
    y_test = np.delete(y_test, -1, axis=0)
    samples = 2
    fpr = dict()
    tpr = dict()
    roc_auc = dict()
    for i in range(samples):
        fpr[i], tpr[i], _ = roc_curve(y_test[:, i], y_score[:, i])
        roc_auc[i] = auc(fpr[i], tpr[i])
    plt.plot(fpr[1], tpr[1])
    plt.xlabel('False Positive Rate')
    plt.ylabel('True Positive Rate')
    roc_auc[1] = auc(fpr[1], tpr[1])
    print('The roc rate for 1st attribute is ', roc_auc[1])
    plt.show()


def main():

    file_train = r'逻辑回归\dataset\data_train_new_norm.csv'
    file_test = r'逻辑回归\dataset\data_test_new_norm.csv'
    file_fea = r'逻辑回归\dataset\selected_feat_names.pkl'
    x_train, y_train, x_test, y_test = load_data(file_train,file_test,file_fea)
    y_predict , LR= classify(x_train,y_train,x_test)
    y_score = LR.predict_proba(x_test)
    # print(LR.coef_)#权重向量
    calculate_metrics(y_test, y_predict,y_score)
    ROC_curve(x_test, y_test,LR)
    lr_w = joblib.load(r'逻辑回归\dataset\lr_model_params.pkl')
    print(lr_w)#模型参数

if __name__ == "__main__":
    main()