Android_Malware_Classifierr.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 110
    },
    "colab_type": "code",
    "id": "BtBxaleLf4cQ",
    "outputId": "34c3f23d-357a-4f5a-8f40-18338317c9ac"
   },
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/usr/local/lib/python3.6/dist-packages/sklearn/externals/joblib/__init__.py:15: FutureWarning: sklearn.externals.joblib is deprecated in 0.21 and will be removed in 0.23. Please import this functionality directly from joblib, which can be installed with: pip install joblib. If this warning is raised when loading pickled models, you may need to re-serialize those models with scikit-learn 0.21+.\n",
      "  warnings.warn(msg, category=FutureWarning)\n",
      "/usr/local/lib/python3.6/dist-packages/statsmodels/tools/_testing.py:19: FutureWarning: pandas.util.testing is deprecated. Use the functions in the public API at pandas.testing instead.\n",
      "  import pandas.util.testing as tm\n"
     ]
    }
   ],
   "source": [
    "from sklearn.naive_bayes import GaussianNB, BernoulliNB\n",
    "from sklearn.metrics import accuracy_score, classification_report\n",
    "from sklearn.ensemble import BaggingClassifier\n",
    "from sklearn.neighbors import KNeighborsClassifier\n",
    "from sklearn.linear_model import SGDClassifier\n",
    "from sklearn.model_selection import train_test_split\n",
    "from sklearn.metrics import cohen_kappa_score\n",
    "from sklearn.metrics import confusion_matrix\n",
    "from sklearn.ensemble import RandomForestClassifier\n",
    "\n",
    "from sklearn import preprocessing\n",
    "import torch\n",
    "from sklearn import svm\n",
    "from sklearn import tree\n",
    "import pandas as pd\n",
    "from sklearn.externals import joblib\n",
    "import pickle\n",
    "import numpy as np\n",
    "import seaborn as sns"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 35
    },
    "colab_type": "code",
    "id": "4joJ3Vgxnuf5",
    "outputId": "4beb98c8-8e58-41f3-fa37-ee9152531df8"
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "android_traffic.csv  sample_data  train.csv\n"
     ]
    }
   ],
   "source": [
    "!ls"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {
    "colab": {},
    "colab_type": "code",
    "id": "W1hX8Gbkoyt4"
   },
   "outputs": [],
   "source": [
    "#Static Analysis\n",
    "import pandas as pd\n",
    "df = pd.read_csv(\"train.csv\", sep=\";\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 72
    },
    "colab_type": "code",
    "id": "8WcoVReJo9FC",
    "outputId": "53cb90b1-80e5-4618-cbe8-f86293a4a960"
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "1    199\n",
       "0    199\n",
       "Name: type, dtype: int64"
      ]
     },
     "execution_count": 5,
     "metadata": {
      "tags": []
     },
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df = df.astype(\"int64\")\n",
    "df.type.value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 217
    },
    "colab_type": "code",
    "id": "i69wqPRVpKVC",
    "outputId": "f0ec6aed-ab57-438f-8041-b67d566863d7"
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "android.permission.INTERNET                  195\n",
       "android.permission.READ_PHONE_STATE          190\n",
       "android.permission.ACCESS_NETWORK_STATE      167\n",
       "android.permission.WRITE_EXTERNAL_STORAGE    136\n",
       "android.permission.ACCESS_WIFI_STATE         135\n",
       "android.permission.READ_SMS                  124\n",
       "android.permission.WRITE_SMS                 104\n",
       "android.permission.RECEIVE_BOOT_COMPLETED    102\n",
       "android.permission.ACCESS_COARSE_LOCATION     80\n",
       "android.permission.CHANGE_WIFI_STATE          75\n",
       "dtype: int64"
      ]
     },
     "execution_count": 6,
     "metadata": {
      "tags": []
     },
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#The state of Malware Samples\n",
    "pd.Series.sort_values(df[df.type==1].sum(axis=0), ascending=False)[1:11]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 217
    },
    "colab_type": "code",
    "id": "eep7MfrcpYFt",
    "outputId": "811ce82c-33ef-4116-da17-c81acc42d5e8"
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "android.permission.INTERNET                  104\n",
       "android.permission.WRITE_EXTERNAL_STORAGE     76\n",
       "android.permission.ACCESS_NETWORK_STATE       62\n",
       "android.permission.WAKE_LOCK                  36\n",
       "android.permission.RECEIVE_BOOT_COMPLETED     30\n",
       "android.permission.ACCESS_WIFI_STATE          29\n",
       "android.permission.READ_PHONE_STATE           24\n",
       "android.permission.VIBRATE                    21\n",
       "android.permission.ACCESS_FINE_LOCATION       18\n",
       "android.permission.READ_EXTERNAL_STORAGE      15\n",
       "dtype: int64"
      ]
     },
     "execution_count": 7,
     "metadata": {
      "tags": []
     },
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#The State of Benign Samples\n",
    "pd.Series.sort_values(df[df.type==0].sum(axis=0), ascending=False)[:10]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {
    "colab": {},
    "colab_type": "code",
    "id": "waOpgmVWpqI1"
   },
   "outputs": [],
   "source": [
    "X_train, X_test, y_train, y_test = train_test_split(df.iloc[:, 1:330], df['type'], test_size=0.20, random_state=42)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 235
    },
    "colab_type": "code",
    "id": "i9-4wL5gsSgc",
    "outputId": "49bd321c-37f9-4e6f-93dc-aa59afeb26ef"
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "kneighbors 2\n",
      "0.9\n",
      "              precision    recall  f1-score   support\n",
      "\n",
      "           0       0.97      0.82      0.89        40\n",
      "           1       0.85      0.97      0.91        40\n",
      "\n",
      "    accuracy                           0.90        80\n",
      "   macro avg       0.91      0.90      0.90        80\n",
      "weighted avg       0.91      0.90      0.90        80\n",
      "\n",
      "\n"
     ]
    }
   ],
   "source": [
    "#k_neighbering Algorithm \n",
    "KNN = KNeighborsClassifier(n_neighbors=2)\n",
    "KNN.fit(X_train, y_train)\n",
    "pred = KNN.predict(X_test)\n",
    "    # accuracy\n",
    "accuracy = accuracy_score(pred, y_test)\n",
    "print(\"kneighbors {}\".format(2))\n",
    "print(accuracy)\n",
    "print(classification_report(pred, y_test, labels=None))\n",
    "print(\"\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 54
    },
    "colab_type": "code",
    "id": "c7Lmv1DXtOQ4",
    "outputId": "0db6e29b-0ba6-4b73-8ebb-1074f2aaeef4"
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Accuracy for SVM: \n",
      "0.925\n"
     ]
    }
   ],
   "source": [
    "#Support Vector Machine \n",
    "from sklearn import svm\n",
    "SvmModel = svm.SVC()\n",
    "SvmModel.fit(X_train,y_train)\n",
    "pred=SvmModel.predict(X_test)\n",
    "accuracy=accuracy_score(pred,y_test)\n",
    "print(\"Accuracy for SVM: \")\n",
    "print(accuracy)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 218
    },
    "colab_type": "code",
    "id": "HXBeK2gkuLDZ",
    "outputId": "7838ba02-1739-4af4-ee41-d34c90d9afb7"
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>name</th>\n",
       "      <th>tcp_packets</th>\n",
       "      <th>dist_port_tcp</th>\n",
       "      <th>external_ips</th>\n",
       "      <th>vulume_bytes</th>\n",
       "      <th>udp_packets</th>\n",
       "      <th>tcp_urg_packet</th>\n",
       "      <th>source_app_packets</th>\n",
       "      <th>remote_app_packets</th>\n",
       "      <th>source_app_bytes</th>\n",
       "      <th>remote_app_bytes</th>\n",
       "      <th>duracion</th>\n",
       "      <th>avg_local_pkt_rate</th>\n",
       "      <th>avg_remote_pkt_rate</th>\n",
       "      <th>source_app_packets.1</th>\n",
       "      <th>dns_query_times</th>\n",
       "      <th>type</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>AntiVirus</td>\n",
       "      <td>36</td>\n",
       "      <td>6</td>\n",
       "      <td>3</td>\n",
       "      <td>3911</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>39</td>\n",
       "      <td>33</td>\n",
       "      <td>5100</td>\n",
       "      <td>4140</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>39</td>\n",
       "      <td>3</td>\n",
       "      <td>benign</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>AntiVirus</td>\n",
       "      <td>117</td>\n",
       "      <td>0</td>\n",
       "      <td>9</td>\n",
       "      <td>23514</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>128</td>\n",
       "      <td>107</td>\n",
       "      <td>26248</td>\n",
       "      <td>24358</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>128</td>\n",
       "      <td>11</td>\n",
       "      <td>benign</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>AntiVirus</td>\n",
       "      <td>196</td>\n",
       "      <td>0</td>\n",
       "      <td>6</td>\n",
       "      <td>24151</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>205</td>\n",
       "      <td>214</td>\n",
       "      <td>163887</td>\n",
       "      <td>24867</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>205</td>\n",
       "      <td>9</td>\n",
       "      <td>benign</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>AntiVirus</td>\n",
       "      <td>6</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>889</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>7</td>\n",
       "      <td>6</td>\n",
       "      <td>819</td>\n",
       "      <td>975</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>7</td>\n",
       "      <td>1</td>\n",
       "      <td>benign</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>AntiVirus</td>\n",
       "      <td>6</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>882</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>7</td>\n",
       "      <td>6</td>\n",
       "      <td>819</td>\n",
       "      <td>968</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>7</td>\n",
       "      <td>1</td>\n",
       "      <td>benign</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "        name  tcp_packets  ...  dns_query_times    type\n",
       "0  AntiVirus           36  ...                3  benign\n",
       "1  AntiVirus          117  ...               11  benign\n",
       "2  AntiVirus          196  ...                9  benign\n",
       "3  AntiVirus            6  ...                1  benign\n",
       "4  AntiVirus            6  ...                1  benign\n",
       "\n",
       "[5 rows x 17 columns]"
      ]
     },
     "execution_count": 11,
     "metadata": {
      "tags": []
     },
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#Dynamic Analysis\n",
    "import pandas as pd\n",
    "data = pd.read_csv(\"android_traffic.csv\", sep=\";\")\n",
    "data.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 126
    },
    "colab_type": "code",
    "id": "_cRmWeLk21b0",
    "outputId": "ae4e53c2-f7e9-4716-982c-31efd4182028"
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "Index(['name', 'tcp_packets', 'dist_port_tcp', 'external_ips', 'vulume_bytes',\n",
       "       'udp_packets', 'tcp_urg_packet', 'source_app_packets',\n",
       "       'remote_app_packets', 'source_app_bytes', 'remote_app_bytes',\n",
       "       'duracion', 'avg_local_pkt_rate', 'avg_remote_pkt_rate',\n",
       "       'source_app_packets.1', 'dns_query_times', 'type'],\n",
       "      dtype='object')"
      ]
     },
     "execution_count": 12,
     "metadata": {
      "tags": []
     },
     "output_type": "execute_result"
    }
   ],
   "source": [
    "data.columns"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 72
    },
    "colab_type": "code",
    "id": "n38tZHye4i4x",
    "outputId": "1baf3e9f-aa86-4b71-99a1-95b7217cb8a1"
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "benign       4704\n",
       "malicious    3141\n",
       "Name: type, dtype: int64"
      ]
     },
     "execution_count": 13,
     "metadata": {
      "tags": []
     },
     "output_type": "execute_result"
    }
   ],
   "source": [
    "data.type.value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 345
    },
    "colab_type": "code",
    "id": "miUvZx_g4vRF",
    "outputId": "cdf78b8d-6823-4b5e-fe96-d58498ff6a6a"
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "name                       0\n",
       "tcp_packets                0\n",
       "dist_port_tcp              0\n",
       "external_ips               0\n",
       "vulume_bytes               0\n",
       "udp_packets                0\n",
       "tcp_urg_packet             0\n",
       "source_app_packets         0\n",
       "remote_app_packets         0\n",
       "source_app_bytes           0\n",
       "remote_app_bytes           0\n",
       "duracion                7845\n",
       "avg_local_pkt_rate      7845\n",
       "avg_remote_pkt_rate     7845\n",
       "source_app_packets.1       0\n",
       "dns_query_times            0\n",
       "type                       0\n",
       "dtype: int64"
      ]
     },
     "execution_count": 14,
     "metadata": {
      "tags": []
     },
     "output_type": "execute_result"
    }
   ],
   "source": [
    "data.isna().sum()\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {
    "colab": {},
    "colab_type": "code",
    "id": "jiAuzjKC8wy1"
   },
   "outputs": [],
   "source": [
    "data = data.drop(['duracion','avg_local_pkt_rate','avg_remote_pkt_rate'], axis=1).copy()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 35
    },
    "colab_type": "code",
    "id": "va7uMRYX87FI",
    "outputId": "d8a7bfc5-2a5f-43df-efa3-f0b15b8ca3af"
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "(7845, 13)"
      ]
     },
     "execution_count": 16,
     "metadata": {
      "tags": []
     },
     "output_type": "execute_result"
    }
   ],
   "source": [
    "data = data.drop(columns=[\"tcp_urg_packet\"], axis=1).copy()\n",
    "data.shape"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 272
    },
    "colab_type": "code",
    "id": "wMq9T2Nr9ZCu",
    "outputId": "6c2ed7cd-8595-45f5-9acd-f246f8735924"
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "name                    AntiVirusAntiVirusAntiVirusAntiVirusAntiVirusA...\n",
       "tcp_packets                                                         15038\n",
       "dist_port_tcp                                                        3514\n",
       "external_ips                                                         1434\n",
       "vulume_bytes                                                      2061210\n",
       "udp_packets                                                            38\n",
       "source_app_packets                                                  21720\n",
       "remote_app_packets                                                  18841\n",
       "source_app_bytes                                                  8615120\n",
       "remote_app_bytes                                                  2456160\n",
       "source_app_packets.1                                                21720\n",
       "dns_query_times                                                      5095\n",
       "type                    benignbenignbenignbenignbenignbenignbenignbeni...\n",
       "dtype: object"
      ]
     },
     "execution_count": 17,
     "metadata": {
      "tags": []
     },
     "output_type": "execute_result"
    }
   ],
   "source": [
    "data[data.duplicated()].sum()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {
    "colab": {},
    "colab_type": "code",
    "id": "fXIx2Da-s01v"
   },
   "outputs": [],
   "source": [
    "data=data.drop('source_app_packets.1',axis=1).copy()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {
    "colab": {},
    "colab_type": "code",
    "id": "6VAKPbpeJ0B6"
   },
   "outputs": [],
   "source": [
    "scaler = preprocessing.RobustScaler()\n",
    "scaledData = scaler.fit_transform(data.iloc[:,1:11])\n",
    "scaledData = pd.DataFrame(scaledData, columns=['tcp_packets','dist_port_tcp','external_ips'\n",
    ",'vulume_bytes','udp_packets','source_app_packets','remote_app_packets',' source_app_bytes','remote_app_bytes','dns_query_times'])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {
    "colab": {},
    "colab_type": "code",
    "id": "qn-9RyzGJ4B2"
   },
   "outputs": [],
   "source": [
    "#Modeling\n",
    "X_train, X_test, y_train, y_test = train_test_split(scaledData.iloc[:,0:10], data.type.astype(\"str\"), test_size=0.25, random_state=45)\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 35
    },
    "colab_type": "code",
    "id": "dl6n8wjnKHxj",
    "outputId": "c83ea80d-112b-42eb-a639-0bcdbc526a01"
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "90.46890927624872"
      ]
     },
     "execution_count": 22,
     "metadata": {
      "tags": []
     },
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#Modeling with RF \n",
    "RandomF=RandomForestClassifier(n_estimators=250, max_depth=50,random_state=45)\n",
    "RandomF.fit(X_train,y_train)\n",
    "pred=RandomF.predict(X_test)\n",
    "accuracyR=accuracy_score(pred,y_test)\n",
    "accuracyR*100"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "colab": {},
    "colab_type": "code",
    "id": "6bC3CTCRNTjM"
   },
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "colab": {
   "name": "Android Malware Classifierr.ipynb",
   "provenance": []
  },
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.4"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 1
}