04_phishing_url_detect.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# **Phishing URL Detection**\n",
    "\n",
    "phishing url detection with machine learning"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [],
   "source": [
    "import os\n",
    "import pandas as pd\n",
    "import numpy as np\n",
    "\n",
    "import keras\n",
    "from keras.preprocessing.sequence import pad_sequences\n",
    "from keras.models import load_model\n",
    "\n",
    "from models.phishing import simple_bilstm\n",
    "\n",
    "PHISHING_DATA_DIR_PATH = \"./data/phishing_url\"\n",
    "PHISHING_CACHE_DIR_PATH = \"./cache/phishing_url\"\n",
    "\n",
    "model_file_path = os.path.join(PHISHING_CACHE_DIR_PATH, \"simple_bilstm.h5\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## read data"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [],
   "source": [
    "def read_data():\n",
    "    blacklist = os.path.join(PHISHING_DATA_DIR_PATH, 'phishing_database.csv')\n",
    "    whitelist = os.path.join(PHISHING_DATA_DIR_PATH, 'whitelist.txt')\n",
    "\n",
    "    urls = {}\n",
    "\n",
    "    blacklist = pd.read_csv(blacklist)\n",
    "\n",
    "    # Assign 0 for non-malicious and 1 as malicious for supervised learning.\n",
    "    for url in blacklist['url']:\n",
    "        urls[url] = 1\n",
    "\n",
    "    with open(whitelist, 'r') as f:\n",
    "        lines = f.read().splitlines()\n",
    "        for url in lines:\n",
    "            urls[url] = 0\n",
    "\n",
    "    return urls\n",
    "\n",
    "urls = read_data()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "label == 1:  29769\n",
      "label == 0:  38228\n",
      "Found 69 unique tokens.\n",
      "Shape of data tensor: (67997, 128)\n",
      "Shape of label tensor: (67997,)\n"
     ]
    }
   ],
   "source": [
    "samples = []\n",
    "labels = []\n",
    "for k, v in urls.items():\n",
    "    samples.append(k)\n",
    "    labels.append(v)\n",
    "    #print(k, v)\n",
    "\n",
    "print(\"label == 1: \", labels.count(1))\n",
    "print(\"label == 0: \", labels.count(0))\n",
    "\n",
    "max_chars, maxlen, num_chars, embedding_vector_length, sequences = simple_bilstm.build_tokenizer(\n",
    "        samples)\n",
    "\n",
    "data = pad_sequences(sequences, maxlen=maxlen)\n",
    "\n",
    "labels = np.asarray(labels)\n",
    "print('Shape of data tensor:', data.shape)\n",
    "print('Shape of label tensor:', labels.shape)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "training_samples:  64597\n",
      "validation_samples:  3399\n"
     ]
    }
   ],
   "source": [
    "# Divide data between training, cross-validation, and test data.\n",
    "training_samples = int(len(samples) * 0.95)\n",
    "validation_samples = int(len(labels) * 0.05)\n",
    "print(\"training_samples: \", training_samples)\n",
    "print(\"validation_samples: \", validation_samples)\n",
    "\n",
    "indices = np.arange(data.shape[0])\n",
    "np.random.shuffle(indices)\n",
    "data = data[indices]\n",
    "labels = labels[indices]\n",
    "\n",
    "'''\n",
    "x = data\n",
    "y = labels\n",
    "'''\n",
    "x = data[:training_samples]\n",
    "y = labels[:training_samples]\n",
    "x_test = data[training_samples: training_samples + validation_samples]\n",
    "y_test = labels[training_samples: training_samples + validation_samples]\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Train model"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Define callbacks for Keras.\n",
    "callbacks_list = [\n",
    "    keras.callbacks.ModelCheckpoint(\n",
    "        filepath=model_file_path,\n",
    "        monitor='val_loss',\n",
    "        save_best_only=True\n",
    "    ),\n",
    "    keras.callbacks.EarlyStopping(\n",
    "        monitor='val_loss',\n",
    "        min_delta=0,\n",
    "        patience=2,\n",
    "        mode='auto',\n",
    "        baseline=None,\n",
    "    )\n",
    "]\n",
    "\n",
    "model = simple_bilstm.build_model(\n",
    "    num_chars, embedding_vector_length, maxlen)\n",
    "\n",
    "# Train.\n",
    "model.fit(x, y,\n",
    "            epochs=10,\n",
    "            batch_size=32,\n",
    "            callbacks=callbacks_list,\n",
    "            validation_split=0.20,\n",
    "            shuffle=True\n",
    "            )"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Eval Model"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "4/4 [==============================] - 14s 3s/step - loss: 0.0066 - accuracy: 0.9982\n",
      "Model Accuracy: 99.82%\n"
     ]
    }
   ],
   "source": [
    "# Evaluate model on test data.\n",
    "model = load_model(model_file_path)\n",
    "score, acc = model.evaluate(x_test, y_test, verbose=1, batch_size=1024)\n",
    "\n",
    "print(\"Model Accuracy: {:0.2f}%\".format(acc * 100))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/Users/kunma/opt/anaconda3/envs/url-analysis/lib/python3.7/site-packages/tensorflow/python/keras/engine/sequential.py:450: UserWarning: `model.predict_classes()` is deprecated and will be removed after 2021-01-01. Please use instead:* `np.argmax(model.predict(x), axis=-1)`,   if your model does multi-class classification   (e.g. if it uses a `softmax` last-layer activation).* `(model.predict(x) > 0.5).astype(\"int32\")`,   if your model does binary classification   (e.g. if it uses a `sigmoid` last-layer activation).\n",
      "  warnings.warn('`model.predict_classes()` is deprecated and '\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "              precision    recall  f1-score   support\n",
      "\n",
      "           0    0.99790   0.99895   0.99843      1904\n",
      "           1    0.99866   0.99732   0.99799      1495\n",
      "\n",
      "    accuracy                        0.99823      3399\n",
      "   macro avg    0.99828   0.99814   0.99821      3399\n",
      "weighted avg    0.99824   0.99823   0.99823      3399\n",
      "\n"
     ]
    }
   ],
   "source": [
    "from sklearn.metrics import classification_report\n",
    "pred = model.predict_classes(x_test)\n",
    "print(classification_report(y_test, pred, digits=5))"
   ]
  }
 ],
 "metadata": {
  "interpreter": {
   "hash": "a6057abd5798a041d5b2e8597a30353311df594746bf26b0b4c3807e7d6a1eaa"
  },
  "kernelspec": {
   "display_name": "Python 3.7.6 ('url-analysis')",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.6"
  },
  "orig_nbformat": 4
 },
 "nbformat": 4,
 "nbformat_minor": 2
}