projet_ml_version_5.py

# -*- coding: utf-8 -*-
"""Projet_ML_version 5.ipynb

Automatically generated by Colab.

Original file is located at
    https://colab.research.google.com/drive/1P3rb1ruFy_6EBAGHWSNmU3LgaBbjO3yc
"""

# 1 biblio+chargemment
import pandas as pd
import seaborn as sns
import numpy as np
import matplotlib.pyplot as plt

df = pd.read_csv("/content/cybersecurity_intrusion_data.csv")
print(df.head())

print(df.shape)

df.info()

import missingno as msno
import matplotlib.pyplot as plt
msno.bar(df)
plt.show()

import seaborn as sns
sns.pairplot(df,hue="attack_detected", palette="pastel")

print(df['attack_detected'].value_counts(normalize=True))
#0 correspond à un trafic normal (aucune attaque détectée).​
#1 correspond à une attaque détectée / trafic malveillant

plt.figure(figsize=(10,8))
sns.histplot(x='network_packet_size',data=df)
plt.title('Distribution of Network Packet Size')
plt.show()

# ------------------------------------------------------------------
# 2. Nettoyage de base
# ------------------------------------------------------------------

# On supprime l’identifiant de session (pas utile pour le modèle)
df = df.drop(columns=['session_id'])

# Gestion des valeurs manquantes (exemple simple)
for col in df.select_dtypes(include=['float64', 'int64']).columns:
    df[col] = df[col].fillna(df[col].median())

for col in df.select_dtypes(include=['object']).columns:
    df[col] = df[col].fillna(df[col].mode()[0])

plt.figure(figsize=(5,5))
sns.countplot(x='protocol_type', data=df, palette='tab20')
plt.title('Protocol Types')
plt.xlabel('0 = ICMP , 1 = TCP , 2 = UDP')
plt.show()

plt.figure(figsize=(8,6))
sns.countplot(x='login_attempts', data=df, palette='tab20')
plt.title('Login Attempts')
plt.show()

plt.figure(figsize=(7,7))
sns.countplot(x='encryption_used', data=df, palette='tab10')
plt.title('Encryption Used')
plt.xlabel('0 = AES , 1 = DES')
plt.show()

# ------------------------------------------------------------------
# 3. Visualisations exploratoires
# ------------------------------------------------------------------
plt.figure(figsize=(4,4))
sns.countplot(data=df, x='attack_detected', palette='tab10')
plt.title("Répartition de la variable cible")
plt.xlabel("Type de trafic")
plt.show()

value = df['browser_type'].value_counts()

Labels = ['Chrome','Firefox','Edge','Unknown','Safari']

plt.figure(figsize=(8,8))
plt.pie(value,autopct='%1.1f%%',labels=Labels)
plt.title('Browser Type')
plt.show()

plt.figure(figsize=(8,8))
sns.heatmap(df.select_dtypes(include=['number']).corr(),annot=True)
plt.show()

# b) Corrélation entre features numériques
num_cols = df.select_dtypes(include=['float64', 'int64']).columns.drop('attack_detected')

plt.figure(figsize=(8,6))
corr = df[num_cols.tolist() + ['attack_detected']].corr()
sns.heatmap(corr, annot=True, fmt=".2f", cmap="coolwarm")
plt.title("Matrice de corrélation")
plt.show()

label_map = {0: "Trafic normal", 1: "Trafic malveillant"}

plt.figure(figsize=(6,4))
sns.boxplot(
    data=df,
    x=df['attack_detected'].replace(label_map),
    y='session_duration'
)
plt.title("Session duration selon attack_detected")
plt.show()

# d) Variable catégorielle vs cible (exemple protocol_type)
plt.figure(figsize=(6,4))
sns.countplot(data=df, x='protocol_type', hue='attack_detected')
plt.title("Protocol type vs attack_detected")
plt.xticks(rotation=30)
plt.show()

from sklearn.model_selection import train_test_split
from sklearn.preprocessing import StandardScaler, OneHotEncoder, KBinsDiscretizer, PolynomialFeatures
from sklearn.compose import ColumnTransformer
from sklearn.pipeline import Pipeline
from sklearn.impute import SimpleImputer
from sklearn.ensemble import IsolationForest

# ------------------------------------------------------------------
# 4. Séparation X / y
# ------------------------------------------------------------------
X = df.drop(columns=['attack_detected'])
y = df['attack_detected']

# Colonnes numériques / catégorielles
num_features = X.select_dtypes(include=['float64', 'int64']).columns.tolist()
cat_features = X.select_dtypes(include=['object']).columns.tolist()
print("Colonnes numériques :", num_features)
print("Colonnes catégorielles :", cat_features)

#Détection et retrait des outliers

# On travaille d'abord sur les variables numériques brutes
iso = IsolationForest(contamination=0.02, random_state=42)
outlier_flags = iso.fit_predict(df[num_cols])

# garder uniquement les points non atypiques (label 1)
mask = outlier_flags == 1
df_clean = df.loc[mask].reset_index(drop=True)

df_clean['total_log_activity'] = df_clean['login_attempts'] + df_clean['failed_logins']
df_clean['failed_ratio'] = df_clean['failed_logins'] / df_clean['total_log_activity'].replace(0, 1)

num_features = df_clean.select_dtypes(include=['float64', 'int64']).columns.tolist()
cat_features = df_clean.select_dtypes(include=['object']).columns.tolist()
print("Colonnes numériques :", num_features)
print("Colonnes catégorielles :", cat_features)

X=df_clean.drop(columns=['attack_detected'])
y = df_clean['attack_detected']

print(X.columns)
print(y.name)

# Définir les colonnes à binner
num_for_bin = ['ip_reputation_score']
other_num = [c for c in num_features if c not in num_for_bin]

# 1) Imputation numérique + scaling + polynomial features
numeric_transformer = Pipeline(steps=[
    ("imputer", SimpleImputer(strategy="median")),
    ("scaler", StandardScaler()),
    ("poly", PolynomialFeatures(degree=2, include_bias=False))
])

categorical_transformer = Pipeline(steps=[
    ("imputer", SimpleImputer(strategy="most_frequent")),
    ("onehot", OneHotEncoder(handle_unknown="ignore"))
])

binner = KBinsDiscretizer(n_bins=4, encode="onehot-dense", strategy="quantile")

preprocessor = ColumnTransformer(
    transformers=[
        ("num", numeric_transformer, other_num),
        ("cat", categorical_transformer, cat_features),
        ("ip_bin", binner, num_for_bin)
    ]
)

# ------------------------------------------------------------------
# 6. Split train / validation / test (80% / 10% / 10%)
# ------------------------------------------------------------------

from sklearn.model_selection import train_test_split

# 80% train, 20% temp (val + test)
X_train, X_temp, y_train, y_temp = train_test_split(
    X, y, test_size=0.2, random_state=42, stratify=y
)

# 10% val, 10% test à partir de X_temp (qui vaut 20%)
X_val, X_test, y_val, y_test = train_test_split(
    X_temp, y_temp, test_size=0.5, random_state=42, stratify=y_temp
)

print("Train :", X_train.shape)
print("Val   :", X_val.shape)
print("Test  :", X_test.shape)

# ------------------------------------------------------------------
# 7. Définition des modèles
# ------------------------------------------------------------------

from sklearn.linear_model import LogisticRegression
from sklearn.ensemble import RandomForestClassifier
from sklearn.svm import SVC

models = {
    "LogisticRegression": LogisticRegression(max_iter=1000),
    "RandomForest": RandomForestClassifier(
        n_estimators=200, random_state=42, n_jobs=-1
    ),
    "SVM_RBF": SVC(kernel='rbf', probability=True)
}

print(X_train.columns)
print(y_train.name)

#les 3 models +comparaison
from sklearn.pipeline import Pipeline
from sklearn.metrics import classification_report, confusion_matrix
from sklearn.model_selection import cross_val_score
from sklearn.metrics import make_scorer, f1_score

results = {}

# Redefine num_features and cat_features based on X to exclude target variables
num_features = X.select_dtypes(include=['float64', 'int64']).columns.tolist()
cat_features = X.select_dtypes(include=['object']).columns.tolist()

# Recalculate other_num based on the updated num_features
num_for_bin = ['ip_reputation_score'] # This was defined earlier
other_num = [c for c in num_features if c not in num_for_bin]

# Recreate the preprocessor with the corrected feature lists
preprocessor = ColumnTransformer(
    transformers=[
        ("num", numeric_transformer, other_num),
        ("cat", categorical_transformer, cat_features),
        ("ip_bin", binner, num_for_bin)
    ]
)

# Define a custom scorer for f1 with the correct pos_label
f1_scorer = make_scorer(f1_score, pos_label=1)

for name, clf in models.items():
    pipe = Pipeline(steps=[
        ("preprocess", preprocessor ),
        ("model", clf)
    ])

    print(f"\n=== {name} ===")

    # Cross-validation sur le train (optionnel mais utile)
    cv_scores = cross_val_score(pipe, X_train, y_train, cv=5, scoring=f1_scorer)
    print("F1 CV (train):", cv_scores.mean().round(3), "+/-", cv_scores.std().round(3))

    # Entraînement sur train
    pipe.fit(X_train, y_train)
    results[name] = pipe # Store the fitted pipeline in results

# Évaluation sur validation
y_val_pred = pipe.predict(X_val)
print("\n--- Validation ---")
print(classification_report(y_val, y_val_pred))

# Évaluation finale sur test
from sklearn.metrics import accuracy_score, classification_report
y_test_pred = pipe.predict(X_test)
print("\n--- Test ---")


print("Accuracy:", accuracy_score(y_test, y_test_pred))

print(classification_report(y_test, y_test_pred))

# Matrice de confusion (test) for all models

for model_name, fitted_pipe in results.items():
    y_test_pred = fitted_pipe.predict(X_test)
    cm = confusion_matrix(y_test, y_test_pred)

    plt.figure(figsize=(4,4))
    sns.heatmap(cm, annot=True, fmt="d", cmap="Blues",
                xticklabels=['Trafic normal', 'Trafic malveillant'],
                yticklabels=['Trafic normal', 'Trafic malveillant'])
    plt.title(f"Matrice de confusion (test) - {model_name}")
    plt.xlabel("Prédit")
    plt.ylabel("Réel")
    plt.show()

#Deployement de Modele Random Forest
import joblib

# on choisir RandomForest
best_model = results["RandomForest"]

# Save
joblib.dump(best_model, "intrusion_model.pkl")
print("Model saved!")

#Deployement de Modele
import joblib

# on choisirle LogisticRegression
best_model = results["LogisticRegression"]

# Save
joblib.dump(best_model, "intrusion_model1.pkl")
print("Model saved!")

#Deployement de Modele

import joblib
best_model = results["SVM_RBF"]

# Save
joblib.dump(best_model, "intrusion_model2.pkl")
print("Model saved!")