INSTALLATION:
- Install Scikit learn 0.19.0 with:(Mac OS X) pip install -U scikit-learn
- Scikit learn requires:
Python (>= 2.7 or >= 3.3),
NumPy (>= 1.8.2),
SciPy (>= 0.13.3).
Step 1 installs these dependencies automatically. - Install kmodes for python: (A) kmodes can be installed using pip:
pip install kmodes (B) To upgrade to the latest version:
pip install --upgrade kmodes (C) Alternatively, you can build the latest development version from source:
git clone https://github.com/nicodv/kmodes.git cd kmodes python setup.py install kmodes would already be up to date, hence an update for it may not be required.
-
Run: pip install --upgrade scikit-learn This will upgrade scikit learn
-
Install matplotlib: pip install matplotlib
-
Install python-tk: apt-get install python-tk
-
Besides these, we import json, urlparse, re, argparse, sys, os, etc. These are installed by default. If not, a pip install would install it.
TESTING:
-
Create a directory and cd into it: (I'm calling it test-attack). mkdir test-attack cd test-attack
-
For running the analysis, clone or download the repository 'Analysis'. Uncompress this folder and cd into it. cd Analysis This folder has an input file called 'partial-july-log.txt'.
-
Call the argparser.py script this way: python argparser.py --inputfile partial-log-july.txt --analyser hac
Check the INFO.log, ATTACK.log and DEBUG.log files that get created in the repo for more info. PNG files with plots also get created in the directory for more than half the analysers.
This example runs the elliptic analyser for IP address-response size tuple.
Besides these, a number of other analysers are available :
List of available analysers is:
-
dbscan
-
hac
-
local-outlier
-
elliptic
-
knn
-
meanshift
-
centroid-median-hac
-
single-complete-hac
-
ward-avg-hac
-
response_size-kmeans
-
response_status-kmeans
-
response_code
-
peak_hour
-
verb-kproto
-
url-kproto
-
hourly-req-host
-
hourly-requests
-
num_param_ip
-
ip_url_param
-
url_one_time_hit
-
hosts_unique_url_hits
-
missing_extra_params
-
default