Network_data_mining_python/Lab3.py at main · kunyoungp/Network_data_mining_python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
import scipy
import pandas as pd
import networkx as nx
import matplotlib.pyplot as plt

df = pd.read_csv('SFlow Data -Sem 1 2020.csv', index_col=False, names=['type', 'flow_agent_addr',
                                                             'inputPort', 'outputPort', 'src_MAC', 'dst_MAC',
                                                             'eth_type', 'in_vlan', 'out_vlan',
                                                             'src_IP', 'dst_IP', 'IP_Protocol', 'ip_tos', 'ip_ttl',
                                                             'src_port', 'dst_port',
                                                             'tcp_flags', 'packet_size', 'IP_size', 'sampling_rate'])

print('Parsing data...\n')

top5_talkers_ip = df['src_IP'].value_counts()[:5]
top5_listeners_ip = df['dst_IP'].value_counts()[:5]

tcp_count = df['IP_Protocol'].value_counts().get(6)
udp_count = df['IP_Protocol'].value_counts().get(17)

top3_IP_Protocols = df['IP_Protocol'].value_counts()[:3]

top5_apps_protocol = df['dst_port'].value_counts()[:5]

total_traffic = df['IP_size'].sum()

print('Top 5 Talkers (IP):')
print(top5_talkers_ip)
print('\n')

print('Top 5 Listeners (IP):')
print(top5_listeners_ip)
print('\n')

print('TCP and UDP proportions:')
number_of_rows = len(df.index)
print(number_of_rows)
print('TCP count: ',tcp_count)
print('UDP count: ',udp_count)
print('TCP Proportion: ',round((tcp_count/number_of_rows)*100,2))
print('UDP Proportion: ',round((udp_count/number_of_rows)*100,2))
print('\n')

print('Top 3 IP Protocols:')
print(top3_IP_Protocols)
print('\n')

print('Top 5 Application Protocols:')
print(top5_apps_protocol)
print('\n')

print('Total traffic: {} bytes\n'.format(total_traffic))

#Additional Analysis
print('Additional stats:\n')

pairs = {}
for index, row in df.iterrows():
    word1 = row['src_IP'] + '/' + row['dst_IP']
    word2 = row['dst_IP'] + '/' + row['src_IP']
    if word1 in pairs.keys():
        pairs[word1] += 1
    elif word2 in pairs.keys():
        pairs[word2] += 1
    else:
        pairs[word1] = 1

pairs_sorted = sorted([(k, v) for k, v in pairs.items()], key=lambda x: x[1], reverse=True)

print('Top 5 communication pairs:\n{}\n'.format(pairs_sorted[:5]))

G = nx.Graph()
nodes = list(set(df['src_IP'].tolist() + df['dst_IP'].tolist()))  # creating nodes
G.add_nodes_from(nodes)
for (p, n) in pairs_sorted:
    G.add_edge(p.split('/')[0], p.split('/')[1], weight=n)

size = []
color = []
for node in nodes:
    if G.degree(node, weight='weight') < 25:
        color.append('g')
        size.append(5)
    elif G.degree(node, weight='weight') < 50:
        color.append('b')
        size.append(10)
    elif G.degree(node, weight='weight') < 75:
        color.append('c')
        size.append(15)
    elif G.degree(node, weight='weight') < 100:
        color.append('y')
        size.append(20)
    elif G.degree(node, weight='weight') < 125:
        color.append('m')
        size.append(25)
    else:
        color.append('r')
        size.append(30)
edges = G.edges()
weights = [G[u][v]['weight'] / 500 for u, v in edges]
print('Network visualised:\n')
print('plotting...\n')
#draw_random, draw_circular, draw_spring, etc to change the graph type
nx.draw_random(G, node_size=size, node_color=color, width=weights, cmap=plt.cm.bwr)
plt.show()