https://github.com/grananqvist/machine-learning-web-application-firewall-and-dataset

https://github.com/grananqvist/machine-learning-web-application-firewall-and-dataset

ai dataset firewall machine-learning malicious waf

Last synced: about 1 year ago
JSON representation

• Host: GitHub
• URL: https://github.com/grananqvist/machine-learning-web-application-firewall-and-dataset
• Owner: grananqvist
• License: mit
• Created: 2017-04-05T22:00:22.000Z (over 9 years ago)
• Default Branch: master
• Last Pushed: 2018-02-26T12:13:13.000Z (over 8 years ago)
• Last Synced: 2023-11-11T16:28:23.066Z (over 2 years ago)
• Topics: ai, dataset, firewall, machine-learning, malicious, waf
• Language: Jupyter Notebook
• Size: 39.1 MB
• Stars: 60
• Watchers: 6
• Forks: 22
• Open Issues: 3
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

          
# Machine learning based web application firewall

Machine learning based Web Application firewall for detection attacks such as SQL injections, XSS and shell script injections. 

Course project for TDA602

Contributors: Filip Granqvist & Oskar Holmberg

Requirements:

 - Python 3.x

 - Jupyter notebook

 - Python libraries

   * Pandas

   * Numpy

   * Sklearn

   * matplotlib

   * seaborn

   * scipy

 - Node.js (to run demo server)

Follow along our development process in these notebooks:

 - 0_Data_wrangling.ipynb	(Formating other sources of payload datasets into a common format (don't step through this))

 - 1_Data_cleaning.ipynb	(Cleaning the data and output into a common .csv file)

 - 2_Data_analysis.ipynb (All analysis, training, evaluation and saving models to pickles (not recommended to step through the training section, takes a long time))

 

 To run notebooks (they can also be read from github):

 1. Install jupyter notebook

 2. type in cmd: jupyter notebook 

 3. step through each part of the notebook using Ctrl+Enter or from the toolbar

 

 

 Plots_technical_background.ipynb contains junk used to create images for the report  

   

 Demo-server contains a Node.js server with our best classifier (in the form of a .pickle) implemented available for live testing  

 See README.md in demo-server for instructions on how to set up the server  

   

 images contains images used for the report

 

 data folder contains our malicious and non-malicious data. Also contains trained classifiers in form of .pickle files  

 tfidf_2grams_randomforest.p contains our single best classifier  

 trained_classifiers.p contains all our classifiers along with performance metrics. But this is not the final version, it was too big for github. Download the final version from here: https://1drv.ms/f/s!Aj1zBHCOJiQFgbQwDswBYtpzB1Pulg and replace the old one