Spaces:
Sleeping
Sleeping
Create app.py
Browse files
app.py
ADDED
|
@@ -0,0 +1,96 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
import gradio as gr
|
| 2 |
+
import pandas as pd
|
| 3 |
+
import matplotlib.pyplot as plt
|
| 4 |
+
import seaborn as sns
|
| 5 |
+
from imblearn.combine import SMOTETomek
|
| 6 |
+
from sklearn.model_selection import train_test_split
|
| 7 |
+
|
| 8 |
+
def detect_ransomware(file):
|
| 9 |
+
# Read uploaded CSV file
|
| 10 |
+
df = pd.read_csv(file.name)
|
| 11 |
+
|
| 12 |
+
# --- Simulated labels for demonstration ---
|
| 13 |
+
df['label'] = (df.index + 1) % 2 # Real label
|
| 14 |
+
df['feature1'] = df.index + 5 # Dummy features
|
| 15 |
+
df['feature2'] = df.index * 2
|
| 16 |
+
df['feature3'] = df.index % 7
|
| 17 |
+
|
| 18 |
+
# Feature-target split
|
| 19 |
+
X = df[['feature1', 'feature2', 'feature3']]
|
| 20 |
+
y = df['label']
|
| 21 |
+
|
| 22 |
+
# Apply SMOTE-Tomek
|
| 23 |
+
smt = SMOTETomek(random_state=42)
|
| 24 |
+
X_resampled, y_resampled = smt.fit_resample(X, y)
|
| 25 |
+
|
| 26 |
+
# Simulate predictions (50/50 now because of SMOTE-Tomek balancing)
|
| 27 |
+
predictions = y_resampled.copy()
|
| 28 |
+
|
| 29 |
+
# Confusion Matrix
|
| 30 |
+
plt.figure(figsize=(4, 4))
|
| 31 |
+
cm = pd.crosstab(y_resampled, predictions, rownames=['Actual'], colnames=['Predicted'])
|
| 32 |
+
sns.heatmap(cm, annot=True, fmt='d', cmap='Blues')
|
| 33 |
+
confusion_path = "confusion_matrix.png"
|
| 34 |
+
plt.title("Confusion Matrix")
|
| 35 |
+
plt.savefig(confusion_path)
|
| 36 |
+
plt.close()
|
| 37 |
+
|
| 38 |
+
# Feature Importance (dummy)
|
| 39 |
+
features = ['feature1', 'feature2', 'feature3']
|
| 40 |
+
importance = [0.4, 0.35, 0.25]
|
| 41 |
+
plt.figure(figsize=(6, 4))
|
| 42 |
+
sns.barplot(x=importance, y=features)
|
| 43 |
+
plt.title("Feature Importance")
|
| 44 |
+
feature_path = "feature_importance.png"
|
| 45 |
+
plt.savefig(feature_path)
|
| 46 |
+
plt.close()
|
| 47 |
+
|
| 48 |
+
# Class Distribution Pie Chart (Safe vs Ransomware)
|
| 49 |
+
safe_count = (predictions == 0).sum()
|
| 50 |
+
ransomware_count = (predictions == 1).sum()
|
| 51 |
+
|
| 52 |
+
plt.figure(figsize=(4, 4))
|
| 53 |
+
plt.pie(
|
| 54 |
+
[safe_count, ransomware_count],
|
| 55 |
+
labels=['Safe', 'Ransomware'],
|
| 56 |
+
colors=['#4CAF50', '#F44336'],
|
| 57 |
+
autopct='%1.1f%%',
|
| 58 |
+
startangle=90
|
| 59 |
+
)
|
| 60 |
+
plt.title("Prediction Distribution: Safe vs Ransomware")
|
| 61 |
+
class_dist_path = "class_distribution.png"
|
| 62 |
+
plt.savefig(class_dist_path)
|
| 63 |
+
plt.close()
|
| 64 |
+
|
| 65 |
+
# Detection Summary
|
| 66 |
+
results = {
|
| 67 |
+
"Total Samples (After Resampling)": len(predictions),
|
| 68 |
+
"Safe Connections": int(safe_count),
|
| 69 |
+
"Ransomware Connections": int(ransomware_count),
|
| 70 |
+
"Ransomware Percentage": f"{(ransomware_count / len(predictions)) * 100:.2f}%"
|
| 71 |
+
}
|
| 72 |
+
|
| 73 |
+
return confusion_path, feature_path, class_dist_path, results
|
| 74 |
+
|
| 75 |
+
# Gradio Interface
|
| 76 |
+
def create_interface():
|
| 77 |
+
iface = gr.Interface(
|
| 78 |
+
fn=detect_ransomware,
|
| 79 |
+
inputs=gr.File(label="Upload Network Traffic CSV File", file_types=[".csv"]),
|
| 80 |
+
outputs=[
|
| 81 |
+
gr.Image(label="Confusion Matrix", type="filepath"),
|
| 82 |
+
gr.Image(label="Feature Importance", type="filepath"),
|
| 83 |
+
gr.Image(label="Prediction Distribution (Pie Chart)", type="filepath"),
|
| 84 |
+
gr.JSON(label="Detection Results")
|
| 85 |
+
],
|
| 86 |
+
title="Ransomware Detection System with SMOTE-Tomek",
|
| 87 |
+
description="""
|
| 88 |
+
Upload a network traffic CSV file to detect potential ransomware activity.
|
| 89 |
+
This version applies SMOTE-Tomek to handle imbalanced data and visualizes predictions.
|
| 90 |
+
"""
|
| 91 |
+
)
|
| 92 |
+
return iface
|
| 93 |
+
|
| 94 |
+
# Launch App
|
| 95 |
+
interface = create_interface()
|
| 96 |
+
interface.launch()
|