rnn.py

# Use with IPython

import pandas as pd
import numpy as np 

dataset = pd.read_csv("data/hashed_data_50.csv")
dataset = dataset[["API Calls", "Malicious"]]

leg = dataset[dataset['Malicious'] == 0]
mal = dataset[dataset['Malicious'] == 1]

# Count of Objects in two classes
print("Legitimate samples: ", len(leg))
print("Malicious samples: ", len(mal))

# Replicate data
#data = pd.concat([leg]*2+[mal], ignore_index=True)
data = pd.concat([leg]+[mal], ignore_index=True)

print("Legitimate samples: ", len(data[data['Malicious'] == 0]))
print("Malicious samples: ", len(data[data['Malicious'] == 1]))


# Tokenize API Calls
from keras.preprocessing.text import Tokenizer
from keras.preprocessing import sequence

tokenizer = Tokenizer(num_words=300, split=' ')
tokenizer.fit_on_texts(data['API Calls'])
X = tokenizer.texts_to_sequences(data['API Calls'])

# Save tokens
#import io, json
#tokenizer_json = tokenizer.to_json()
#with io.open('tokenizer.json', "w", encoding="utf-8") as f:
#    f.write(json.dumps(tokenizer_json, ensure_ascii=False))
    
# Delete invalid rows (need to run twice?)
deleteRows = [i for i, r in enumerate(X) if len(r) > 50] 
[X.pop(i) for i in deleteRows] 
data = data.drop(data.index[[deleteRows]]) 
Y = data['Malicious']

X = sequence.pad_sequences(X)#[:,1:]
X = np.fliplr(X)


### Fill up data with Generated Window-Slided legal data
from random import randint

leg_indxs = [i for i, v in enumerate(Y) if v == 0]
toAppendY = []
toAppendX = []
for _ in range(len(mal)-len(leg)):
    i = randint(0, len(leg_indxs))
    l = randint(1, 25)
    r = np.zeros(shape=(50), dtype=np.int32)
    r[:l] = np.array(X[i][:l])
    toAppendX.append(r)
    toAppendY.append(0)
toAppendX = np.array(toAppendX)    
Y = Y.append(pd.Series(toAppendY))
X = np.concatenate((X, toAppendX))

 # Flip sequence
# Split Train-Test
from sklearn.model_selection import train_test_split

X_train, X_test, Y_train, Y_test = train_test_split(X,Y, test_size = 0.3, random_state = 42)

X_train = np.array(X_train)
Y_train = np.array(Y_train)
#X_train = np.reshape(X_train, (X_train.shape[0], X_train.shape[1], 1))

# Build RNN model
from keras.models import Sequential
from keras.layers import Dense, Embedding, LSTM, SpatialDropout1D, Dropout

model = Sequential()
# tokenizer.word_index.items() to see len of dict
model.add(Embedding(2229, 128, input_length = X.shape[1]))
model.add(SpatialDropout1D(0.3))
model.add(LSTM(units=150, return_sequences=True))
model.add(SpatialDropout1D(0.3))
model.add(LSTM(units=150, return_sequences=True))
model.add(SpatialDropout1D(0.3))
model.add(LSTM(units=150))
model.add(Dense(units=1))#, activation='softmax'))
model.compile(loss = 'mean_squared_error', optimizer='adam',metrics = ['accuracy'])
print(model.summary())

"""
from keras.utils import plot_model
import os
os.environ["PATH"] += os.pathsep + r'C:\Program Files (x86)\graphviz\bin'
plot_model(model, show_layer_names=True, show_shapes=True, to_file='model.png')
"""

# Train
from keras.callbacks import ModelCheckpoint
# SAVE MODEL
def saveModel(m, name):
    model_json = m.to_json()
    with open(name+".json", "w") as json_file:
        json_file.write(model_json)
    m.save_weights(name+".h5")

checkpoint = ModelCheckpoint("models/model_50api_500_check.h5", monitor='loss', verbose=1, save_best_only=True, mode='min')
model.fit(X_train, Y_train, epochs = 500, batch_size=64, callbacks=[checkpoint])
saveModel(model, "model_50api_500")


# LOAD MODEL
from keras.models import model_from_json

with open("models/model_50api_500.json", "r") as f:
    model = model_from_json(f.read())
model.load_weights('models/model_50api_500.h5')


# Test model
from sklearn.metrics import confusion_matrix, accuracy_score
y_test_pred = model.predict(X_test)
cmp = np.concatenate((y_test_pred, pd.DataFrame(Y_test)), axis = 1)

pred = (y_test_pred > 0.5)
cm = confusion_matrix(Y_test, pred)
print("Test accuracy: ",accuracy_score(Y_test, pred))
print("FP={0}, FN={1}".format(cm[0][1]/sum(sum(cm)), cm[1][0]/sum(sum(cm))))


# Test window-sliding
APIs = X_test.shape[1]
obj = np.reshape(X_test[4], (1, APIs))
timeline = np.zeros(shape=(APIs, APIs))#[[0 for i in range(150)] for j in range(150)]
for i in range(APIs):
    timeline[i][:i+1] = obj[0,:i+1]
timeline_pred = model.predict(timeline)

class Assessment:
    def __init__(self, size):
        self.true = None
        self.prediction = None
        self.a1 = None
        self.a2 = None
        self.a3 = None
        self.a4 = None
        self.avg = None
        self.final = None
        self.errors = np.empty((size), np.float32)
        
# Window-sliding accuracy
def getTimeline(x, shape):
    obj = np.reshape(x, (1, shape)) # "Turn over" array to fit input horizontally
    timeline = np.zeros(shape=(shape, shape))
    for call in range(shape):
        timeline[call][:call+1] = obj[0,:call+1]
    return timeline

Y_test = Y_test.reset_index()[0]
total = X_test.shape[0]
APIs = X_test.shape[1]
assesments = [None]*total

total_errors = np.zeros((APIs), np.float32)
total_1class_erros = np.zeros((APIs), np.float32)
total_2class_erros = np.zeros((APIs), np.float32)

validation_size = X_test.shape[0]
for i, x in enumerate(X_test[:validation_size]):
    t = getTimeline(x, APIs)
    obj = Assessment(size=APIs)
    obj.prediction = model.predict(t)
    
    y = obj.true = Y_test[i]
    if y == 1:
        for j, p in enumerate(obj.prediction):
            total_1class_erros[j] += abs(y-p)
    else:
        for j, p in enumerate(obj.prediction):
            total_2class_erros[j] += abs(y-p)
            
    for j, p in enumerate(obj.prediction):
        obj.errors[j] =  abs(y-p)
        total_errors[j] += obj.errors[j]
    print(f"Asessment progress {i+1}/{total}")
    
for i in range(APIs):
    total_errors[i] = total_errors[i]/validation_size
    total_1class_erros[i] = total_1class_erros[i]/validation_size
    total_2class_erros[i] = total_2class_erros[i]/validation_size

def calcAccByErr(errors, offset=0):
    return  1 - (sum(errors[offset:])/(APIs-offset))

window_offset = 99
print("Window-sliding accuracy (offset={0}):\n  Total: {1:.4f}%".format(window_offset, calcAccByErr(total_errors, window_offset)*100))
print("  Malwares: {0:.4f}%".format(calcAccByErr(total_1class_erros, window_offset)*100))
print("  Legal files: {0:.4f}%".format(calcAccByErr(total_2class_erros, window_offset)*100))


## Plots
import matplotlib.pyplot as plt

plt.plot(total_errors, color="blue", label="Total error")
plt.plot(total_1class_erros, color="red", label="False negatives")
plt.plot(total_2class_erros, color="green", label="False positives")
plt.title("Prediction error")
plt.xlabel("Number of API calls")
plt.ylabel("Error")
plt.legend()
plt.show()