dataset.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "import pandas as pd\n",
    "pd.set_option('display.max_columns', 100)\n",
    "import numpy as np\n",
    "import sys\n",
    "import os\n",
    "from subprocess import run, PIPE\n",
    "import shlex"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [],
   "source": [
    "# folder path to attack and normal pcap tcp dump\n",
    "\n",
    "# foler contain attack tcp dump files\n",
    "ATTACK_PCAP_DIR='data/attack_pcap'\n",
    "# folder contain attack csv files\n",
    "ATTACK_CSV_DIR='data/attack_csv'\n",
    "# foler contain normal tcp dump files\n",
    "NORMAL_PCAP_DIR='data/normal_pcap'\n",
    "# folder contain normal csv files\n",
    "NORMAL_CSV_DIR='data/normal_csv'\n",
    "\n",
    "# kdd99 extractor: tcp dumpt to kdd-like connection record\n",
    "CONVERTER= 'tools/kdd99_feature_extractor/build-files/src/kdd99extractor'\n",
    "CONVERTER_ARGS= '-e'\n",
    "\n",
    "KDD_COLUMNS=['duration', 'protocol_type', 'service', 'flag', 'src_bytes', 'dst_bytes', 'land',\n",
    "         'wrong_fragment', 'urgent', 'hot', 'num_failed_logins', 'logged_in', 'num_compromised',\n",
    "         'root_shell', 'su_attempted', 'num_root', 'num_file_creations', 'num_shells',\n",
    "         'num_access_files', 'num_outbound_cmds', 'is_host_login', 'is_guest_login', 'count',\n",
    "         'srv_count', 'serror_rate', 'srv_serror_rate', 'rerror_rate', 'srv_rerror_rate',\n",
    "         'same_srv_rate', 'diff_srv_rate', 'srv_diff_host_rate', 'dst_host_count', 'dst_host_srv_count',\n",
    "         'dst_host_same_srv_rate', 'dst_host_diff_srv_rate', 'dst_host_same_src_port_rate', 'dst_host_srv_diff_host_rate',\n",
    "         'dst_host_serror_rate', 'dst_host_srv_serror_rate', 'dst_host_rerror_rate', 'dst_host_srv_rerror_rate', 'label']\n",
    "COLUMNS=['duration', 'protocol_type', 'service', 'flag', 'src_bytes',\n",
    "        'dst_bytes', 'land', 'wrong_fragment', 'urgent', 'count', 'srv_count',\n",
    "        'serror_rate', 'srv_serror_rate', 'rerror_rate', 'srv_rerror_rate',\n",
    "        'same_srv_rate', 'diff_srv_rate', 'srv_diff_host_rate', 'dst_host_count',\n",
    "        'dst_host_srv_count', 'dst_host_same_srv_rate', 'dst_host_diff_srv_rate',\n",
    "        'dst_host_same_src_port_rate', 'dst_host_srv_diff_host_rate',\n",
    "        'dst_host_serror_rate', 'dst_host_srv_serror_rate', 'dst_host_rerror_rate',\n",
    "        'dst_host_srv_rerror_rate', 'src_ip', 'src_port', 'dst_ip', 'dst_port',\n",
    "        'last_packet_timestamp', 'attack_type', 'attack_method', 'label' ]\n",
    "\n",
    "ATTACK_SUBSET=COLUMNS[:28]+COLUMNS[-3:]\n",
    "NORMAL_SUBSET=COLUMNS[:28]+ COLUMNS[-1:]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [],
   "source": [
    "def pcap2csv(pcap_dir, csv_dir):\n",
    "    \"Convert tcp dump data to kdd99-like connection records as csv file\"\n",
    "    pcap_files=os.listdir(pcap_dir)\n",
    "    for filename in pcap_files:\n",
    "        in_file=os.path.join(pcap_dir, filename)\n",
    "        out_file=os.path.join(csv_dir, filename.replace('.pcap', '.csv'))\n",
    "        print(f\"Converting {in_file} to {out_file}\")\n",
    "        cmd = f\"{CONVERTER} {CONVERTER_ARGS} {in_file} > {out_file}\"\n",
    "        os.system(cmd)\n",
    "        print('done')\n",
    "        print('-----------------')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Converting data/attack_pcap/dos-tcp_rst_flood-1.pcap to data/attack_csv/dos-tcp_rst_flood-1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/dos-tcp_syn_flood-rand_2.pcap to data/attack_csv/dos-tcp_syn_flood-rand_2.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/probe-other-2.pcap to data/attack_csv/probe-other-2.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/dos-http_slow-slowloris_1.pcap to data/attack_csv/dos-http_slow-slowloris_1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/dos-tcp_fin_flood-rand_1.pcap to data/attack_csv/dos-tcp_fin_flood-rand_1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/mitm-arp_poisoning-1.pcap to data/attack_csv/mitm-arp_poisoning-1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/dos-tcp_syn_flood-1.pcap to data/attack_csv/dos-tcp_syn_flood-1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/dos-http_slow-slowloris_2.pcap to data/attack_csv/dos-http_slow-slowloris_2.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/mitm-mac_flooding-1.pcap to data/attack_csv/mitm-mac_flooding-1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/probe-tcp_null_scan-1.pcap to data/attack_csv/probe-tcp_null_scan-1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/mitm-arp_poisoning-2.pcap to data/attack_csv/mitm-arp_poisoning-2.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/dos-icmp_flood-1.pcap to data/attack_csv/dos-icmp_flood-1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/probe-other-1.pcap to data/attack_csv/probe-other-1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/probe-icmp_ping_scan-2.pcap to data/attack_csv/probe-icmp_ping_scan-2.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/probe-icmp_ping_scan-1.pcap to data/attack_csv/probe-icmp_ping_scan-1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/probe-tcp_connection_scan-1.pcap to data/attack_csv/probe-tcp_connection_scan-1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/probe-udp_scan-2.pcap to data/attack_csv/probe-udp_scan-2.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/mitm-ping_of_death-1.pcap to data/attack_csv/mitm-ping_of_death-1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/r2l-guest_passwd-1.pcap to data/attack_csv/r2l-guest_passwd-1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/dos-udp_flood-1.pcap to data/attack_csv/dos-udp_flood-1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/dos-tcp_syn_flood-land.pcap to data/attack_csv/dos-tcp_syn_flood-land.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/dos-http_flood-hulk_1.pcap to data/attack_csv/dos-http_flood-hulk_1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/attack_pcap/probe-udp_scan-1.pcap to data/attack_csv/probe-udp_scan-1.csv\n",
      "done\n",
      "-----------------\n"
     ]
    }
   ],
   "source": [
    "# convert attack tcp dump to csv\n",
    "pcap2csv(ATTACK_PCAP_DIR, ATTACK_CSV_DIR)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Converting data/normal_pcap/normal-1.pcap to data/normal_csv/normal-1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/normal_pcap/2.pcap to data/normal_csv/2.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/normal_pcap/5.pcap to data/normal_csv/5.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/normal_pcap/4.pcap to data/normal_csv/4.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/normal_pcap/normal-2.pcap to data/normal_csv/normal-2.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/normal_pcap/7.pcap to data/normal_csv/7.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/normal_pcap/3.pcap to data/normal_csv/3.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/normal_pcap/normal-4.pcap to data/normal_csv/normal-4.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/normal_pcap/normal-3.pcap to data/normal_csv/normal-3.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/normal_pcap/1.pcap to data/normal_csv/1.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/normal_pcap/8.pcap to data/normal_csv/8.csv\n",
      "done\n",
      "-----------------\n",
      "Converting data/normal_pcap/6.pcap to data/normal_csv/6.csv\n",
      "done\n",
      "-----------------\n"
     ]
    }
   ],
   "source": [
    "# convert normal tcp dump to csv\n",
    "pcap2csv(NORMAL_PCAP_DIR, NORMAL_CSV_DIR)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Process and lable attack connection"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>protocol_type</th>\n",
       "      <th>service</th>\n",
       "      <th>flag</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>count</th>\n",
       "      <th>srv_count</th>\n",
       "      <th>serror_rate</th>\n",
       "      <th>srv_serror_rate</th>\n",
       "      <th>rerror_rate</th>\n",
       "      <th>srv_rerror_rate</th>\n",
       "      <th>same_srv_rate</th>\n",
       "      <th>diff_srv_rate</th>\n",
       "      <th>srv_diff_host_rate</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "      <th>src_ip</th>\n",
       "      <th>src_port</th>\n",
       "      <th>dst_ip</th>\n",
       "      <th>dst_port</th>\n",
       "      <th>last_packet_timestamp</th>\n",
       "      <th>attack_type</th>\n",
       "      <th>attack_method</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "Empty DataFrame\n",
       "Columns: [duration, protocol_type, service, flag, src_bytes, dst_bytes, land, wrong_fragment, urgent, count, srv_count, serror_rate, srv_serror_rate, rerror_rate, srv_rerror_rate, same_srv_rate, diff_srv_rate, srv_diff_host_rate, dst_host_count, dst_host_srv_count, dst_host_same_srv_rate, dst_host_diff_srv_rate, dst_host_same_src_port_rate, dst_host_srv_diff_host_rate, dst_host_serror_rate, dst_host_srv_serror_rate, dst_host_rerror_rate, dst_host_srv_rerror_rate, src_ip, src_port, dst_ip, dst_port, last_packet_timestamp, attack_type, attack_method, label]\n",
       "Index: []"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "attack_df=pd.DataFrame(columns=COLUMNS)\n",
    "attack_df"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Processing dos-tcp_syn_flood-land.csv\n",
      "(4, 36)\n",
      "(4, 36)\n",
      "Processing probe-other-1.csv\n",
      "(2228, 36)\n",
      "(2232, 36)\n",
      "Processing dos-http_flood-hulk_1.csv\n",
      "(24863, 36)\n",
      "(27095, 36)\n",
      "Processing probe-udp_scan-1.csv\n",
      "(995, 36)\n",
      "(28090, 36)\n",
      "Processing probe-icmp_ping_scan-1.csv\n",
      "(1320, 36)\n",
      "(29410, 36)\n",
      "Processing dos-tcp_fin_flood-rand_1.csv\n",
      "(115079, 36)\n",
      "(144489, 36)\n",
      "Processing dos-tcp_syn_flood-1.csv\n",
      "(58354, 36)\n",
      "(202843, 36)\n",
      "Processing dos-tcp_rst_flood-1.csv\n",
      "(256138, 36)\n",
      "(458981, 36)\n",
      "Processing probe-tcp_null_scan-1.csv\n",
      "(9823, 36)\n",
      "(468804, 36)\n",
      "Processing dos-udp_flood-1.csv\n",
      "(226271, 36)\n",
      "(695075, 36)\n",
      "Processing probe-other-2.csv\n",
      "(4380, 36)\n",
      "(699455, 36)\n",
      "Processing dos-http_slow-slowloris_2.csv\n",
      "(35, 36)\n",
      "(699490, 36)\n",
      "Processing mitm-mac_flooding-1.csv\n",
      "(0, 36)\n",
      "(699490, 36)\n",
      "Processing mitm-arp_poisoning-2.csv\n",
      "(0, 36)\n",
      "(699490, 36)\n",
      "Processing r2l-guest_passwd-1.csv\n",
      "(231, 36)\n",
      "(699721, 36)\n",
      "Processing dos-icmp_flood-1.csv\n",
      "(2, 36)\n",
      "(699723, 36)\n",
      "Processing mitm-ping_of_death-1.csv\n",
      "(2, 36)\n",
      "(699725, 36)\n",
      "Processing mitm-arp_poisoning-1.csv\n",
      "(0, 36)\n",
      "(699725, 36)\n",
      "Processing dos-tcp_syn_flood-rand_2.csv\n",
      "(154171, 36)\n",
      "(853896, 36)\n",
      "Processing probe-tcp_connection_scan-1.csv\n",
      "(6343, 36)\n",
      "(860239, 36)\n",
      "Processing probe-udp_scan-2.csv\n",
      "(4029, 36)\n",
      "(864268, 36)\n",
      "Processing probe-icmp_ping_scan-2.csv\n",
      "(4, 36)\n",
      "(864272, 36)\n",
      "Processing dos-http_slow-slowloris_1.csv\n",
      "(52, 36)\n",
      "(864324, 36)\n"
     ]
    }
   ],
   "source": [
    "for file in os.listdir(ATTACK_CSV_DIR):\n",
    "    print(f'Processing {file}')\n",
    "    filename=file.split('.')[0]\n",
    "    attack_type, attack_method, _=filename.split('-')\n",
    "    try:\n",
    "        df=pd.read_csv(os.path.join(ATTACK_CSV_DIR, file), names=COLUMNS)\n",
    "    except EmptyDataError:\n",
    "        print('{file} contains no data!')\n",
    "        continue\n",
    "    print(df.shape)\n",
    "    df['attack_type']=attack_type\n",
    "    df['label']=attack_method\n",
    "    attack_df=pd.concat([attack_df, df], ignore_index=True)\n",
    "    print(attack_df.shape)\n",
    "#     print(attack_df.columns)\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>protocol_type</th>\n",
       "      <th>service</th>\n",
       "      <th>flag</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>count</th>\n",
       "      <th>srv_count</th>\n",
       "      <th>serror_rate</th>\n",
       "      <th>srv_serror_rate</th>\n",
       "      <th>rerror_rate</th>\n",
       "      <th>srv_rerror_rate</th>\n",
       "      <th>same_srv_rate</th>\n",
       "      <th>diff_srv_rate</th>\n",
       "      <th>srv_diff_host_rate</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "      <th>src_ip</th>\n",
       "      <th>src_port</th>\n",
       "      <th>dst_ip</th>\n",
       "      <th>dst_port</th>\n",
       "      <th>last_packet_timestamp</th>\n",
       "      <th>attack_type</th>\n",
       "      <th>attack_method</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>7</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ftp</td>\n",
       "      <td>S1</td>\n",
       "      <td>19715542</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>100.10.0.2</td>\n",
       "      <td>1156</td>\n",
       "      <td>100.10.0.2</td>\n",
       "      <td>21</td>\n",
       "      <td>2020-06-08T03:06:03</td>\n",
       "      <td>dos</td>\n",
       "      <td>NaN</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>5</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>S1</td>\n",
       "      <td>12564398</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>100.10.0.2</td>\n",
       "      <td>80</td>\n",
       "      <td>100.10.0.2</td>\n",
       "      <td>80</td>\n",
       "      <td>2020-06-08T03:06:40</td>\n",
       "      <td>dos</td>\n",
       "      <td>NaN</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>2</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>S1</td>\n",
       "      <td>7070294</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>0.50</td>\n",
       "      <td>0.50</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>100.10.0.2</td>\n",
       "      <td>21</td>\n",
       "      <td>100.10.0.2</td>\n",
       "      <td>80</td>\n",
       "      <td>2020-06-08T03:06:47</td>\n",
       "      <td>dos</td>\n",
       "      <td>NaN</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>3</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>S1</td>\n",
       "      <td>9209662</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>3</td>\n",
       "      <td>2</td>\n",
       "      <td>0.67</td>\n",
       "      <td>0.33</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>100.10.0.2</td>\n",
       "      <td>10000</td>\n",
       "      <td>100.10.0.2</td>\n",
       "      <td>80</td>\n",
       "      <td>2020-06-08T03:07:09</td>\n",
       "      <td>dos</td>\n",
       "      <td>NaN</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>OTH</td>\n",
       "      <td>54</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>192.168.2.5</td>\n",
       "      <td>47994</td>\n",
       "      <td>100.10.0.68</td>\n",
       "      <td>80</td>\n",
       "      <td>2020-06-08T16:20:36</td>\n",
       "      <td>probe</td>\n",
       "      <td>NaN</td>\n",
       "      <td>other</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "  duration protocol_type service flag src_bytes dst_bytes land wrong_fragment  \\\n",
       "0        7           tcp     ftp   S1  19715542         0    0              0   \n",
       "1        5           tcp    http   S1  12564398         0    1              0   \n",
       "2        2           tcp    http   S1   7070294         0    0              0   \n",
       "3        3           tcp    http   S1   9209662         0    0              0   \n",
       "4        0           tcp    http  OTH        54         0    0              0   \n",
       "\n",
       "  urgent count srv_count  serror_rate  srv_serror_rate  rerror_rate  \\\n",
       "0      0     0         0          0.0              0.0          0.0   \n",
       "1      0     1         0          1.0              0.0          0.0   \n",
       "2      0     1         1          1.0              1.0          0.0   \n",
       "3      0     1         1          1.0              1.0          0.0   \n",
       "4      0     0         0          0.0              0.0          0.0   \n",
       "\n",
       "   srv_rerror_rate  same_srv_rate  diff_srv_rate  srv_diff_host_rate  \\\n",
       "0              0.0            0.0            0.0                 0.0   \n",
       "1              0.0            0.0            1.0                 0.0   \n",
       "2              0.0            1.0            0.0                 0.0   \n",
       "3              0.0            1.0            0.0                 0.0   \n",
       "4              0.0            0.0            0.0                 0.0   \n",
       "\n",
       "  dst_host_count dst_host_srv_count  dst_host_same_srv_rate  \\\n",
       "0              0                  0                    0.00   \n",
       "1              1                  0                    0.00   \n",
       "2              2                  1                    0.50   \n",
       "3              3                  2                    0.67   \n",
       "4              0                  0                    0.00   \n",
       "\n",
       "   dst_host_diff_srv_rate  dst_host_same_src_port_rate  \\\n",
       "0                    0.00                          0.0   \n",
       "1                    1.00                          0.0   \n",
       "2                    0.50                          0.0   \n",
       "3                    0.33                          0.0   \n",
       "4                    0.00                          0.0   \n",
       "\n",
       "   dst_host_srv_diff_host_rate  dst_host_serror_rate  \\\n",
       "0                          0.0                   0.0   \n",
       "1                          0.0                   1.0   \n",
       "2                          0.0                   1.0   \n",
       "3                          0.0                   1.0   \n",
       "4                          0.0                   0.0   \n",
       "\n",
       "   dst_host_srv_serror_rate  dst_host_rerror_rate  dst_host_srv_rerror_rate  \\\n",
       "0                       0.0                   0.0                       0.0   \n",
       "1                       0.0                   0.0                       0.0   \n",
       "2                       1.0                   0.0                       0.0   \n",
       "3                       1.0                   0.0                       0.0   \n",
       "4                       0.0                   0.0                       0.0   \n",
       "\n",
       "        src_ip src_port       dst_ip dst_port last_packet_timestamp  \\\n",
       "0   100.10.0.2     1156   100.10.0.2       21   2020-06-08T03:06:03   \n",
       "1   100.10.0.2       80   100.10.0.2       80   2020-06-08T03:06:40   \n",
       "2   100.10.0.2       21   100.10.0.2       80   2020-06-08T03:06:47   \n",
       "3   100.10.0.2    10000   100.10.0.2       80   2020-06-08T03:07:09   \n",
       "4  192.168.2.5    47994  100.10.0.68       80   2020-06-08T16:20:36   \n",
       "\n",
       "  attack_type  attack_method          label  \n",
       "0         dos            NaN  tcp_syn_flood  \n",
       "1         dos            NaN  tcp_syn_flood  \n",
       "2         dos            NaN  tcp_syn_flood  \n",
       "3         dos            NaN  tcp_syn_flood  \n",
       "4       probe            NaN          other  "
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "attack_df.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>protocol_type</th>\n",
       "      <th>service</th>\n",
       "      <th>flag</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>count</th>\n",
       "      <th>srv_count</th>\n",
       "      <th>serror_rate</th>\n",
       "      <th>srv_serror_rate</th>\n",
       "      <th>rerror_rate</th>\n",
       "      <th>srv_rerror_rate</th>\n",
       "      <th>same_srv_rate</th>\n",
       "      <th>diff_srv_rate</th>\n",
       "      <th>srv_diff_host_rate</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "      <th>src_ip</th>\n",
       "      <th>src_port</th>\n",
       "      <th>dst_ip</th>\n",
       "      <th>dst_port</th>\n",
       "      <th>last_packet_timestamp</th>\n",
       "      <th>attack_type</th>\n",
       "      <th>attack_method</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>count</th>\n",
       "      <td>864324.0</td>\n",
       "      <td>864324</td>\n",
       "      <td>864324</td>\n",
       "      <td>864324</td>\n",
       "      <td>864324.0</td>\n",
       "      <td>864324.0</td>\n",
       "      <td>864324.0</td>\n",
       "      <td>864324.0</td>\n",
       "      <td>864324.0</td>\n",
       "      <td>864324.0</td>\n",
       "      <td>864324.0</td>\n",
       "      <td>864324.000000</td>\n",
       "      <td>864324.000000</td>\n",
       "      <td>864324.0</td>\n",
       "      <td>864324.0</td>\n",
       "      <td>864324.000000</td>\n",
       "      <td>864324.000000</td>\n",
       "      <td>864324.000000</td>\n",
       "      <td>864324.0</td>\n",
       "      <td>864324.0</td>\n",
       "      <td>864324.000000</td>\n",
       "      <td>864324.000000</td>\n",
       "      <td>864324.000000</td>\n",
       "      <td>864324.000000</td>\n",
       "      <td>864324.000000</td>\n",
       "      <td>864324.000000</td>\n",
       "      <td>864324.0</td>\n",
       "      <td>864324.0</td>\n",
       "      <td>864324</td>\n",
       "      <td>864324.0</td>\n",
       "      <td>864324</td>\n",
       "      <td>864324.0</td>\n",
       "      <td>864324</td>\n",
       "      <td>864324</td>\n",
       "      <td>0.0</td>\n",
       "      <td>864324</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>unique</th>\n",
       "      <td>58.0</td>\n",
       "      <td>3</td>\n",
       "      <td>46</td>\n",
       "      <td>6</td>\n",
       "      <td>1518.0</td>\n",
       "      <td>104.0</td>\n",
       "      <td>2.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>3.0</td>\n",
       "      <td>140067.0</td>\n",
       "      <td>140065.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>101.0</td>\n",
       "      <td>101.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>482204</td>\n",
       "      <td>65536.0</td>\n",
       "      <td>13465</td>\n",
       "      <td>1799.0</td>\n",
       "      <td>1266</td>\n",
       "      <td>4</td>\n",
       "      <td>NaN</td>\n",
       "      <td>14</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>top</th>\n",
       "      <td>0.0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ssh</td>\n",
       "      <td>OTH</td>\n",
       "      <td>54.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>69446.0</td>\n",
       "      <td>69444.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>100.0</td>\n",
       "      <td>100.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>192.168.2.3</td>\n",
       "      <td>0.0</td>\n",
       "      <td>100.10.0.2</td>\n",
       "      <td>22.0</td>\n",
       "      <td>2020-06-08T10:50:11</td>\n",
       "      <td>dos</td>\n",
       "      <td>NaN</td>\n",
       "      <td>tcp_rst_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>freq</th>\n",
       "      <td>819080.0</td>\n",
       "      <td>632262</td>\n",
       "      <td>256445</td>\n",
       "      <td>382869</td>\n",
       "      <td>267517.0</td>\n",
       "      <td>629144.0</td>\n",
       "      <td>864323.0</td>\n",
       "      <td>864324.0</td>\n",
       "      <td>864273.0</td>\n",
       "      <td>31577.0</td>\n",
       "      <td>27323.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>768327.0</td>\n",
       "      <td>759893.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>325910</td>\n",
       "      <td>14020.0</td>\n",
       "      <td>835946</td>\n",
       "      <td>256452.0</td>\n",
       "      <td>36007</td>\n",
       "      <td>834969</td>\n",
       "      <td>NaN</td>\n",
       "      <td>256138</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>mean</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.220798</td>\n",
       "      <td>0.221644</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.975714</td>\n",
       "      <td>0.007137</td>\n",
       "      <td>0.025239</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.975904</td>\n",
       "      <td>0.006605</td>\n",
       "      <td>0.023516</td>\n",
       "      <td>0.024592</td>\n",
       "      <td>0.226744</td>\n",
       "      <td>0.227496</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>std</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.394280</td>\n",
       "      <td>0.395012</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.144363</td>\n",
       "      <td>0.065045</td>\n",
       "      <td>0.149379</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.144780</td>\n",
       "      <td>0.063302</td>\n",
       "      <td>0.138213</td>\n",
       "      <td>0.147109</td>\n",
       "      <td>0.401814</td>\n",
       "      <td>0.402363</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>min</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25%</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>50%</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>75%</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.180000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.250000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>max</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.990000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "        duration protocol_type service    flag  src_bytes  dst_bytes  \\\n",
       "count   864324.0        864324  864324  864324   864324.0   864324.0   \n",
       "unique      58.0             3      46       6     1518.0      104.0   \n",
       "top          0.0           tcp     ssh     OTH       54.0        0.0   \n",
       "freq    819080.0        632262  256445  382869   267517.0   629144.0   \n",
       "mean         NaN           NaN     NaN     NaN        NaN        NaN   \n",
       "std          NaN           NaN     NaN     NaN        NaN        NaN   \n",
       "min          NaN           NaN     NaN     NaN        NaN        NaN   \n",
       "25%          NaN           NaN     NaN     NaN        NaN        NaN   \n",
       "50%          NaN           NaN     NaN     NaN        NaN        NaN   \n",
       "75%          NaN           NaN     NaN     NaN        NaN        NaN   \n",
       "max          NaN           NaN     NaN     NaN        NaN        NaN   \n",
       "\n",
       "            land  wrong_fragment    urgent     count  srv_count  \\\n",
       "count   864324.0        864324.0  864324.0  864324.0   864324.0   \n",
       "unique       2.0             1.0       3.0  140067.0   140065.0   \n",
       "top          0.0             0.0       0.0   69446.0    69444.0   \n",
       "freq    864323.0        864324.0  864273.0   31577.0    27323.0   \n",
       "mean         NaN             NaN       NaN       NaN        NaN   \n",
       "std          NaN             NaN       NaN       NaN        NaN   \n",
       "min          NaN             NaN       NaN       NaN        NaN   \n",
       "25%          NaN             NaN       NaN       NaN        NaN   \n",
       "50%          NaN             NaN       NaN       NaN        NaN   \n",
       "75%          NaN             NaN       NaN       NaN        NaN   \n",
       "max          NaN             NaN       NaN       NaN        NaN   \n",
       "\n",
       "          serror_rate  srv_serror_rate  rerror_rate  srv_rerror_rate  \\\n",
       "count   864324.000000    864324.000000     864324.0         864324.0   \n",
       "unique            NaN              NaN          NaN              NaN   \n",
       "top               NaN              NaN          NaN              NaN   \n",
       "freq              NaN              NaN          NaN              NaN   \n",
       "mean         0.220798         0.221644          0.0              0.0   \n",
       "std          0.394280         0.395012          0.0              0.0   \n",
       "min          0.000000         0.000000          0.0              0.0   \n",
       "25%          0.000000         0.000000          0.0              0.0   \n",
       "50%          0.000000         0.000000          0.0              0.0   \n",
       "75%          0.000000         0.180000          0.0              0.0   \n",
       "max          1.000000         1.000000          0.0              0.0   \n",
       "\n",
       "        same_srv_rate  diff_srv_rate  srv_diff_host_rate  dst_host_count  \\\n",
       "count   864324.000000  864324.000000       864324.000000        864324.0   \n",
       "unique            NaN            NaN                 NaN           101.0   \n",
       "top               NaN            NaN                 NaN           100.0   \n",
       "freq              NaN            NaN                 NaN        768327.0   \n",
       "mean         0.975714       0.007137            0.025239             NaN   \n",
       "std          0.144363       0.065045            0.149379             NaN   \n",
       "min          0.000000       0.000000            0.000000             NaN   \n",
       "25%          1.000000       0.000000            0.000000             NaN   \n",
       "50%          1.000000       0.000000            0.000000             NaN   \n",
       "75%          1.000000       0.000000            0.000000             NaN   \n",
       "max          1.000000       1.000000            1.000000             NaN   \n",
       "\n",
       "        dst_host_srv_count  dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "count             864324.0           864324.000000           864324.000000   \n",
       "unique               101.0                     NaN                     NaN   \n",
       "top                  100.0                     NaN                     NaN   \n",
       "freq              759893.0                     NaN                     NaN   \n",
       "mean                   NaN                0.975904                0.006605   \n",
       "std                    NaN                0.144780                0.063302   \n",
       "min                    NaN                0.000000                0.000000   \n",
       "25%                    NaN                1.000000                0.000000   \n",
       "50%                    NaN                1.000000                0.000000   \n",
       "75%                    NaN                1.000000                0.000000   \n",
       "max                    NaN                1.000000                1.000000   \n",
       "\n",
       "        dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "count                 864324.000000                864324.000000   \n",
       "unique                          NaN                          NaN   \n",
       "top                             NaN                          NaN   \n",
       "freq                            NaN                          NaN   \n",
       "mean                       0.023516                     0.024592   \n",
       "std                        0.138213                     0.147109   \n",
       "min                        0.000000                     0.000000   \n",
       "25%                        0.000000                     0.000000   \n",
       "50%                        0.000000                     0.000000   \n",
       "75%                        0.000000                     0.000000   \n",
       "max                        0.990000                     1.000000   \n",
       "\n",
       "        dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "count          864324.000000             864324.000000              864324.0   \n",
       "unique                   NaN                       NaN                   NaN   \n",
       "top                      NaN                       NaN                   NaN   \n",
       "freq                     NaN                       NaN                   NaN   \n",
       "mean                0.226744                  0.227496                   0.0   \n",
       "std                 0.401814                  0.402363                   0.0   \n",
       "min                 0.000000                  0.000000                   0.0   \n",
       "25%                 0.000000                  0.000000                   0.0   \n",
       "50%                 0.000000                  0.000000                   0.0   \n",
       "75%                 0.000000                  0.250000                   0.0   \n",
       "max                 1.000000                  1.000000                   0.0   \n",
       "\n",
       "        dst_host_srv_rerror_rate       src_ip  src_port      dst_ip  dst_port  \\\n",
       "count                   864324.0       864324  864324.0      864324  864324.0   \n",
       "unique                       NaN       482204   65536.0       13465    1799.0   \n",
       "top                          NaN  192.168.2.3       0.0  100.10.0.2      22.0   \n",
       "freq                         NaN       325910   14020.0      835946  256452.0   \n",
       "mean                         0.0          NaN       NaN         NaN       NaN   \n",
       "std                          0.0          NaN       NaN         NaN       NaN   \n",
       "min                          0.0          NaN       NaN         NaN       NaN   \n",
       "25%                          0.0          NaN       NaN         NaN       NaN   \n",
       "50%                          0.0          NaN       NaN         NaN       NaN   \n",
       "75%                          0.0          NaN       NaN         NaN       NaN   \n",
       "max                          0.0          NaN       NaN         NaN       NaN   \n",
       "\n",
       "       last_packet_timestamp attack_type  attack_method          label  \n",
       "count                 864324      864324            0.0         864324  \n",
       "unique                  1266           4            NaN             14  \n",
       "top      2020-06-08T10:50:11         dos            NaN  tcp_rst_flood  \n",
       "freq                   36007      834969            NaN         256138  \n",
       "mean                     NaN         NaN            NaN            NaN  \n",
       "std                      NaN         NaN            NaN            NaN  \n",
       "min                      NaN         NaN            NaN            NaN  \n",
       "25%                      NaN         NaN            NaN            NaN  \n",
       "50%                      NaN         NaN            NaN            NaN  \n",
       "75%                      NaN         NaN            NaN            NaN  \n",
       "max                      NaN         NaN            NaN            NaN  "
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "attack_df.describe(include='all')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "0.9660370416649312"
      ]
     },
     "execution_count": 10,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "attack_df[attack_df['attack_type']=='dos']['duration'].count()/attack_df['duration'].count()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "Series([], Name: attack_method, dtype: float64)"
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "attack_df['attack_method'].value_counts()/attack_df.shape[0]*100"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [],
   "source": [
    "attack_df=attack_df[ATTACK_SUBSET]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [],
   "source": [
    "attack_df.drop_duplicates(inplace=True, ignore_index=True)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>protocol_type</th>\n",
       "      <th>service</th>\n",
       "      <th>flag</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>count</th>\n",
       "      <th>srv_count</th>\n",
       "      <th>serror_rate</th>\n",
       "      <th>srv_serror_rate</th>\n",
       "      <th>rerror_rate</th>\n",
       "      <th>srv_rerror_rate</th>\n",
       "      <th>same_srv_rate</th>\n",
       "      <th>diff_srv_rate</th>\n",
       "      <th>srv_diff_host_rate</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "      <th>attack_type</th>\n",
       "      <th>attack_method</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>count</th>\n",
       "      <td>468298.0</td>\n",
       "      <td>468298</td>\n",
       "      <td>468298</td>\n",
       "      <td>468298</td>\n",
       "      <td>468298.0</td>\n",
       "      <td>468298.0</td>\n",
       "      <td>468298.0</td>\n",
       "      <td>468298.0</td>\n",
       "      <td>468298.0</td>\n",
       "      <td>468298.0</td>\n",
       "      <td>468298.0</td>\n",
       "      <td>468298.000000</td>\n",
       "      <td>468298.000000</td>\n",
       "      <td>468298.0</td>\n",
       "      <td>468298.0</td>\n",
       "      <td>468298.000000</td>\n",
       "      <td>468298.000000</td>\n",
       "      <td>468298.000000</td>\n",
       "      <td>468298.0</td>\n",
       "      <td>468298.0</td>\n",
       "      <td>468298.000000</td>\n",
       "      <td>468298.000000</td>\n",
       "      <td>468298.000000</td>\n",
       "      <td>468298.000000</td>\n",
       "      <td>468298.000000</td>\n",
       "      <td>468298.000000</td>\n",
       "      <td>468298.0</td>\n",
       "      <td>468298.0</td>\n",
       "      <td>468298</td>\n",
       "      <td>0.0</td>\n",
       "      <td>468298</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>unique</th>\n",
       "      <td>58.0</td>\n",
       "      <td>3</td>\n",
       "      <td>46</td>\n",
       "      <td>6</td>\n",
       "      <td>1518.0</td>\n",
       "      <td>104.0</td>\n",
       "      <td>2.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>3.0</td>\n",
       "      <td>140067.0</td>\n",
       "      <td>140065.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>101.0</td>\n",
       "      <td>101.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>4</td>\n",
       "      <td>NaN</td>\n",
       "      <td>14</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>top</th>\n",
       "      <td>0.0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ftp</td>\n",
       "      <td>S1</td>\n",
       "      <td>254.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>100.0</td>\n",
       "      <td>100.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>dos</td>\n",
       "      <td>NaN</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>freq</th>\n",
       "      <td>423580.0</td>\n",
       "      <td>357087</td>\n",
       "      <td>154189</td>\n",
       "      <td>196328</td>\n",
       "      <td>154095.0</td>\n",
       "      <td>233564.0</td>\n",
       "      <td>468297.0</td>\n",
       "      <td>468298.0</td>\n",
       "      <td>468247.0</td>\n",
       "      <td>5864.0</td>\n",
       "      <td>701.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>412735.0</td>\n",
       "      <td>404042.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>442915</td>\n",
       "      <td>NaN</td>\n",
       "      <td>212454</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>mean</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.406674</td>\n",
       "      <td>0.408232</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.975218</td>\n",
       "      <td>0.012260</td>\n",
       "      <td>0.023270</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.975614</td>\n",
       "      <td>0.011497</td>\n",
       "      <td>0.026403</td>\n",
       "      <td>0.022937</td>\n",
       "      <td>0.417641</td>\n",
       "      <td>0.419026</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>std</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.458997</td>\n",
       "      <td>0.459525</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.138504</td>\n",
       "      <td>0.084411</td>\n",
       "      <td>0.140843</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.139179</td>\n",
       "      <td>0.083331</td>\n",
       "      <td>0.144565</td>\n",
       "      <td>0.139337</td>\n",
       "      <td>0.466483</td>\n",
       "      <td>0.466786</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>min</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25%</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>50%</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>75%</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>max</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.990000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "        duration protocol_type service    flag  src_bytes  dst_bytes  \\\n",
       "count   468298.0        468298  468298  468298   468298.0   468298.0   \n",
       "unique      58.0             3      46       6     1518.0      104.0   \n",
       "top          0.0           tcp     ftp      S1      254.0        0.0   \n",
       "freq    423580.0        357087  154189  196328   154095.0   233564.0   \n",
       "mean         NaN           NaN     NaN     NaN        NaN        NaN   \n",
       "std          NaN           NaN     NaN     NaN        NaN        NaN   \n",
       "min          NaN           NaN     NaN     NaN        NaN        NaN   \n",
       "25%          NaN           NaN     NaN     NaN        NaN        NaN   \n",
       "50%          NaN           NaN     NaN     NaN        NaN        NaN   \n",
       "75%          NaN           NaN     NaN     NaN        NaN        NaN   \n",
       "max          NaN           NaN     NaN     NaN        NaN        NaN   \n",
       "\n",
       "            land  wrong_fragment    urgent     count  srv_count  \\\n",
       "count   468298.0        468298.0  468298.0  468298.0   468298.0   \n",
       "unique       2.0             1.0       3.0  140067.0   140065.0   \n",
       "top          0.0             0.0       0.0       0.0        0.0   \n",
       "freq    468297.0        468298.0  468247.0    5864.0      701.0   \n",
       "mean         NaN             NaN       NaN       NaN        NaN   \n",
       "std          NaN             NaN       NaN       NaN        NaN   \n",
       "min          NaN             NaN       NaN       NaN        NaN   \n",
       "25%          NaN             NaN       NaN       NaN        NaN   \n",
       "50%          NaN             NaN       NaN       NaN        NaN   \n",
       "75%          NaN             NaN       NaN       NaN        NaN   \n",
       "max          NaN             NaN       NaN       NaN        NaN   \n",
       "\n",
       "          serror_rate  srv_serror_rate  rerror_rate  srv_rerror_rate  \\\n",
       "count   468298.000000    468298.000000     468298.0         468298.0   \n",
       "unique            NaN              NaN          NaN              NaN   \n",
       "top               NaN              NaN          NaN              NaN   \n",
       "freq              NaN              NaN          NaN              NaN   \n",
       "mean         0.406674         0.408232          0.0              0.0   \n",
       "std          0.458997         0.459525          0.0              0.0   \n",
       "min          0.000000         0.000000          0.0              0.0   \n",
       "25%          0.000000         0.000000          0.0              0.0   \n",
       "50%          0.000000         0.000000          0.0              0.0   \n",
       "75%          1.000000         1.000000          0.0              0.0   \n",
       "max          1.000000         1.000000          0.0              0.0   \n",
       "\n",
       "        same_srv_rate  diff_srv_rate  srv_diff_host_rate  dst_host_count  \\\n",
       "count   468298.000000  468298.000000       468298.000000        468298.0   \n",
       "unique            NaN            NaN                 NaN           101.0   \n",
       "top               NaN            NaN                 NaN           100.0   \n",
       "freq              NaN            NaN                 NaN        412735.0   \n",
       "mean         0.975218       0.012260            0.023270             NaN   \n",
       "std          0.138504       0.084411            0.140843             NaN   \n",
       "min          0.000000       0.000000            0.000000             NaN   \n",
       "25%          1.000000       0.000000            0.000000             NaN   \n",
       "50%          1.000000       0.000000            0.000000             NaN   \n",
       "75%          1.000000       0.000000            0.000000             NaN   \n",
       "max          1.000000       1.000000            1.000000             NaN   \n",
       "\n",
       "        dst_host_srv_count  dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "count             468298.0           468298.000000           468298.000000   \n",
       "unique               101.0                     NaN                     NaN   \n",
       "top                  100.0                     NaN                     NaN   \n",
       "freq              404042.0                     NaN                     NaN   \n",
       "mean                   NaN                0.975614                0.011497   \n",
       "std                    NaN                0.139179                0.083331   \n",
       "min                    NaN                0.000000                0.000000   \n",
       "25%                    NaN                1.000000                0.000000   \n",
       "50%                    NaN                1.000000                0.000000   \n",
       "75%                    NaN                1.000000                0.000000   \n",
       "max                    NaN                1.000000                1.000000   \n",
       "\n",
       "        dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "count                 468298.000000                468298.000000   \n",
       "unique                          NaN                          NaN   \n",
       "top                             NaN                          NaN   \n",
       "freq                            NaN                          NaN   \n",
       "mean                       0.026403                     0.022937   \n",
       "std                        0.144565                     0.139337   \n",
       "min                        0.000000                     0.000000   \n",
       "25%                        0.000000                     0.000000   \n",
       "50%                        0.000000                     0.000000   \n",
       "75%                        0.000000                     0.000000   \n",
       "max                        0.990000                     1.000000   \n",
       "\n",
       "        dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "count          468298.000000             468298.000000              468298.0   \n",
       "unique                   NaN                       NaN                   NaN   \n",
       "top                      NaN                       NaN                   NaN   \n",
       "freq                     NaN                       NaN                   NaN   \n",
       "mean                0.417641                  0.419026                   0.0   \n",
       "std                 0.466483                  0.466786                   0.0   \n",
       "min                 0.000000                  0.000000                   0.0   \n",
       "25%                 0.000000                  0.000000                   0.0   \n",
       "50%                 0.000000                  0.000000                   0.0   \n",
       "75%                 1.000000                  1.000000                   0.0   \n",
       "max                 1.000000                  1.000000                   0.0   \n",
       "\n",
       "        dst_host_srv_rerror_rate attack_type  attack_method          label  \n",
       "count                   468298.0      468298            0.0         468298  \n",
       "unique                       NaN           4            NaN             14  \n",
       "top                          NaN         dos            NaN  tcp_syn_flood  \n",
       "freq                         NaN      442915            NaN         212454  \n",
       "mean                         0.0         NaN            NaN            NaN  \n",
       "std                          0.0         NaN            NaN            NaN  \n",
       "min                          0.0         NaN            NaN            NaN  \n",
       "25%                          0.0         NaN            NaN            NaN  \n",
       "50%                          0.0         NaN            NaN            NaN  \n",
       "75%                          0.0         NaN            NaN            NaN  \n",
       "max                          0.0         NaN            NaN            NaN  "
      ]
     },
     "execution_count": 14,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "attack_df.describe(include='all')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "0.9457973341761016"
      ]
     },
     "execution_count": 15,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "attack_df[attack_df['attack_type']=='dos']['duration'].count()/attack_df['duration'].count()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Process and label normal connection"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [],
   "source": [
    "normal_df=pd.DataFrame(columns=COLUMNS)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Processing normal-3.csv\n",
      "(979, 36)\n",
      "(979, 36)\n",
      "Processing 7.csv\n",
      "(1925, 36)\n",
      "(2904, 36)\n",
      "Processing 3.csv\n",
      "(587, 36)\n",
      "(3491, 36)\n",
      "Processing 6.csv\n",
      "(5994, 36)\n",
      "(9485, 36)\n",
      "Processing 4.csv\n",
      "(5378, 36)\n",
      "(14863, 36)\n",
      "Processing normal-2.csv\n",
      "(19, 36)\n",
      "(14882, 36)\n",
      "Processing 8.csv\n",
      "(10052, 36)\n",
      "(24934, 36)\n",
      "Processing normal-4.csv\n",
      "(821, 36)\n",
      "(25755, 36)\n",
      "Processing 2.csv\n",
      "(1736, 36)\n",
      "(27491, 36)\n",
      "Processing normal-1.csv\n",
      "(160, 36)\n",
      "(27651, 36)\n",
      "Processing 5.csv\n",
      "(2417, 36)\n",
      "(30068, 36)\n",
      "Processing 1.csv\n",
      "(633, 36)\n",
      "(30701, 36)\n"
     ]
    }
   ],
   "source": [
    "for file in os.listdir(NORMAL_CSV_DIR):\n",
    "    print(f'Processing {file}')\n",
    "    try:\n",
    "        df=pd.read_csv(os.path.join(NORMAL_CSV_DIR, file), names=COLUMNS)\n",
    "    except EmptyDataError:\n",
    "        print('{file} contains no data!')\n",
    "        continue\n",
    "    print(df.shape)\n",
    "    df['label']='normal.'\n",
    "    normal_df=pd.concat([normal_df, df], ignore_index=True)\n",
    "    print(normal_df.shape)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [],
   "source": [
    "normal_df.drop_duplicates(inplace=True, ignore_index=True)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>protocol_type</th>\n",
       "      <th>service</th>\n",
       "      <th>flag</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>count</th>\n",
       "      <th>srv_count</th>\n",
       "      <th>serror_rate</th>\n",
       "      <th>srv_serror_rate</th>\n",
       "      <th>rerror_rate</th>\n",
       "      <th>srv_rerror_rate</th>\n",
       "      <th>same_srv_rate</th>\n",
       "      <th>diff_srv_rate</th>\n",
       "      <th>srv_diff_host_rate</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "      <th>src_ip</th>\n",
       "      <th>src_port</th>\n",
       "      <th>dst_ip</th>\n",
       "      <th>dst_port</th>\n",
       "      <th>last_packet_timestamp</th>\n",
       "      <th>attack_type</th>\n",
       "      <th>attack_method</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>count</th>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700</td>\n",
       "      <td>30700</td>\n",
       "      <td>30700</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700.000000</td>\n",
       "      <td>30700.000000</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700.000000</td>\n",
       "      <td>30700.000000</td>\n",
       "      <td>30700.000000</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700.000000</td>\n",
       "      <td>30700.000000</td>\n",
       "      <td>30700.000000</td>\n",
       "      <td>30700.000000</td>\n",
       "      <td>30700.000000</td>\n",
       "      <td>30700.000000</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>30700</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>unique</th>\n",
       "      <td>630.0</td>\n",
       "      <td>3</td>\n",
       "      <td>12</td>\n",
       "      <td>6</td>\n",
       "      <td>5150.0</td>\n",
       "      <td>5660.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>292.0</td>\n",
       "      <td>290.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>79.0</td>\n",
       "      <td>100.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>190</td>\n",
       "      <td>13886.0</td>\n",
       "      <td>802</td>\n",
       "      <td>676.0</td>\n",
       "      <td>17951</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>top</th>\n",
       "      <td>0.0</td>\n",
       "      <td>udp</td>\n",
       "      <td>other</td>\n",
       "      <td>SF</td>\n",
       "      <td>66.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.0</td>\n",
       "      <td>37.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>192.168.0.102</td>\n",
       "      <td>443.0</td>\n",
       "      <td>192.168.0.1</td>\n",
       "      <td>443.0</td>\n",
       "      <td>2020-06-09T08:07:18</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>freq</th>\n",
       "      <td>19577.0</td>\n",
       "      <td>16516</td>\n",
       "      <td>15103</td>\n",
       "      <td>18763</td>\n",
       "      <td>3829.0</td>\n",
       "      <td>13900.0</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>30700.0</td>\n",
       "      <td>17488.0</td>\n",
       "      <td>6508.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>5187.0</td>\n",
       "      <td>579.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>19864</td>\n",
       "      <td>2794.0</td>\n",
       "      <td>6657</td>\n",
       "      <td>12186.0</td>\n",
       "      <td>217</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>30700</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>mean</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.002315</td>\n",
       "      <td>0.004921</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.419595</td>\n",
       "      <td>0.010763</td>\n",
       "      <td>0.476192</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.796511</td>\n",
       "      <td>0.034531</td>\n",
       "      <td>0.146366</td>\n",
       "      <td>0.555368</td>\n",
       "      <td>0.002464</td>\n",
       "      <td>0.003719</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>std</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.047266</td>\n",
       "      <td>0.068393</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.491601</td>\n",
       "      <td>0.093682</td>\n",
       "      <td>0.471268</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.385949</td>\n",
       "      <td>0.142159</td>\n",
       "      <td>0.272676</td>\n",
       "      <td>0.428223</td>\n",
       "      <td>0.046684</td>\n",
       "      <td>0.051103</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>min</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25%</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.920000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>50%</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.500000</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.770000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>75%</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.180000</td>\n",
       "      <td>0.970000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>max</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.980000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "        duration protocol_type service   flag  src_bytes  dst_bytes     land  \\\n",
       "count    30700.0         30700   30700  30700    30700.0    30700.0  30700.0   \n",
       "unique     630.0             3      12      6     5150.0     5660.0      1.0   \n",
       "top          0.0           udp   other     SF       66.0        0.0      0.0   \n",
       "freq     19577.0         16516   15103  18763     3829.0    13900.0  30700.0   \n",
       "mean         NaN           NaN     NaN    NaN        NaN        NaN      NaN   \n",
       "std          NaN           NaN     NaN    NaN        NaN        NaN      NaN   \n",
       "min          NaN           NaN     NaN    NaN        NaN        NaN      NaN   \n",
       "25%          NaN           NaN     NaN    NaN        NaN        NaN      NaN   \n",
       "50%          NaN           NaN     NaN    NaN        NaN        NaN      NaN   \n",
       "75%          NaN           NaN     NaN    NaN        NaN        NaN      NaN   \n",
       "max          NaN           NaN     NaN    NaN        NaN        NaN      NaN   \n",
       "\n",
       "        wrong_fragment   urgent    count  srv_count   serror_rate  \\\n",
       "count          30700.0  30700.0  30700.0    30700.0  30700.000000   \n",
       "unique             1.0      1.0    292.0      290.0           NaN   \n",
       "top                0.0      0.0      0.0        1.0           NaN   \n",
       "freq           30700.0  30700.0  17488.0     6508.0           NaN   \n",
       "mean               NaN      NaN      NaN        NaN      0.002315   \n",
       "std                NaN      NaN      NaN        NaN      0.047266   \n",
       "min                NaN      NaN      NaN        NaN      0.000000   \n",
       "25%                NaN      NaN      NaN        NaN      0.000000   \n",
       "50%                NaN      NaN      NaN        NaN      0.000000   \n",
       "75%                NaN      NaN      NaN        NaN      0.000000   \n",
       "max                NaN      NaN      NaN        NaN      1.000000   \n",
       "\n",
       "        srv_serror_rate  rerror_rate  srv_rerror_rate  same_srv_rate  \\\n",
       "count      30700.000000      30700.0          30700.0   30700.000000   \n",
       "unique              NaN          NaN              NaN            NaN   \n",
       "top                 NaN          NaN              NaN            NaN   \n",
       "freq                NaN          NaN              NaN            NaN   \n",
       "mean           0.004921          0.0              0.0       0.419595   \n",
       "std            0.068393          0.0              0.0       0.491601   \n",
       "min            0.000000          0.0              0.0       0.000000   \n",
       "25%            0.000000          0.0              0.0       0.000000   \n",
       "50%            0.000000          0.0              0.0       0.000000   \n",
       "75%            0.000000          0.0              0.0       1.000000   \n",
       "max            1.000000          0.0              0.0       1.000000   \n",
       "\n",
       "        diff_srv_rate  srv_diff_host_rate  dst_host_count  dst_host_srv_count  \\\n",
       "count    30700.000000        30700.000000         30700.0             30700.0   \n",
       "unique            NaN                 NaN            79.0               100.0   \n",
       "top               NaN                 NaN             0.0                37.0   \n",
       "freq              NaN                 NaN          5187.0               579.0   \n",
       "mean         0.010763            0.476192             NaN                 NaN   \n",
       "std          0.093682            0.471268             NaN                 NaN   \n",
       "min          0.000000            0.000000             NaN                 NaN   \n",
       "25%          0.000000            0.000000             NaN                 NaN   \n",
       "50%          0.000000            0.500000             NaN                 NaN   \n",
       "75%          0.000000            1.000000             NaN                 NaN   \n",
       "max          1.000000            1.000000             NaN                 NaN   \n",
       "\n",
       "        dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "count             30700.000000            30700.000000   \n",
       "unique                     NaN                     NaN   \n",
       "top                        NaN                     NaN   \n",
       "freq                       NaN                     NaN   \n",
       "mean                  0.796511                0.034531   \n",
       "std                   0.385949                0.142159   \n",
       "min                   0.000000                0.000000   \n",
       "25%                   0.920000                0.000000   \n",
       "50%                   1.000000                0.000000   \n",
       "75%                   1.000000                0.000000   \n",
       "max                   1.000000                1.000000   \n",
       "\n",
       "        dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "count                  30700.000000                 30700.000000   \n",
       "unique                          NaN                          NaN   \n",
       "top                             NaN                          NaN   \n",
       "freq                            NaN                          NaN   \n",
       "mean                       0.146366                     0.555368   \n",
       "std                        0.272676                     0.428223   \n",
       "min                        0.000000                     0.000000   \n",
       "25%                        0.000000                     0.000000   \n",
       "50%                        0.000000                     0.770000   \n",
       "75%                        0.180000                     0.970000   \n",
       "max                        0.980000                     1.000000   \n",
       "\n",
       "        dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "count           30700.000000              30700.000000               30700.0   \n",
       "unique                   NaN                       NaN                   NaN   \n",
       "top                      NaN                       NaN                   NaN   \n",
       "freq                     NaN                       NaN                   NaN   \n",
       "mean                0.002464                  0.003719                   0.0   \n",
       "std                 0.046684                  0.051103                   0.0   \n",
       "min                 0.000000                  0.000000                   0.0   \n",
       "25%                 0.000000                  0.000000                   0.0   \n",
       "50%                 0.000000                  0.000000                   0.0   \n",
       "75%                 0.000000                  0.000000                   0.0   \n",
       "max                 1.000000                  1.000000                   0.0   \n",
       "\n",
       "        dst_host_srv_rerror_rate         src_ip  src_port       dst_ip  \\\n",
       "count                    30700.0          30700   30700.0        30700   \n",
       "unique                       NaN            190   13886.0          802   \n",
       "top                          NaN  192.168.0.102     443.0  192.168.0.1   \n",
       "freq                         NaN          19864    2794.0         6657   \n",
       "mean                         0.0            NaN       NaN          NaN   \n",
       "std                          0.0            NaN       NaN          NaN   \n",
       "min                          0.0            NaN       NaN          NaN   \n",
       "25%                          0.0            NaN       NaN          NaN   \n",
       "50%                          0.0            NaN       NaN          NaN   \n",
       "75%                          0.0            NaN       NaN          NaN   \n",
       "max                          0.0            NaN       NaN          NaN   \n",
       "\n",
       "        dst_port last_packet_timestamp  attack_type  attack_method    label  \n",
       "count    30700.0                 30700          0.0            0.0    30700  \n",
       "unique     676.0                 17951          NaN            NaN        1  \n",
       "top        443.0   2020-06-09T08:07:18          NaN            NaN  normal.  \n",
       "freq     12186.0                   217          NaN            NaN    30700  \n",
       "mean         NaN                   NaN          NaN            NaN      NaN  \n",
       "std          NaN                   NaN          NaN            NaN      NaN  \n",
       "min          NaN                   NaN          NaN            NaN      NaN  \n",
       "25%          NaN                   NaN          NaN            NaN      NaN  \n",
       "50%          NaN                   NaN          NaN            NaN      NaN  \n",
       "75%          NaN                   NaN          NaN            NaN      NaN  \n",
       "max          NaN                   NaN          NaN            NaN      NaN  "
      ]
     },
     "execution_count": 19,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "normal_df.describe(include='all')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>protocol_type</th>\n",
       "      <th>service</th>\n",
       "      <th>flag</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>count</th>\n",
       "      <th>srv_count</th>\n",
       "      <th>serror_rate</th>\n",
       "      <th>srv_serror_rate</th>\n",
       "      <th>rerror_rate</th>\n",
       "      <th>srv_rerror_rate</th>\n",
       "      <th>same_srv_rate</th>\n",
       "      <th>diff_srv_rate</th>\n",
       "      <th>srv_diff_host_rate</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "      <th>src_ip</th>\n",
       "      <th>src_port</th>\n",
       "      <th>dst_ip</th>\n",
       "      <th>dst_port</th>\n",
       "      <th>last_packet_timestamp</th>\n",
       "      <th>attack_type</th>\n",
       "      <th>attack_method</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>other</td>\n",
       "      <td>OTH</td>\n",
       "      <td>66</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>192.168.0.109</td>\n",
       "      <td>42924</td>\n",
       "      <td>64.233.187.188</td>\n",
       "      <td>5228</td>\n",
       "      <td>2020-06-09T08:02:20</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>other</td>\n",
       "      <td>OTH</td>\n",
       "      <td>68</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>64.233.187.188</td>\n",
       "      <td>5228</td>\n",
       "      <td>192.168.0.109</td>\n",
       "      <td>42924</td>\n",
       "      <td>2020-06-09T08:02:21</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http_443</td>\n",
       "      <td>OTH</td>\n",
       "      <td>66</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>192.168.0.109</td>\n",
       "      <td>41368</td>\n",
       "      <td>216.58.197.110</td>\n",
       "      <td>443</td>\n",
       "      <td>2020-06-09T08:02:23</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http_443</td>\n",
       "      <td>OTH</td>\n",
       "      <td>54</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>192.168.0.109</td>\n",
       "      <td>42256</td>\n",
       "      <td>172.67.70.188</td>\n",
       "      <td>443</td>\n",
       "      <td>2020-06-09T08:02:23</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http_443</td>\n",
       "      <td>OTH</td>\n",
       "      <td>66</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0</td>\n",
       "      <td>2</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>192.168.0.109</td>\n",
       "      <td>35396</td>\n",
       "      <td>123.30.180.60</td>\n",
       "      <td>443</td>\n",
       "      <td>2020-06-09T08:02:23</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>30695</th>\n",
       "      <td>0</td>\n",
       "      <td>udp</td>\n",
       "      <td>domain_u</td>\n",
       "      <td>SF</td>\n",
       "      <td>90</td>\n",
       "      <td>127</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>29</td>\n",
       "      <td>29</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>192.168.0.109</td>\n",
       "      <td>33678</td>\n",
       "      <td>192.168.0.1</td>\n",
       "      <td>53</td>\n",
       "      <td>2020-06-15T22:54:31</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>30696</th>\n",
       "      <td>29</td>\n",
       "      <td>udp</td>\n",
       "      <td>other</td>\n",
       "      <td>SF</td>\n",
       "      <td>8125</td>\n",
       "      <td>174514</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0</td>\n",
       "      <td>68</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>192.168.0.109</td>\n",
       "      <td>39993</td>\n",
       "      <td>172.217.25.14</td>\n",
       "      <td>443</td>\n",
       "      <td>2020-06-15T22:55:01</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>30697</th>\n",
       "      <td>0</td>\n",
       "      <td>udp</td>\n",
       "      <td>domain_u</td>\n",
       "      <td>SF</td>\n",
       "      <td>102</td>\n",
       "      <td>118</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>30</td>\n",
       "      <td>30</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>192.168.0.109</td>\n",
       "      <td>33449</td>\n",
       "      <td>192.168.0.1</td>\n",
       "      <td>53</td>\n",
       "      <td>2020-06-15T22:54:33</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>30698</th>\n",
       "      <td>29</td>\n",
       "      <td>udp</td>\n",
       "      <td>other</td>\n",
       "      <td>SF</td>\n",
       "      <td>3714</td>\n",
       "      <td>6838</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0</td>\n",
       "      <td>67</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>192.168.0.109</td>\n",
       "      <td>40339</td>\n",
       "      <td>172.217.174.202</td>\n",
       "      <td>443</td>\n",
       "      <td>2020-06-15T22:55:03</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>30699</th>\n",
       "      <td>29</td>\n",
       "      <td>udp</td>\n",
       "      <td>other</td>\n",
       "      <td>SF</td>\n",
       "      <td>3222</td>\n",
       "      <td>3364</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>3</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.67</td>\n",
       "      <td>1</td>\n",
       "      <td>67</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.99</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>192.168.0.109</td>\n",
       "      <td>33660</td>\n",
       "      <td>172.217.174.202</td>\n",
       "      <td>443</td>\n",
       "      <td>2020-06-15T22:55:03</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>30700 rows × 36 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "      duration protocol_type   service flag src_bytes dst_bytes land  \\\n",
       "0            0           tcp     other  OTH        66         0    0   \n",
       "1            0           tcp     other  OTH        68         0    0   \n",
       "2            0           tcp  http_443  OTH        66         0    0   \n",
       "3            0           tcp  http_443  OTH        54         0    0   \n",
       "4            0           tcp  http_443  OTH        66         0    0   \n",
       "...        ...           ...       ...  ...       ...       ...  ...   \n",
       "30695        0           udp  domain_u   SF        90       127    0   \n",
       "30696       29           udp     other   SF      8125    174514    0   \n",
       "30697        0           udp  domain_u   SF       102       118    0   \n",
       "30698       29           udp     other   SF      3714      6838    0   \n",
       "30699       29           udp     other   SF      3222      3364    0   \n",
       "\n",
       "      wrong_fragment urgent count srv_count  serror_rate  srv_serror_rate  \\\n",
       "0                  0      0     0         0          0.0              0.0   \n",
       "1                  0      0     0         1          0.0              0.0   \n",
       "2                  0      0     0         0          0.0              0.0   \n",
       "3                  0      0     0         1          0.0              0.0   \n",
       "4                  0      0     0         2          0.0              0.0   \n",
       "...              ...    ...   ...       ...          ...              ...   \n",
       "30695              0      0     0         0          0.0              0.0   \n",
       "30696              0      0     0         1          0.0              0.0   \n",
       "30697              0      0     1         1          0.0              0.0   \n",
       "30698              0      0     0         2          0.0              0.0   \n",
       "30699              0      0     1         3          0.0              0.0   \n",
       "\n",
       "       rerror_rate  srv_rerror_rate  same_srv_rate  diff_srv_rate  \\\n",
       "0              0.0              0.0            0.0            0.0   \n",
       "1              0.0              0.0            0.0            0.0   \n",
       "2              0.0              0.0            0.0            0.0   \n",
       "3              0.0              0.0            0.0            0.0   \n",
       "4              0.0              0.0            0.0            0.0   \n",
       "...            ...              ...            ...            ...   \n",
       "30695          0.0              0.0            0.0            0.0   \n",
       "30696          0.0              0.0            0.0            0.0   \n",
       "30697          0.0              0.0            1.0            0.0   \n",
       "30698          0.0              0.0            0.0            0.0   \n",
       "30699          0.0              0.0            1.0            0.0   \n",
       "\n",
       "       srv_diff_host_rate dst_host_count dst_host_srv_count  \\\n",
       "0                    0.00              0                  0   \n",
       "1                    1.00              0                  1   \n",
       "2                    0.00              0                  0   \n",
       "3                    1.00              0                  1   \n",
       "4                    1.00              0                  2   \n",
       "...                   ...            ...                ...   \n",
       "30695                0.00             29                 29   \n",
       "30696                1.00              0                 68   \n",
       "30697                0.00             30                 30   \n",
       "30698                1.00              0                 67   \n",
       "30699                0.67              1                 67   \n",
       "\n",
       "       dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "0                         0.0                     0.0   \n",
       "1                         0.0                     0.0   \n",
       "2                         0.0                     0.0   \n",
       "3                         0.0                     0.0   \n",
       "4                         0.0                     0.0   \n",
       "...                       ...                     ...   \n",
       "30695                     1.0                     0.0   \n",
       "30696                     0.0                     0.0   \n",
       "30697                     1.0                     0.0   \n",
       "30698                     0.0                     0.0   \n",
       "30699                     1.0                     0.0   \n",
       "\n",
       "       dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "0                              0.0                         0.00   \n",
       "1                              0.0                         1.00   \n",
       "2                              0.0                         0.00   \n",
       "3                              0.0                         1.00   \n",
       "4                              0.0                         1.00   \n",
       "...                            ...                          ...   \n",
       "30695                          0.0                         0.00   \n",
       "30696                          0.0                         1.00   \n",
       "30697                          0.0                         0.00   \n",
       "30698                          0.0                         1.00   \n",
       "30699                          0.0                         0.99   \n",
       "\n",
       "       dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "0                       0.0                       0.0                   0.0   \n",
       "1                       0.0                       0.0                   0.0   \n",
       "2                       0.0                       0.0                   0.0   \n",
       "3                       0.0                       0.0                   0.0   \n",
       "4                       0.0                       0.0                   0.0   \n",
       "...                     ...                       ...                   ...   \n",
       "30695                   0.0                       0.0                   0.0   \n",
       "30696                   0.0                       0.0                   0.0   \n",
       "30697                   0.0                       0.0                   0.0   \n",
       "30698                   0.0                       0.0                   0.0   \n",
       "30699                   0.0                       0.0                   0.0   \n",
       "\n",
       "       dst_host_srv_rerror_rate          src_ip src_port           dst_ip  \\\n",
       "0                           0.0   192.168.0.109    42924   64.233.187.188   \n",
       "1                           0.0  64.233.187.188     5228    192.168.0.109   \n",
       "2                           0.0   192.168.0.109    41368   216.58.197.110   \n",
       "3                           0.0   192.168.0.109    42256    172.67.70.188   \n",
       "4                           0.0   192.168.0.109    35396    123.30.180.60   \n",
       "...                         ...             ...      ...              ...   \n",
       "30695                       0.0   192.168.0.109    33678      192.168.0.1   \n",
       "30696                       0.0   192.168.0.109    39993    172.217.25.14   \n",
       "30697                       0.0   192.168.0.109    33449      192.168.0.1   \n",
       "30698                       0.0   192.168.0.109    40339  172.217.174.202   \n",
       "30699                       0.0   192.168.0.109    33660  172.217.174.202   \n",
       "\n",
       "      dst_port last_packet_timestamp  attack_type  attack_method    label  \n",
       "0         5228   2020-06-09T08:02:20          NaN            NaN  normal.  \n",
       "1        42924   2020-06-09T08:02:21          NaN            NaN  normal.  \n",
       "2          443   2020-06-09T08:02:23          NaN            NaN  normal.  \n",
       "3          443   2020-06-09T08:02:23          NaN            NaN  normal.  \n",
       "4          443   2020-06-09T08:02:23          NaN            NaN  normal.  \n",
       "...        ...                   ...          ...            ...      ...  \n",
       "30695       53   2020-06-15T22:54:31          NaN            NaN  normal.  \n",
       "30696      443   2020-06-15T22:55:01          NaN            NaN  normal.  \n",
       "30697       53   2020-06-15T22:54:33          NaN            NaN  normal.  \n",
       "30698      443   2020-06-15T22:55:03          NaN            NaN  normal.  \n",
       "30699      443   2020-06-15T22:55:03          NaN            NaN  normal.  \n",
       "\n",
       "[30700 rows x 36 columns]"
      ]
     },
     "execution_count": 20,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "normal_df"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>protocol_type</th>\n",
       "      <th>service</th>\n",
       "      <th>flag</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>count</th>\n",
       "      <th>srv_count</th>\n",
       "      <th>serror_rate</th>\n",
       "      <th>srv_serror_rate</th>\n",
       "      <th>rerror_rate</th>\n",
       "      <th>srv_rerror_rate</th>\n",
       "      <th>same_srv_rate</th>\n",
       "      <th>diff_srv_rate</th>\n",
       "      <th>srv_diff_host_rate</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "      <th>attack_type</th>\n",
       "      <th>attack_method</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>7</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ftp</td>\n",
       "      <td>S1</td>\n",
       "      <td>19715542</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>dos</td>\n",
       "      <td>NaN</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>5</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>S1</td>\n",
       "      <td>12564398</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>dos</td>\n",
       "      <td>NaN</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>2</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>S1</td>\n",
       "      <td>7070294</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>0.50</td>\n",
       "      <td>0.50</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.00</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>dos</td>\n",
       "      <td>NaN</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>3</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>S1</td>\n",
       "      <td>9209662</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>3</td>\n",
       "      <td>2</td>\n",
       "      <td>0.67</td>\n",
       "      <td>0.33</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.00</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>dos</td>\n",
       "      <td>NaN</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>OTH</td>\n",
       "      <td>54</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>probe</td>\n",
       "      <td>NaN</td>\n",
       "      <td>other</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>468293</th>\n",
       "      <td>3</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>S1</td>\n",
       "      <td>222</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>8</td>\n",
       "      <td>8</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>47</td>\n",
       "      <td>47</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.55</td>\n",
       "      <td>0.55</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>dos</td>\n",
       "      <td>NaN</td>\n",
       "      <td>http_slow</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>468294</th>\n",
       "      <td>3</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>S1</td>\n",
       "      <td>222</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>9</td>\n",
       "      <td>9</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>48</td>\n",
       "      <td>48</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.56</td>\n",
       "      <td>0.56</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>dos</td>\n",
       "      <td>NaN</td>\n",
       "      <td>http_slow</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>468295</th>\n",
       "      <td>3</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>S1</td>\n",
       "      <td>222</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>10</td>\n",
       "      <td>10</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>49</td>\n",
       "      <td>49</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.57</td>\n",
       "      <td>0.57</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>dos</td>\n",
       "      <td>NaN</td>\n",
       "      <td>http_slow</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>468296</th>\n",
       "      <td>3</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>S1</td>\n",
       "      <td>222</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>11</td>\n",
       "      <td>11</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>50</td>\n",
       "      <td>50</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.58</td>\n",
       "      <td>0.58</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>dos</td>\n",
       "      <td>NaN</td>\n",
       "      <td>http_slow</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>468297</th>\n",
       "      <td>3</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>S1</td>\n",
       "      <td>222</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>12</td>\n",
       "      <td>12</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>51</td>\n",
       "      <td>51</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.59</td>\n",
       "      <td>0.59</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>dos</td>\n",
       "      <td>NaN</td>\n",
       "      <td>http_slow</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>468298 rows × 31 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "       duration protocol_type service flag src_bytes dst_bytes land  \\\n",
       "0             7           tcp     ftp   S1  19715542         0    0   \n",
       "1             5           tcp    http   S1  12564398         0    1   \n",
       "2             2           tcp    http   S1   7070294         0    0   \n",
       "3             3           tcp    http   S1   9209662         0    0   \n",
       "4             0           tcp    http  OTH        54         0    0   \n",
       "...         ...           ...     ...  ...       ...       ...  ...   \n",
       "468293        3           tcp    http   S1       222         0    0   \n",
       "468294        3           tcp    http   S1       222         0    0   \n",
       "468295        3           tcp    http   S1       222         0    0   \n",
       "468296        3           tcp    http   S1       222         0    0   \n",
       "468297        3           tcp    http   S1       222         0    0   \n",
       "\n",
       "       wrong_fragment urgent count srv_count  serror_rate  srv_serror_rate  \\\n",
       "0                   0      0     0         0          0.0              0.0   \n",
       "1                   0      0     1         0          1.0              0.0   \n",
       "2                   0      0     1         1          1.0              1.0   \n",
       "3                   0      0     1         1          1.0              1.0   \n",
       "4                   0      0     0         0          0.0              0.0   \n",
       "...               ...    ...   ...       ...          ...              ...   \n",
       "468293              0      0     8         8          1.0              1.0   \n",
       "468294              0      0     9         9          1.0              1.0   \n",
       "468295              0      0    10        10          1.0              1.0   \n",
       "468296              0      0    11        11          1.0              1.0   \n",
       "468297              0      0    12        12          1.0              1.0   \n",
       "\n",
       "        rerror_rate  srv_rerror_rate  same_srv_rate  diff_srv_rate  \\\n",
       "0               0.0              0.0            0.0            0.0   \n",
       "1               0.0              0.0            0.0            1.0   \n",
       "2               0.0              0.0            1.0            0.0   \n",
       "3               0.0              0.0            1.0            0.0   \n",
       "4               0.0              0.0            0.0            0.0   \n",
       "...             ...              ...            ...            ...   \n",
       "468293          0.0              0.0            1.0            0.0   \n",
       "468294          0.0              0.0            1.0            0.0   \n",
       "468295          0.0              0.0            1.0            0.0   \n",
       "468296          0.0              0.0            1.0            0.0   \n",
       "468297          0.0              0.0            1.0            0.0   \n",
       "\n",
       "        srv_diff_host_rate dst_host_count dst_host_srv_count  \\\n",
       "0                      0.0              0                  0   \n",
       "1                      0.0              1                  0   \n",
       "2                      0.0              2                  1   \n",
       "3                      0.0              3                  2   \n",
       "4                      0.0              0                  0   \n",
       "...                    ...            ...                ...   \n",
       "468293                 0.0             47                 47   \n",
       "468294                 0.0             48                 48   \n",
       "468295                 0.0             49                 49   \n",
       "468296                 0.0             50                 50   \n",
       "468297                 0.0             51                 51   \n",
       "\n",
       "        dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "0                         0.00                    0.00   \n",
       "1                         0.00                    1.00   \n",
       "2                         0.50                    0.50   \n",
       "3                         0.67                    0.33   \n",
       "4                         0.00                    0.00   \n",
       "...                        ...                     ...   \n",
       "468293                    1.00                    0.00   \n",
       "468294                    1.00                    0.00   \n",
       "468295                    1.00                    0.00   \n",
       "468296                    1.00                    0.00   \n",
       "468297                    1.00                    0.00   \n",
       "\n",
       "        dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "0                               0.0                          0.0   \n",
       "1                               0.0                          0.0   \n",
       "2                               0.0                          0.0   \n",
       "3                               0.0                          0.0   \n",
       "4                               0.0                          0.0   \n",
       "...                             ...                          ...   \n",
       "468293                          0.0                          0.0   \n",
       "468294                          0.0                          0.0   \n",
       "468295                          0.0                          0.0   \n",
       "468296                          0.0                          0.0   \n",
       "468297                          0.0                          0.0   \n",
       "\n",
       "        dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "0                       0.00                      0.00                   0.0   \n",
       "1                       1.00                      0.00                   0.0   \n",
       "2                       1.00                      1.00                   0.0   \n",
       "3                       1.00                      1.00                   0.0   \n",
       "4                       0.00                      0.00                   0.0   \n",
       "...                      ...                       ...                   ...   \n",
       "468293                  0.55                      0.55                   0.0   \n",
       "468294                  0.56                      0.56                   0.0   \n",
       "468295                  0.57                      0.57                   0.0   \n",
       "468296                  0.58                      0.58                   0.0   \n",
       "468297                  0.59                      0.59                   0.0   \n",
       "\n",
       "        dst_host_srv_rerror_rate attack_type  attack_method          label  \n",
       "0                            0.0         dos            NaN  tcp_syn_flood  \n",
       "1                            0.0         dos            NaN  tcp_syn_flood  \n",
       "2                            0.0         dos            NaN  tcp_syn_flood  \n",
       "3                            0.0         dos            NaN  tcp_syn_flood  \n",
       "4                            0.0       probe            NaN          other  \n",
       "...                          ...         ...            ...            ...  \n",
       "468293                       0.0         dos            NaN      http_slow  \n",
       "468294                       0.0         dos            NaN      http_slow  \n",
       "468295                       0.0         dos            NaN      http_slow  \n",
       "468296                       0.0         dos            NaN      http_slow  \n",
       "468297                       0.0         dos            NaN      http_slow  \n",
       "\n",
       "[468298 rows x 31 columns]"
      ]
     },
     "execution_count": 21,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "attack_df"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {},
   "outputs": [],
   "source": [
    "total_df=pd.concat([normal_df, attack_df], ignore_index=True)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "tcp_syn_flood          212454\n",
       "udp_flood              105583\n",
       "tcp_rst_flood           72402\n",
       "normal.                 30700\n",
       "tcp_fin_flood           28096\n",
       "http_flood              24291\n",
       "other                    6361\n",
       "tcp_null_scan            6329\n",
       "tcp_connection_scan      6255\n",
       "udp_scan                 5024\n",
       "icmp_ping_scan           1234\n",
       "guest_passwd              178\n",
       "http_slow                  87\n",
       "ping_of_death               2\n",
       "icmp_flood                  2\n",
       "Name: label, dtype: int64"
      ]
     },
     "execution_count": 23,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "total_df['label'].value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [],
   "source": [
    "total_df=total_df[NORMAL_SUBSET]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>protocol_type</th>\n",
       "      <th>service</th>\n",
       "      <th>flag</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>count</th>\n",
       "      <th>srv_count</th>\n",
       "      <th>serror_rate</th>\n",
       "      <th>srv_serror_rate</th>\n",
       "      <th>rerror_rate</th>\n",
       "      <th>srv_rerror_rate</th>\n",
       "      <th>same_srv_rate</th>\n",
       "      <th>diff_srv_rate</th>\n",
       "      <th>srv_diff_host_rate</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>414919</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ftp</td>\n",
       "      <td>S1</td>\n",
       "      <td>254</td>\n",
       "      <td>58</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>80353</td>\n",
       "      <td>80352</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>100</td>\n",
       "      <td>100</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>58296</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>OTH</td>\n",
       "      <td>54</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>149</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0</td>\n",
       "      <td>100</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.51</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>icmp_ping_scan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>443984</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ftp</td>\n",
       "      <td>S1</td>\n",
       "      <td>254</td>\n",
       "      <td>58</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>109418</td>\n",
       "      <td>109416</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>100</td>\n",
       "      <td>100</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>411682</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ftp</td>\n",
       "      <td>S1</td>\n",
       "      <td>254</td>\n",
       "      <td>58</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>77116</td>\n",
       "      <td>77115</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>100</td>\n",
       "      <td>100</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>246097</th>\n",
       "      <td>0</td>\n",
       "      <td>udp</td>\n",
       "      <td>other</td>\n",
       "      <td>SF</td>\n",
       "      <td>152</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>19642</td>\n",
       "      <td>19642</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>100</td>\n",
       "      <td>100</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>udp_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>434552</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ftp</td>\n",
       "      <td>S1</td>\n",
       "      <td>254</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>99986</td>\n",
       "      <td>99984</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>100</td>\n",
       "      <td>100</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>30759</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>OTH</td>\n",
       "      <td>54</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>55</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0</td>\n",
       "      <td>55</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.62</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>other</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>176205</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ssh</td>\n",
       "      <td>OTH</td>\n",
       "      <td>54</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>30532</td>\n",
       "      <td>30532</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>100</td>\n",
       "      <td>100</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>tcp_rst_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>210586</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ssh</td>\n",
       "      <td>OTH</td>\n",
       "      <td>54</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>64913</td>\n",
       "      <td>64913</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>100</td>\n",
       "      <td>100</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>tcp_rst_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>404805</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ftp</td>\n",
       "      <td>S1</td>\n",
       "      <td>254</td>\n",
       "      <td>58</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>70239</td>\n",
       "      <td>70238</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>100</td>\n",
       "      <td>100</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>481638</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ftp</td>\n",
       "      <td>S1</td>\n",
       "      <td>254</td>\n",
       "      <td>58</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>7081</td>\n",
       "      <td>7081</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>100</td>\n",
       "      <td>100</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>397383</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ftp</td>\n",
       "      <td>S1</td>\n",
       "      <td>254</td>\n",
       "      <td>58</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>62817</td>\n",
       "      <td>62816</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>100</td>\n",
       "      <td>100</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>446175</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ftp</td>\n",
       "      <td>S1</td>\n",
       "      <td>254</td>\n",
       "      <td>58</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>111609</td>\n",
       "      <td>111607</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>100</td>\n",
       "      <td>100</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>207402</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ssh</td>\n",
       "      <td>OTH</td>\n",
       "      <td>54</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>61729</td>\n",
       "      <td>61729</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>100</td>\n",
       "      <td>100</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>tcp_rst_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>207724</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ssh</td>\n",
       "      <td>OTH</td>\n",
       "      <td>54</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>62051</td>\n",
       "      <td>62051</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>100</td>\n",
       "      <td>100</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>tcp_rst_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>417731</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ftp</td>\n",
       "      <td>S1</td>\n",
       "      <td>254</td>\n",
       "      <td>58</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>83165</td>\n",
       "      <td>83164</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>100</td>\n",
       "      <td>100</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>tcp_syn_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>304837</th>\n",
       "      <td>0</td>\n",
       "      <td>udp</td>\n",
       "      <td>ntp_u</td>\n",
       "      <td>SF</td>\n",
       "      <td>152</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>29430</td>\n",
       "      <td>29430</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>91</td>\n",
       "      <td>91</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>udp_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20690</th>\n",
       "      <td>29</td>\n",
       "      <td>udp</td>\n",
       "      <td>other</td>\n",
       "      <td>SF</td>\n",
       "      <td>3514</td>\n",
       "      <td>2168</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>4</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.75</td>\n",
       "      <td>6</td>\n",
       "      <td>81</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.93</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>254446</th>\n",
       "      <td>0</td>\n",
       "      <td>udp</td>\n",
       "      <td>other</td>\n",
       "      <td>SF</td>\n",
       "      <td>152</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>27991</td>\n",
       "      <td>27991</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>100</td>\n",
       "      <td>100</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>udp_flood</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>320334</th>\n",
       "      <td>0</td>\n",
       "      <td>udp</td>\n",
       "      <td>other</td>\n",
       "      <td>SF</td>\n",
       "      <td>152</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>30804</td>\n",
       "      <td>30804</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>80</td>\n",
       "      <td>80</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>udp_flood</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "       duration protocol_type service flag src_bytes dst_bytes land  \\\n",
       "414919        0           tcp     ftp   S1       254        58    0   \n",
       "58296         0           tcp    http  OTH        54         0    0   \n",
       "443984        0           tcp     ftp   S1       254        58    0   \n",
       "411682        0           tcp     ftp   S1       254        58    0   \n",
       "246097        0           udp   other   SF       152         0    0   \n",
       "434552        0           tcp     ftp   S1       254         0    0   \n",
       "30759         0           tcp    http  OTH        54         0    0   \n",
       "176205        0           tcp     ssh  OTH        54         0    0   \n",
       "210586        0           tcp     ssh  OTH        54         0    0   \n",
       "404805        0           tcp     ftp   S1       254        58    0   \n",
       "481638        0           tcp     ftp   S1       254        58    0   \n",
       "397383        0           tcp     ftp   S1       254        58    0   \n",
       "446175        0           tcp     ftp   S1       254        58    0   \n",
       "207402        0           tcp     ssh  OTH        54         0    0   \n",
       "207724        0           tcp     ssh  OTH        54         0    0   \n",
       "417731        0           tcp     ftp   S1       254        58    0   \n",
       "304837        0           udp   ntp_u   SF       152         0    0   \n",
       "20690        29           udp   other   SF      3514      2168    0   \n",
       "254446        0           udp   other   SF       152         0    0   \n",
       "320334        0           udp   other   SF       152         0    0   \n",
       "\n",
       "       wrong_fragment urgent   count srv_count  serror_rate  srv_serror_rate  \\\n",
       "414919              0      0   80353     80352          1.0              1.0   \n",
       "58296               0      0       0       149          0.0              0.0   \n",
       "443984              0      0  109418    109416          1.0              1.0   \n",
       "411682              0      0   77116     77115          1.0              1.0   \n",
       "246097              0      0   19642     19642          0.0              0.0   \n",
       "434552              0      0   99986     99984          1.0              1.0   \n",
       "30759               0      0       0        55          0.0              0.0   \n",
       "176205              0      0   30532     30532          0.0              0.0   \n",
       "210586              0      0   64913     64913          0.0              0.0   \n",
       "404805              0      0   70239     70238          1.0              1.0   \n",
       "481638              0      0    7081      7081          1.0              1.0   \n",
       "397383              0      0   62817     62816          1.0              1.0   \n",
       "446175              0      0  111609    111607          1.0              1.0   \n",
       "207402              0      0   61729     61729          0.0              0.0   \n",
       "207724              0      0   62051     62051          0.0              0.0   \n",
       "417731              0      0   83165     83164          1.0              1.0   \n",
       "304837              0      0   29430     29430          0.0              0.0   \n",
       "20690               0      0       1         4          0.0              0.0   \n",
       "254446              0      0   27991     27991          0.0              0.0   \n",
       "320334              0      0   30804     30804          0.0              0.0   \n",
       "\n",
       "        rerror_rate  srv_rerror_rate  same_srv_rate  diff_srv_rate  \\\n",
       "414919          0.0              0.0            1.0            0.0   \n",
       "58296           0.0              0.0            0.0            0.0   \n",
       "443984          0.0              0.0            1.0            0.0   \n",
       "411682          0.0              0.0            1.0            0.0   \n",
       "246097          0.0              0.0            1.0            0.0   \n",
       "434552          0.0              0.0            1.0            0.0   \n",
       "30759           0.0              0.0            0.0            0.0   \n",
       "176205          0.0              0.0            1.0            0.0   \n",
       "210586          0.0              0.0            1.0            0.0   \n",
       "404805          0.0              0.0            1.0            0.0   \n",
       "481638          0.0              0.0            1.0            0.0   \n",
       "397383          0.0              0.0            1.0            0.0   \n",
       "446175          0.0              0.0            1.0            0.0   \n",
       "207402          0.0              0.0            1.0            0.0   \n",
       "207724          0.0              0.0            1.0            0.0   \n",
       "417731          0.0              0.0            1.0            0.0   \n",
       "304837          0.0              0.0            1.0            0.0   \n",
       "20690           0.0              0.0            1.0            0.0   \n",
       "254446          0.0              0.0            1.0            0.0   \n",
       "320334          0.0              0.0            1.0            0.0   \n",
       "\n",
       "        srv_diff_host_rate dst_host_count dst_host_srv_count  \\\n",
       "414919                0.00            100                100   \n",
       "58296                 1.00              0                100   \n",
       "443984                0.00            100                100   \n",
       "411682                0.00            100                100   \n",
       "246097                0.00            100                100   \n",
       "434552                0.00            100                100   \n",
       "30759                 1.00              0                 55   \n",
       "176205                0.00            100                100   \n",
       "210586                0.00            100                100   \n",
       "404805                0.00            100                100   \n",
       "481638                0.00            100                100   \n",
       "397383                0.00            100                100   \n",
       "446175                0.00            100                100   \n",
       "207402                0.00            100                100   \n",
       "207724                0.00            100                100   \n",
       "417731                0.00            100                100   \n",
       "304837                0.00             91                 91   \n",
       "20690                 0.75              6                 81   \n",
       "254446                0.00            100                100   \n",
       "320334                0.00             80                 80   \n",
       "\n",
       "        dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "414919                     1.0                     0.0   \n",
       "58296                      0.0                     0.0   \n",
       "443984                     1.0                     0.0   \n",
       "411682                     1.0                     0.0   \n",
       "246097                     1.0                     0.0   \n",
       "434552                     1.0                     0.0   \n",
       "30759                      0.0                     0.0   \n",
       "176205                     1.0                     0.0   \n",
       "210586                     1.0                     0.0   \n",
       "404805                     1.0                     0.0   \n",
       "481638                     1.0                     0.0   \n",
       "397383                     1.0                     0.0   \n",
       "446175                     1.0                     0.0   \n",
       "207402                     1.0                     0.0   \n",
       "207724                     1.0                     0.0   \n",
       "417731                     1.0                     0.0   \n",
       "304837                     1.0                     0.0   \n",
       "20690                      1.0                     0.0   \n",
       "254446                     1.0                     0.0   \n",
       "320334                     1.0                     0.0   \n",
       "\n",
       "        dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "414919                         0.00                         0.00   \n",
       "58296                          0.51                         1.00   \n",
       "443984                         0.00                         0.00   \n",
       "411682                         0.00                         0.00   \n",
       "246097                         0.00                         0.00   \n",
       "434552                         0.00                         0.00   \n",
       "30759                          0.62                         1.00   \n",
       "176205                         0.00                         0.00   \n",
       "210586                         0.00                         0.00   \n",
       "404805                         0.00                         0.00   \n",
       "481638                         0.00                         0.00   \n",
       "397383                         0.00                         0.00   \n",
       "446175                         0.00                         0.00   \n",
       "207402                         0.00                         0.00   \n",
       "207724                         0.00                         0.00   \n",
       "417731                         0.00                         0.00   \n",
       "304837                         0.00                         0.00   \n",
       "20690                          0.00                         0.93   \n",
       "254446                         0.00                         0.00   \n",
       "320334                         0.00                         0.00   \n",
       "\n",
       "        dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "414919                   1.0                       1.0                   0.0   \n",
       "58296                    0.0                       0.0                   0.0   \n",
       "443984                   1.0                       1.0                   0.0   \n",
       "411682                   1.0                       1.0                   0.0   \n",
       "246097                   0.0                       0.0                   0.0   \n",
       "434552                   1.0                       1.0                   0.0   \n",
       "30759                    0.0                       0.0                   0.0   \n",
       "176205                   0.0                       0.0                   0.0   \n",
       "210586                   0.0                       0.0                   0.0   \n",
       "404805                   1.0                       1.0                   0.0   \n",
       "481638                   1.0                       1.0                   0.0   \n",
       "397383                   1.0                       1.0                   0.0   \n",
       "446175                   1.0                       1.0                   0.0   \n",
       "207402                   0.0                       0.0                   0.0   \n",
       "207724                   0.0                       0.0                   0.0   \n",
       "417731                   1.0                       1.0                   0.0   \n",
       "304837                   0.0                       0.0                   0.0   \n",
       "20690                    0.0                       0.0                   0.0   \n",
       "254446                   0.0                       0.0                   0.0   \n",
       "320334                   0.0                       0.0                   0.0   \n",
       "\n",
       "        dst_host_srv_rerror_rate           label  \n",
       "414919                       0.0   tcp_syn_flood  \n",
       "58296                        0.0  icmp_ping_scan  \n",
       "443984                       0.0   tcp_syn_flood  \n",
       "411682                       0.0   tcp_syn_flood  \n",
       "246097                       0.0       udp_flood  \n",
       "434552                       0.0   tcp_syn_flood  \n",
       "30759                        0.0           other  \n",
       "176205                       0.0   tcp_rst_flood  \n",
       "210586                       0.0   tcp_rst_flood  \n",
       "404805                       0.0   tcp_syn_flood  \n",
       "481638                       0.0   tcp_syn_flood  \n",
       "397383                       0.0   tcp_syn_flood  \n",
       "446175                       0.0   tcp_syn_flood  \n",
       "207402                       0.0   tcp_rst_flood  \n",
       "207724                       0.0   tcp_rst_flood  \n",
       "417731                       0.0   tcp_syn_flood  \n",
       "304837                       0.0       udp_flood  \n",
       "20690                        0.0         normal.  \n",
       "254446                       0.0       udp_flood  \n",
       "320334                       0.0       udp_flood  "
      ]
     },
     "execution_count": 25,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "total_df.sample(20)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Since the number of normal samples is too small as compared to attack samples, use part of kdd99 normal data additionally"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>protocol_type</th>\n",
       "      <th>service</th>\n",
       "      <th>flag</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>hot</th>\n",
       "      <th>num_failed_logins</th>\n",
       "      <th>logged_in</th>\n",
       "      <th>num_compromised</th>\n",
       "      <th>root_shell</th>\n",
       "      <th>su_attempted</th>\n",
       "      <th>num_root</th>\n",
       "      <th>num_file_creations</th>\n",
       "      <th>num_shells</th>\n",
       "      <th>num_access_files</th>\n",
       "      <th>num_outbound_cmds</th>\n",
       "      <th>is_host_login</th>\n",
       "      <th>is_guest_login</th>\n",
       "      <th>count</th>\n",
       "      <th>srv_count</th>\n",
       "      <th>serror_rate</th>\n",
       "      <th>srv_serror_rate</th>\n",
       "      <th>rerror_rate</th>\n",
       "      <th>srv_rerror_rate</th>\n",
       "      <th>same_srv_rate</th>\n",
       "      <th>diff_srv_rate</th>\n",
       "      <th>srv_diff_host_rate</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>count</th>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1074992</td>\n",
       "      <td>1074992</td>\n",
       "      <td>1074992</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1074992.0</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1.074992e+06</td>\n",
       "      <td>1074992</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>unique</th>\n",
       "      <td>NaN</td>\n",
       "      <td>3</td>\n",
       "      <td>70</td>\n",
       "      <td>11</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>23</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>top</th>\n",
       "      <td>NaN</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>freq</th>\n",
       "      <td>NaN</td>\n",
       "      <td>978540</td>\n",
       "      <td>580507</td>\n",
       "      <td>786840</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>812814</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>mean</th>\n",
       "      <td>1.348908e+02</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>5.837540e+03</td>\n",
       "      <td>4.873730e+03</td>\n",
       "      <td>2.418623e-05</td>\n",
       "      <td>2.735834e-03</td>\n",
       "      <td>3.627934e-05</td>\n",
       "      <td>5.427947e-02</td>\n",
       "      <td>1.460476e-04</td>\n",
       "      <td>6.301163e-01</td>\n",
       "      <td>3.570817e-02</td>\n",
       "      <td>3.023278e-04</td>\n",
       "      <td>1.674431e-04</td>\n",
       "      <td>5.875300e-02</td>\n",
       "      <td>5.416784e-03</td>\n",
       "      <td>3.386072e-04</td>\n",
       "      <td>4.320032e-03</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.860479e-06</td>\n",
       "      <td>3.802819e-03</td>\n",
       "      <td>4.934544e+01</td>\n",
       "      <td>1.297961e+01</td>\n",
       "      <td>1.901168e-01</td>\n",
       "      <td>1.908070e-01</td>\n",
       "      <td>7.811688e-02</td>\n",
       "      <td>7.793043e-02</td>\n",
       "      <td>7.785663e-01</td>\n",
       "      <td>3.159951e-02</td>\n",
       "      <td>1.179070e-01</td>\n",
       "      <td>1.619723e+02</td>\n",
       "      <td>1.592091e+02</td>\n",
       "      <td>6.700944e-01</td>\n",
       "      <td>4.949892e-02</td>\n",
       "      <td>9.335762e-02</td>\n",
       "      <td>2.173602e-02</td>\n",
       "      <td>1.906580e-01</td>\n",
       "      <td>1.901296e-01</td>\n",
       "      <td>7.954099e-02</td>\n",
       "      <td>7.829662e-02</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>std</th>\n",
       "      <td>1.321605e+03</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>2.009617e+06</td>\n",
       "      <td>1.376866e+06</td>\n",
       "      <td>4.917892e-03</td>\n",
       "      <td>8.835986e-02</td>\n",
       "      <td>1.540162e-02</td>\n",
       "      <td>9.974618e-01</td>\n",
       "      <td>1.558112e-02</td>\n",
       "      <td>4.827732e-01</td>\n",
       "      <td>8.232096e+00</td>\n",
       "      <td>1.738496e-02</td>\n",
       "      <td>1.725250e-02</td>\n",
       "      <td>8.406153e+00</td>\n",
       "      <td>2.650495e-01</td>\n",
       "      <td>1.864927e-02</td>\n",
       "      <td>7.347828e-02</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.363993e-03</td>\n",
       "      <td>6.154966e-02</td>\n",
       "      <td>8.523218e+01</td>\n",
       "      <td>2.941398e+01</td>\n",
       "      <td>3.909777e-01</td>\n",
       "      <td>3.916605e-01</td>\n",
       "      <td>2.669225e-01</td>\n",
       "      <td>2.659105e-01</td>\n",
       "      <td>3.917200e-01</td>\n",
       "      <td>1.169086e-01</td>\n",
       "      <td>2.655164e-01</td>\n",
       "      <td>1.022645e+02</td>\n",
       "      <td>1.098842e+02</td>\n",
       "      <td>4.259518e-01</td>\n",
       "      <td>1.310801e-01</td>\n",
       "      <td>2.298291e-01</td>\n",
       "      <td>5.636309e-02</td>\n",
       "      <td>3.907621e-01</td>\n",
       "      <td>3.913478e-01</td>\n",
       "      <td>2.621995e-01</td>\n",
       "      <td>2.609840e-01</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>min</th>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25%</th>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>2.000000e+00</td>\n",
       "      <td>2.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>5.000000e+01</td>\n",
       "      <td>1.800000e+01</td>\n",
       "      <td>7.000000e-02</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>50%</th>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>2.190000e+02</td>\n",
       "      <td>3.320000e+02</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>8.000000e+00</td>\n",
       "      <td>7.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>2.240000e+02</td>\n",
       "      <td>2.480000e+02</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>1.000000e-02</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>75%</th>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>3.060000e+02</td>\n",
       "      <td>1.721000e+03</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>3.400000e+01</td>\n",
       "      <td>1.500000e+01</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e-02</td>\n",
       "      <td>9.000000e-02</td>\n",
       "      <td>2.550000e+02</td>\n",
       "      <td>2.550000e+02</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>6.000000e-02</td>\n",
       "      <td>4.000000e-02</td>\n",
       "      <td>2.000000e-02</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>max</th>\n",
       "      <td>5.832900e+04</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.379964e+09</td>\n",
       "      <td>1.309937e+09</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>3.000000e+00</td>\n",
       "      <td>1.400000e+01</td>\n",
       "      <td>7.700000e+01</td>\n",
       "      <td>5.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>7.479000e+03</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>2.000000e+00</td>\n",
       "      <td>7.468000e+03</td>\n",
       "      <td>4.300000e+01</td>\n",
       "      <td>2.000000e+00</td>\n",
       "      <td>9.000000e+00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>5.110000e+02</td>\n",
       "      <td>5.110000e+02</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>2.550000e+02</td>\n",
       "      <td>2.550000e+02</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "            duration protocol_type  service     flag     src_bytes  \\\n",
       "count   1.074992e+06       1074992  1074992  1074992  1.074992e+06   \n",
       "unique           NaN             3       70       11           NaN   \n",
       "top              NaN           tcp     http       SF           NaN   \n",
       "freq             NaN        978540   580507   786840           NaN   \n",
       "mean    1.348908e+02           NaN      NaN      NaN  5.837540e+03   \n",
       "std     1.321605e+03           NaN      NaN      NaN  2.009617e+06   \n",
       "min     0.000000e+00           NaN      NaN      NaN  0.000000e+00   \n",
       "25%     0.000000e+00           NaN      NaN      NaN  0.000000e+00   \n",
       "50%     0.000000e+00           NaN      NaN      NaN  2.190000e+02   \n",
       "75%     0.000000e+00           NaN      NaN      NaN  3.060000e+02   \n",
       "max     5.832900e+04           NaN      NaN      NaN  1.379964e+09   \n",
       "\n",
       "           dst_bytes          land  wrong_fragment        urgent  \\\n",
       "count   1.074992e+06  1.074992e+06    1.074992e+06  1.074992e+06   \n",
       "unique           NaN           NaN             NaN           NaN   \n",
       "top              NaN           NaN             NaN           NaN   \n",
       "freq             NaN           NaN             NaN           NaN   \n",
       "mean    4.873730e+03  2.418623e-05    2.735834e-03  3.627934e-05   \n",
       "std     1.376866e+06  4.917892e-03    8.835986e-02  1.540162e-02   \n",
       "min     0.000000e+00  0.000000e+00    0.000000e+00  0.000000e+00   \n",
       "25%     0.000000e+00  0.000000e+00    0.000000e+00  0.000000e+00   \n",
       "50%     3.320000e+02  0.000000e+00    0.000000e+00  0.000000e+00   \n",
       "75%     1.721000e+03  0.000000e+00    0.000000e+00  0.000000e+00   \n",
       "max     1.309937e+09  1.000000e+00    3.000000e+00  1.400000e+01   \n",
       "\n",
       "                 hot  num_failed_logins     logged_in  num_compromised  \\\n",
       "count   1.074992e+06       1.074992e+06  1.074992e+06     1.074992e+06   \n",
       "unique           NaN                NaN           NaN              NaN   \n",
       "top              NaN                NaN           NaN              NaN   \n",
       "freq             NaN                NaN           NaN              NaN   \n",
       "mean    5.427947e-02       1.460476e-04  6.301163e-01     3.570817e-02   \n",
       "std     9.974618e-01       1.558112e-02  4.827732e-01     8.232096e+00   \n",
       "min     0.000000e+00       0.000000e+00  0.000000e+00     0.000000e+00   \n",
       "25%     0.000000e+00       0.000000e+00  0.000000e+00     0.000000e+00   \n",
       "50%     0.000000e+00       0.000000e+00  1.000000e+00     0.000000e+00   \n",
       "75%     0.000000e+00       0.000000e+00  1.000000e+00     0.000000e+00   \n",
       "max     7.700000e+01       5.000000e+00  1.000000e+00     7.479000e+03   \n",
       "\n",
       "          root_shell  su_attempted      num_root  num_file_creations  \\\n",
       "count   1.074992e+06  1.074992e+06  1.074992e+06        1.074992e+06   \n",
       "unique           NaN           NaN           NaN                 NaN   \n",
       "top              NaN           NaN           NaN                 NaN   \n",
       "freq             NaN           NaN           NaN                 NaN   \n",
       "mean    3.023278e-04  1.674431e-04  5.875300e-02        5.416784e-03   \n",
       "std     1.738496e-02  1.725250e-02  8.406153e+00        2.650495e-01   \n",
       "min     0.000000e+00  0.000000e+00  0.000000e+00        0.000000e+00   \n",
       "25%     0.000000e+00  0.000000e+00  0.000000e+00        0.000000e+00   \n",
       "50%     0.000000e+00  0.000000e+00  0.000000e+00        0.000000e+00   \n",
       "75%     0.000000e+00  0.000000e+00  0.000000e+00        0.000000e+00   \n",
       "max     1.000000e+00  2.000000e+00  7.468000e+03        4.300000e+01   \n",
       "\n",
       "          num_shells  num_access_files  num_outbound_cmds  is_host_login  \\\n",
       "count   1.074992e+06      1.074992e+06          1074992.0   1.074992e+06   \n",
       "unique           NaN               NaN                NaN            NaN   \n",
       "top              NaN               NaN                NaN            NaN   \n",
       "freq             NaN               NaN                NaN            NaN   \n",
       "mean    3.386072e-04      4.320032e-03                0.0   1.860479e-06   \n",
       "std     1.864927e-02      7.347828e-02                0.0   1.363993e-03   \n",
       "min     0.000000e+00      0.000000e+00                0.0   0.000000e+00   \n",
       "25%     0.000000e+00      0.000000e+00                0.0   0.000000e+00   \n",
       "50%     0.000000e+00      0.000000e+00                0.0   0.000000e+00   \n",
       "75%     0.000000e+00      0.000000e+00                0.0   0.000000e+00   \n",
       "max     2.000000e+00      9.000000e+00                0.0   1.000000e+00   \n",
       "\n",
       "        is_guest_login         count     srv_count   serror_rate  \\\n",
       "count     1.074992e+06  1.074992e+06  1.074992e+06  1.074992e+06   \n",
       "unique             NaN           NaN           NaN           NaN   \n",
       "top                NaN           NaN           NaN           NaN   \n",
       "freq               NaN           NaN           NaN           NaN   \n",
       "mean      3.802819e-03  4.934544e+01  1.297961e+01  1.901168e-01   \n",
       "std       6.154966e-02  8.523218e+01  2.941398e+01  3.909777e-01   \n",
       "min       0.000000e+00  0.000000e+00  0.000000e+00  0.000000e+00   \n",
       "25%       0.000000e+00  2.000000e+00  2.000000e+00  0.000000e+00   \n",
       "50%       0.000000e+00  8.000000e+00  7.000000e+00  0.000000e+00   \n",
       "75%       0.000000e+00  3.400000e+01  1.500000e+01  0.000000e+00   \n",
       "max       1.000000e+00  5.110000e+02  5.110000e+02  1.000000e+00   \n",
       "\n",
       "        srv_serror_rate   rerror_rate  srv_rerror_rate  same_srv_rate  \\\n",
       "count      1.074992e+06  1.074992e+06     1.074992e+06   1.074992e+06   \n",
       "unique              NaN           NaN              NaN            NaN   \n",
       "top                 NaN           NaN              NaN            NaN   \n",
       "freq                NaN           NaN              NaN            NaN   \n",
       "mean       1.908070e-01  7.811688e-02     7.793043e-02   7.785663e-01   \n",
       "std        3.916605e-01  2.669225e-01     2.659105e-01   3.917200e-01   \n",
       "min        0.000000e+00  0.000000e+00     0.000000e+00   0.000000e+00   \n",
       "25%        0.000000e+00  0.000000e+00     0.000000e+00   1.000000e+00   \n",
       "50%        0.000000e+00  0.000000e+00     0.000000e+00   1.000000e+00   \n",
       "75%        0.000000e+00  0.000000e+00     0.000000e+00   1.000000e+00   \n",
       "max        1.000000e+00  1.000000e+00     1.000000e+00   1.000000e+00   \n",
       "\n",
       "        diff_srv_rate  srv_diff_host_rate  dst_host_count  dst_host_srv_count  \\\n",
       "count    1.074992e+06        1.074992e+06    1.074992e+06        1.074992e+06   \n",
       "unique            NaN                 NaN             NaN                 NaN   \n",
       "top               NaN                 NaN             NaN                 NaN   \n",
       "freq              NaN                 NaN             NaN                 NaN   \n",
       "mean     3.159951e-02        1.179070e-01    1.619723e+02        1.592091e+02   \n",
       "std      1.169086e-01        2.655164e-01    1.022645e+02        1.098842e+02   \n",
       "min      0.000000e+00        0.000000e+00    0.000000e+00        0.000000e+00   \n",
       "25%      0.000000e+00        0.000000e+00    5.000000e+01        1.800000e+01   \n",
       "50%      0.000000e+00        0.000000e+00    2.240000e+02        2.480000e+02   \n",
       "75%      1.000000e-02        9.000000e-02    2.550000e+02        2.550000e+02   \n",
       "max      1.000000e+00        1.000000e+00    2.550000e+02        2.550000e+02   \n",
       "\n",
       "        dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "count             1.074992e+06            1.074992e+06   \n",
       "unique                     NaN                     NaN   \n",
       "top                        NaN                     NaN   \n",
       "freq                       NaN                     NaN   \n",
       "mean              6.700944e-01            4.949892e-02   \n",
       "std               4.259518e-01            1.310801e-01   \n",
       "min               0.000000e+00            0.000000e+00   \n",
       "25%               7.000000e-02            0.000000e+00   \n",
       "50%               1.000000e+00            0.000000e+00   \n",
       "75%               1.000000e+00            6.000000e-02   \n",
       "max               1.000000e+00            1.000000e+00   \n",
       "\n",
       "        dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "count                  1.074992e+06                 1.074992e+06   \n",
       "unique                          NaN                          NaN   \n",
       "top                             NaN                          NaN   \n",
       "freq                            NaN                          NaN   \n",
       "mean                   9.335762e-02                 2.173602e-02   \n",
       "std                    2.298291e-01                 5.636309e-02   \n",
       "min                    0.000000e+00                 0.000000e+00   \n",
       "25%                    0.000000e+00                 0.000000e+00   \n",
       "50%                    1.000000e-02                 0.000000e+00   \n",
       "75%                    4.000000e-02                 2.000000e-02   \n",
       "max                    1.000000e+00                 1.000000e+00   \n",
       "\n",
       "        dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "count           1.074992e+06              1.074992e+06          1.074992e+06   \n",
       "unique                   NaN                       NaN                   NaN   \n",
       "top                      NaN                       NaN                   NaN   \n",
       "freq                     NaN                       NaN                   NaN   \n",
       "mean            1.906580e-01              1.901296e-01          7.954099e-02   \n",
       "std             3.907621e-01              3.913478e-01          2.621995e-01   \n",
       "min             0.000000e+00              0.000000e+00          0.000000e+00   \n",
       "25%             0.000000e+00              0.000000e+00          0.000000e+00   \n",
       "50%             0.000000e+00              0.000000e+00          0.000000e+00   \n",
       "75%             0.000000e+00              0.000000e+00          0.000000e+00   \n",
       "max             1.000000e+00              1.000000e+00          1.000000e+00   \n",
       "\n",
       "        dst_host_srv_rerror_rate    label  \n",
       "count               1.074992e+06  1074992  \n",
       "unique                       NaN       23  \n",
       "top                          NaN  normal.  \n",
       "freq                         NaN   812814  \n",
       "mean                7.829662e-02      NaN  \n",
       "std                 2.609840e-01      NaN  \n",
       "min                 0.000000e+00      NaN  \n",
       "25%                 0.000000e+00      NaN  \n",
       "50%                 0.000000e+00      NaN  \n",
       "75%                 0.000000e+00      NaN  \n",
       "max                 1.000000e+00      NaN  "
      ]
     },
     "execution_count": 26,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "kdd=pd.read_csv('data/kddcup.data', names=KDD_COLUMNS)\n",
    "kdd.drop_duplicates(inplace=True)\n",
    "kdd.describe(include='all')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>protocol_type</th>\n",
       "      <th>service</th>\n",
       "      <th>flag</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>count</th>\n",
       "      <th>srv_count</th>\n",
       "      <th>serror_rate</th>\n",
       "      <th>srv_serror_rate</th>\n",
       "      <th>rerror_rate</th>\n",
       "      <th>srv_rerror_rate</th>\n",
       "      <th>same_srv_rate</th>\n",
       "      <th>diff_srv_rate</th>\n",
       "      <th>srv_diff_host_rate</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>199764</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>236</td>\n",
       "      <td>1610</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>7</td>\n",
       "      <td>23</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.09</td>\n",
       "      <td>255</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>345305</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ftp_data</td>\n",
       "      <td>SF</td>\n",
       "      <td>8325</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>14</td>\n",
       "      <td>14</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>63</td>\n",
       "      <td>94</td>\n",
       "      <td>0.38</td>\n",
       "      <td>0.10</td>\n",
       "      <td>0.38</td>\n",
       "      <td>0.02</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>505903</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>286</td>\n",
       "      <td>5902</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>17</td>\n",
       "      <td>17</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>37</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.03</td>\n",
       "      <td>0.04</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.01</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>412662</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>218</td>\n",
       "      <td>1122</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>11</td>\n",
       "      <td>11</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>11</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.09</td>\n",
       "      <td>0.02</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>376151</th>\n",
       "      <td>0</td>\n",
       "      <td>udp</td>\n",
       "      <td>domain_u</td>\n",
       "      <td>SF</td>\n",
       "      <td>46</td>\n",
       "      <td>139</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>236</td>\n",
       "      <td>312</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.01</td>\n",
       "      <td>255</td>\n",
       "      <td>244</td>\n",
       "      <td>0.96</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>50403</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>232</td>\n",
       "      <td>348</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>15</td>\n",
       "      <td>27</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.07</td>\n",
       "      <td>30</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.03</td>\n",
       "      <td>0.06</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>211797</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>247</td>\n",
       "      <td>1408</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>9</td>\n",
       "      <td>9</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>255</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>438762</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>287</td>\n",
       "      <td>2491</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>19</td>\n",
       "      <td>19</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>178</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>280806</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>229</td>\n",
       "      <td>1733</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>24</td>\n",
       "      <td>24</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>63</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.02</td>\n",
       "      <td>0.02</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>59838</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>216</td>\n",
       "      <td>644</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>11</td>\n",
       "      <td>11</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>11</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.09</td>\n",
       "      <td>0.09</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>52095</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>306</td>\n",
       "      <td>4265</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>3</td>\n",
       "      <td>3</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>93</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.04</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14423</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>295</td>\n",
       "      <td>3073</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>2</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>1.00</td>\n",
       "      <td>31</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.03</td>\n",
       "      <td>0.04</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>137054</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>279</td>\n",
       "      <td>7896</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>7</td>\n",
       "      <td>7</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>255</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>442503</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>300</td>\n",
       "      <td>296</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>8</td>\n",
       "      <td>37</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.19</td>\n",
       "      <td>255</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>504916</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>266</td>\n",
       "      <td>405</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>12</td>\n",
       "      <td>20</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.10</td>\n",
       "      <td>255</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>48409</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>221</td>\n",
       "      <td>1193</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>9</td>\n",
       "      <td>20</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.15</td>\n",
       "      <td>255</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>713120</th>\n",
       "      <td>0</td>\n",
       "      <td>udp</td>\n",
       "      <td>domain_u</td>\n",
       "      <td>SF</td>\n",
       "      <td>33</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>2</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>1.00</td>\n",
       "      <td>16</td>\n",
       "      <td>2</td>\n",
       "      <td>0.12</td>\n",
       "      <td>0.19</td>\n",
       "      <td>0.12</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>384673</th>\n",
       "      <td>0</td>\n",
       "      <td>udp</td>\n",
       "      <td>domain_u</td>\n",
       "      <td>SF</td>\n",
       "      <td>44</td>\n",
       "      <td>44</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>17</td>\n",
       "      <td>25</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.12</td>\n",
       "      <td>255</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>350429</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>ftp_data</td>\n",
       "      <td>SF</td>\n",
       "      <td>3775</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>15</td>\n",
       "      <td>15</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>231</td>\n",
       "      <td>99</td>\n",
       "      <td>0.43</td>\n",
       "      <td>0.02</td>\n",
       "      <td>0.43</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>224637</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>smtp</td>\n",
       "      <td>SF</td>\n",
       "      <td>1001</td>\n",
       "      <td>337</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>2</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>1.00</td>\n",
       "      <td>41</td>\n",
       "      <td>23</td>\n",
       "      <td>0.49</td>\n",
       "      <td>0.10</td>\n",
       "      <td>0.02</td>\n",
       "      <td>0.09</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "        duration protocol_type   service flag  src_bytes  dst_bytes  land  \\\n",
       "199764         0           tcp      http   SF        236       1610     0   \n",
       "345305         0           tcp  ftp_data   SF       8325          0     0   \n",
       "505903         0           tcp      http   SF        286       5902     0   \n",
       "412662         0           tcp      http   SF        218       1122     0   \n",
       "376151         0           udp  domain_u   SF         46        139     0   \n",
       "50403          0           tcp      http   SF        232        348     0   \n",
       "211797         0           tcp      http   SF        247       1408     0   \n",
       "438762         0           tcp      http   SF        287       2491     0   \n",
       "280806         0           tcp      http   SF        229       1733     0   \n",
       "59838          0           tcp      http   SF        216        644     0   \n",
       "52095          0           tcp      http   SF        306       4265     0   \n",
       "14423          0           tcp      http   SF        295       3073     0   \n",
       "137054         0           tcp      http   SF        279       7896     0   \n",
       "442503         0           tcp      http   SF        300        296     0   \n",
       "504916         0           tcp      http   SF        266        405     0   \n",
       "48409          0           tcp      http   SF        221       1193     0   \n",
       "713120         0           udp  domain_u   SF         33          0     0   \n",
       "384673         0           udp  domain_u   SF         44         44     0   \n",
       "350429         0           tcp  ftp_data   SF       3775          0     0   \n",
       "224637         0           tcp      smtp   SF       1001        337     0   \n",
       "\n",
       "        wrong_fragment  urgent  count  srv_count  serror_rate  \\\n",
       "199764               0       0      7         23          0.0   \n",
       "345305               0       0     14         14          0.0   \n",
       "505903               0       0     17         17          0.0   \n",
       "412662               0       0     11         11          0.0   \n",
       "376151               0       0    236        312          0.0   \n",
       "50403                0       0     15         27          0.0   \n",
       "211797               0       0      9          9          0.0   \n",
       "438762               0       0     19         19          0.0   \n",
       "280806               0       0     24         24          0.0   \n",
       "59838                0       0     11         11          0.0   \n",
       "52095                0       0      3          3          0.0   \n",
       "14423                0       0      1          2          0.0   \n",
       "137054               0       0      7          7          0.0   \n",
       "442503               0       0      8         37          0.0   \n",
       "504916               0       0     12         20          0.0   \n",
       "48409                0       0      9         20          0.0   \n",
       "713120               0       0      1          2          0.0   \n",
       "384673               0       0     17         25          0.0   \n",
       "350429               0       0     15         15          0.0   \n",
       "224637               0       0      1          2          0.0   \n",
       "\n",
       "        srv_serror_rate  rerror_rate  srv_rerror_rate  same_srv_rate  \\\n",
       "199764              0.0          0.0              0.0            1.0   \n",
       "345305              0.0          0.0              0.0            1.0   \n",
       "505903              0.0          0.0              0.0            1.0   \n",
       "412662              0.0          0.0              0.0            1.0   \n",
       "376151              0.0          0.0              0.0            1.0   \n",
       "50403               0.0          0.0              0.0            1.0   \n",
       "211797              0.0          0.0              0.0            1.0   \n",
       "438762              0.0          0.0              0.0            1.0   \n",
       "280806              0.0          0.0              0.0            1.0   \n",
       "59838               0.0          0.0              0.0            1.0   \n",
       "52095               0.0          0.0              0.0            1.0   \n",
       "14423               0.0          0.0              0.0            1.0   \n",
       "137054              0.0          0.0              0.0            1.0   \n",
       "442503              0.0          0.0              0.0            1.0   \n",
       "504916              0.0          0.0              0.0            1.0   \n",
       "48409               0.0          0.0              0.0            1.0   \n",
       "713120              0.0          0.0              0.0            1.0   \n",
       "384673              0.0          0.0              0.0            1.0   \n",
       "350429              0.0          0.0              0.0            1.0   \n",
       "224637              0.0          0.0              0.0            1.0   \n",
       "\n",
       "        diff_srv_rate  srv_diff_host_rate  dst_host_count  dst_host_srv_count  \\\n",
       "199764           0.00                0.09             255                 255   \n",
       "345305           0.00                0.00              63                  94   \n",
       "505903           0.00                0.00              37                 255   \n",
       "412662           0.00                0.00              11                 255   \n",
       "376151           0.01                0.01             255                 244   \n",
       "50403            0.00                0.07              30                 255   \n",
       "211797           0.00                0.00             255                 255   \n",
       "438762           0.00                0.00             178                 255   \n",
       "280806           0.00                0.00              63                 255   \n",
       "59838            0.00                0.00              11                 255   \n",
       "52095            0.00                0.00              93                 255   \n",
       "14423            0.00                1.00              31                 255   \n",
       "137054           0.00                0.00             255                 255   \n",
       "442503           0.00                0.19             255                 255   \n",
       "504916           0.00                0.10             255                 255   \n",
       "48409            0.00                0.15             255                 255   \n",
       "713120           0.00                1.00              16                   2   \n",
       "384673           0.00                0.12             255                 255   \n",
       "350429           0.00                0.00             231                  99   \n",
       "224637           0.00                1.00              41                  23   \n",
       "\n",
       "        dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "199764                    1.00                    0.00   \n",
       "345305                    0.38                    0.10   \n",
       "505903                    1.00                    0.00   \n",
       "412662                    1.00                    0.00   \n",
       "376151                    0.96                    0.01   \n",
       "50403                     1.00                    0.00   \n",
       "211797                    1.00                    0.00   \n",
       "438762                    1.00                    0.00   \n",
       "280806                    1.00                    0.00   \n",
       "59838                     1.00                    0.00   \n",
       "52095                     1.00                    0.00   \n",
       "14423                     1.00                    0.00   \n",
       "137054                    1.00                    0.00   \n",
       "442503                    1.00                    0.00   \n",
       "504916                    1.00                    0.00   \n",
       "48409                     1.00                    0.00   \n",
       "713120                    0.12                    0.19   \n",
       "384673                    1.00                    0.00   \n",
       "350429                    0.43                    0.02   \n",
       "224637                    0.49                    0.10   \n",
       "\n",
       "        dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "199764                         0.00                         0.00   \n",
       "345305                         0.38                         0.02   \n",
       "505903                         0.03                         0.04   \n",
       "412662                         0.09                         0.02   \n",
       "376151                         0.00                         0.00   \n",
       "50403                          0.03                         0.06   \n",
       "211797                         0.00                         0.00   \n",
       "438762                         0.01                         0.01   \n",
       "280806                         0.02                         0.02   \n",
       "59838                          0.09                         0.09   \n",
       "52095                          0.01                         0.04   \n",
       "14423                          0.03                         0.04   \n",
       "137054                         0.00                         0.00   \n",
       "442503                         0.00                         0.00   \n",
       "504916                         0.00                         0.00   \n",
       "48409                          0.00                         0.00   \n",
       "713120                         0.12                         0.00   \n",
       "384673                         0.00                         0.00   \n",
       "350429                         0.43                         0.00   \n",
       "224637                         0.02                         0.09   \n",
       "\n",
       "        dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "199764                  0.00                      0.00                   0.0   \n",
       "345305                  0.00                      0.00                   0.0   \n",
       "505903                  0.00                      0.00                   0.0   \n",
       "412662                  0.00                      0.00                   0.0   \n",
       "376151                  0.00                      0.00                   0.0   \n",
       "50403                   0.00                      0.00                   0.0   \n",
       "211797                  0.00                      0.00                   0.0   \n",
       "438762                  0.00                      0.00                   0.0   \n",
       "280806                  0.00                      0.00                   0.0   \n",
       "59838                   0.00                      0.00                   0.0   \n",
       "52095                   0.00                      0.00                   0.0   \n",
       "14423                   0.00                      0.00                   0.0   \n",
       "137054                  0.00                      0.00                   0.0   \n",
       "442503                  0.00                      0.00                   0.0   \n",
       "504916                  0.01                      0.01                   0.0   \n",
       "48409                   0.00                      0.00                   0.0   \n",
       "713120                  0.00                      0.00                   0.0   \n",
       "384673                  0.00                      0.00                   0.0   \n",
       "350429                  0.00                      0.00                   0.0   \n",
       "224637                  0.00                      0.00                   0.0   \n",
       "\n",
       "        dst_host_srv_rerror_rate    label  \n",
       "199764                      0.00  normal.  \n",
       "345305                      0.00  normal.  \n",
       "505903                      0.01  normal.  \n",
       "412662                      0.00  normal.  \n",
       "376151                      0.00  normal.  \n",
       "50403                       0.00  normal.  \n",
       "211797                      0.00  normal.  \n",
       "438762                      0.00  normal.  \n",
       "280806                      0.00  normal.  \n",
       "59838                       0.00  normal.  \n",
       "52095                       0.00  normal.  \n",
       "14423                       0.00  normal.  \n",
       "137054                      0.00  normal.  \n",
       "442503                      0.00  normal.  \n",
       "504916                      0.00  normal.  \n",
       "48409                       0.00  normal.  \n",
       "713120                      0.00  normal.  \n",
       "384673                      0.00  normal.  \n",
       "350429                      0.00  normal.  \n",
       "224637                      0.00  normal.  "
      ]
     },
     "execution_count": 27,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "normal_kdd=kdd[kdd['label']=='normal.'].reset_index(drop=True)\n",
    "focus=normal_kdd[NORMAL_SUBSET]\n",
    "focus.sample(20)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>protocol_type</th>\n",
       "      <th>service</th>\n",
       "      <th>flag</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>count</th>\n",
       "      <th>srv_count</th>\n",
       "      <th>serror_rate</th>\n",
       "      <th>srv_serror_rate</th>\n",
       "      <th>rerror_rate</th>\n",
       "      <th>srv_rerror_rate</th>\n",
       "      <th>same_srv_rate</th>\n",
       "      <th>diff_srv_rate</th>\n",
       "      <th>srv_diff_host_rate</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>20074</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>232</td>\n",
       "      <td>6850</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>20</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.05</td>\n",
       "      <td>0.04</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>151703</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>206</td>\n",
       "      <td>873</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>14</td>\n",
       "      <td>17</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.18</td>\n",
       "      <td>59</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.02</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>478132</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>smtp</td>\n",
       "      <td>SF</td>\n",
       "      <td>1046</td>\n",
       "      <td>340</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>95</td>\n",
       "      <td>135</td>\n",
       "      <td>0.66</td>\n",
       "      <td>0.04</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>203013</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>269</td>\n",
       "      <td>4271</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>2</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.50</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>139823</th>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>219</td>\n",
       "      <td>283</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>5</td>\n",
       "      <td>5</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>34</td>\n",
       "      <td>255</td>\n",
       "      <td>1.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.03</td>\n",
       "      <td>0.04</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "        duration protocol_type service flag  src_bytes  dst_bytes  land  \\\n",
       "20074          0           tcp    http   SF        232       6850     0   \n",
       "151703         0           tcp    http   SF        206        873     0   \n",
       "478132         0           tcp    smtp   SF       1046        340     0   \n",
       "203013         0           tcp    http   SF        269       4271     0   \n",
       "139823         0           tcp    http   SF        219        283     0   \n",
       "\n",
       "        wrong_fragment  urgent  count  srv_count  serror_rate  \\\n",
       "20074                0       0      2          2          0.0   \n",
       "151703               0       0     14         17          0.0   \n",
       "478132               0       0      1          1          0.0   \n",
       "203013               0       0      2          2          0.0   \n",
       "139823               0       0      5          5          0.0   \n",
       "\n",
       "        srv_serror_rate  rerror_rate  srv_rerror_rate  same_srv_rate  \\\n",
       "20074               0.0          0.0              0.0            1.0   \n",
       "151703              0.0          0.0              0.0            1.0   \n",
       "478132              0.0          0.0              0.0            1.0   \n",
       "203013              0.0          0.0              0.0            1.0   \n",
       "139823              0.0          0.0              0.0            1.0   \n",
       "\n",
       "        diff_srv_rate  srv_diff_host_rate  dst_host_count  dst_host_srv_count  \\\n",
       "20074             0.0                0.00              20                 255   \n",
       "151703            0.0                0.18              59                 255   \n",
       "478132            0.0                0.00              95                 135   \n",
       "203013            0.0                0.00               2                 255   \n",
       "139823            0.0                0.00              34                 255   \n",
       "\n",
       "        dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "20074                     1.00                    0.00   \n",
       "151703                    1.00                    0.00   \n",
       "478132                    0.66                    0.04   \n",
       "203013                    1.00                    0.00   \n",
       "139823                    1.00                    0.00   \n",
       "\n",
       "        dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "20074                          0.05                         0.04   \n",
       "151703                         0.02                         0.01   \n",
       "478132                         0.01                         0.01   \n",
       "203013                         0.50                         0.01   \n",
       "139823                         0.03                         0.04   \n",
       "\n",
       "        dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "20074                    0.0                       0.0                   0.0   \n",
       "151703                   0.0                       0.0                   0.0   \n",
       "478132                   0.0                       0.0                   0.0   \n",
       "203013                   0.0                       0.0                   0.0   \n",
       "139823                   0.0                       0.0                   0.0   \n",
       "\n",
       "        dst_host_srv_rerror_rate    label  \n",
       "20074                        0.0  normal.  \n",
       "151703                       0.0  normal.  \n",
       "478132                       0.0  normal.  \n",
       "203013                       0.0  normal.  \n",
       "139823                       0.0  normal.  "
      ]
     },
     "execution_count": 28,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "focus.sample(5)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>protocol_type</th>\n",
       "      <th>service</th>\n",
       "      <th>flag</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>count</th>\n",
       "      <th>srv_count</th>\n",
       "      <th>serror_rate</th>\n",
       "      <th>srv_serror_rate</th>\n",
       "      <th>rerror_rate</th>\n",
       "      <th>srv_rerror_rate</th>\n",
       "      <th>same_srv_rate</th>\n",
       "      <th>diff_srv_rate</th>\n",
       "      <th>srv_diff_host_rate</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>count</th>\n",
       "      <td>1306823.0</td>\n",
       "      <td>1306823</td>\n",
       "      <td>1306823</td>\n",
       "      <td>1306823</td>\n",
       "      <td>1306823.0</td>\n",
       "      <td>1306823.0</td>\n",
       "      <td>1306823.0</td>\n",
       "      <td>1306823.0</td>\n",
       "      <td>1306823.0</td>\n",
       "      <td>1306823.0</td>\n",
       "      <td>1306823.0</td>\n",
       "      <td>1.306823e+06</td>\n",
       "      <td>1.306823e+06</td>\n",
       "      <td>1.306823e+06</td>\n",
       "      <td>1.306823e+06</td>\n",
       "      <td>1.306823e+06</td>\n",
       "      <td>1.306823e+06</td>\n",
       "      <td>1.306823e+06</td>\n",
       "      <td>1306823.0</td>\n",
       "      <td>1306823.0</td>\n",
       "      <td>1.306823e+06</td>\n",
       "      <td>1.306823e+06</td>\n",
       "      <td>1.306823e+06</td>\n",
       "      <td>1.306823e+06</td>\n",
       "      <td>1.306823e+06</td>\n",
       "      <td>1.306823e+06</td>\n",
       "      <td>1.306823e+06</td>\n",
       "      <td>1.306823e+06</td>\n",
       "      <td>1306823</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>unique</th>\n",
       "      <td>9070.0</td>\n",
       "      <td>3</td>\n",
       "      <td>48</td>\n",
       "      <td>10</td>\n",
       "      <td>9799.0</td>\n",
       "      <td>23630.0</td>\n",
       "      <td>2.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>7.0</td>\n",
       "      <td>140067.0</td>\n",
       "      <td>140065.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>256.0</td>\n",
       "      <td>256.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>15</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>top</th>\n",
       "      <td>0.0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>254.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>100.0</td>\n",
       "      <td>255.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>freq</th>\n",
       "      <td>1165350.0</td>\n",
       "      <td>1095317</td>\n",
       "      <td>690144</td>\n",
       "      <td>924138</td>\n",
       "      <td>156143.0</td>\n",
       "      <td>337830.0</td>\n",
       "      <td>1306815.0</td>\n",
       "      <td>1306823.0</td>\n",
       "      <td>1306759.0</td>\n",
       "      <td>261351.0</td>\n",
       "      <td>179868.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>414537.0</td>\n",
       "      <td>510588.0</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>838525</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>mean</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.468691e-01</td>\n",
       "      <td>1.476688e-01</td>\n",
       "      <td>2.850301e-02</td>\n",
       "      <td>2.869914e-02</td>\n",
       "      <td>9.722149e-01</td>\n",
       "      <td>1.447245e-02</td>\n",
       "      <td>1.125174e-01</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>9.007750e-01</td>\n",
       "      <td>2.796490e-02</td>\n",
       "      <td>7.996012e-02</td>\n",
       "      <td>3.621608e-02</td>\n",
       "      <td>1.512192e-01</td>\n",
       "      <td>1.510151e-01</td>\n",
       "      <td>2.999681e-02</td>\n",
       "      <td>2.909875e-02</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>std</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>3.373157e-01</td>\n",
       "      <td>3.379267e-01</td>\n",
       "      <td>1.655957e-01</td>\n",
       "      <td>1.643657e-01</td>\n",
       "      <td>1.486384e-01</td>\n",
       "      <td>1.015170e-01</td>\n",
       "      <td>2.660401e-01</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>2.512305e-01</td>\n",
       "      <td>1.162931e-01</td>\n",
       "      <td>2.137324e-01</td>\n",
       "      <td>1.358796e-01</td>\n",
       "      <td>3.438952e-01</td>\n",
       "      <td>3.441303e-01</td>\n",
       "      <td>1.622720e-01</td>\n",
       "      <td>1.580536e-01</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>min</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25%</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>50%</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>75%</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>5.000000e-02</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>3.000000e-02</td>\n",
       "      <td>2.000000e-02</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>max</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "         duration protocol_type  service     flag  src_bytes  dst_bytes  \\\n",
       "count   1306823.0       1306823  1306823  1306823  1306823.0  1306823.0   \n",
       "unique     9070.0             3       48       10     9799.0    23630.0   \n",
       "top           0.0           tcp     http       SF      254.0        0.0   \n",
       "freq    1165350.0       1095317   690144   924138   156143.0   337830.0   \n",
       "mean          NaN           NaN      NaN      NaN        NaN        NaN   \n",
       "std           NaN           NaN      NaN      NaN        NaN        NaN   \n",
       "min           NaN           NaN      NaN      NaN        NaN        NaN   \n",
       "25%           NaN           NaN      NaN      NaN        NaN        NaN   \n",
       "50%           NaN           NaN      NaN      NaN        NaN        NaN   \n",
       "75%           NaN           NaN      NaN      NaN        NaN        NaN   \n",
       "max           NaN           NaN      NaN      NaN        NaN        NaN   \n",
       "\n",
       "             land  wrong_fragment     urgent      count  srv_count  \\\n",
       "count   1306823.0       1306823.0  1306823.0  1306823.0  1306823.0   \n",
       "unique        2.0             1.0        7.0   140067.0   140065.0   \n",
       "top           0.0             0.0        0.0        1.0        1.0   \n",
       "freq    1306815.0       1306823.0  1306759.0   261351.0   179868.0   \n",
       "mean          NaN             NaN        NaN        NaN        NaN   \n",
       "std           NaN             NaN        NaN        NaN        NaN   \n",
       "min           NaN             NaN        NaN        NaN        NaN   \n",
       "25%           NaN             NaN        NaN        NaN        NaN   \n",
       "50%           NaN             NaN        NaN        NaN        NaN   \n",
       "75%           NaN             NaN        NaN        NaN        NaN   \n",
       "max           NaN             NaN        NaN        NaN        NaN   \n",
       "\n",
       "         serror_rate  srv_serror_rate   rerror_rate  srv_rerror_rate  \\\n",
       "count   1.306823e+06     1.306823e+06  1.306823e+06     1.306823e+06   \n",
       "unique           NaN              NaN           NaN              NaN   \n",
       "top              NaN              NaN           NaN              NaN   \n",
       "freq             NaN              NaN           NaN              NaN   \n",
       "mean    1.468691e-01     1.476688e-01  2.850301e-02     2.869914e-02   \n",
       "std     3.373157e-01     3.379267e-01  1.655957e-01     1.643657e-01   \n",
       "min     0.000000e+00     0.000000e+00  0.000000e+00     0.000000e+00   \n",
       "25%     0.000000e+00     0.000000e+00  0.000000e+00     0.000000e+00   \n",
       "50%     0.000000e+00     0.000000e+00  0.000000e+00     0.000000e+00   \n",
       "75%     0.000000e+00     0.000000e+00  0.000000e+00     0.000000e+00   \n",
       "max     1.000000e+00     1.000000e+00  1.000000e+00     1.000000e+00   \n",
       "\n",
       "        same_srv_rate  diff_srv_rate  srv_diff_host_rate  dst_host_count  \\\n",
       "count    1.306823e+06   1.306823e+06        1.306823e+06       1306823.0   \n",
       "unique            NaN            NaN                 NaN           256.0   \n",
       "top               NaN            NaN                 NaN           100.0   \n",
       "freq              NaN            NaN                 NaN        414537.0   \n",
       "mean     9.722149e-01   1.447245e-02        1.125174e-01             NaN   \n",
       "std      1.486384e-01   1.015170e-01        2.660401e-01             NaN   \n",
       "min      0.000000e+00   0.000000e+00        0.000000e+00             NaN   \n",
       "25%      1.000000e+00   0.000000e+00        0.000000e+00             NaN   \n",
       "50%      1.000000e+00   0.000000e+00        0.000000e+00             NaN   \n",
       "75%      1.000000e+00   0.000000e+00        5.000000e-02             NaN   \n",
       "max      1.000000e+00   1.000000e+00        1.000000e+00             NaN   \n",
       "\n",
       "        dst_host_srv_count  dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "count            1306823.0            1.306823e+06            1.306823e+06   \n",
       "unique               256.0                     NaN                     NaN   \n",
       "top                  255.0                     NaN                     NaN   \n",
       "freq              510588.0                     NaN                     NaN   \n",
       "mean                   NaN            9.007750e-01            2.796490e-02   \n",
       "std                    NaN            2.512305e-01            1.162931e-01   \n",
       "min                    NaN            0.000000e+00            0.000000e+00   \n",
       "25%                    NaN            1.000000e+00            0.000000e+00   \n",
       "50%                    NaN            1.000000e+00            0.000000e+00   \n",
       "75%                    NaN            1.000000e+00            0.000000e+00   \n",
       "max                    NaN            1.000000e+00            1.000000e+00   \n",
       "\n",
       "        dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "count                  1.306823e+06                 1.306823e+06   \n",
       "unique                          NaN                          NaN   \n",
       "top                             NaN                          NaN   \n",
       "freq                            NaN                          NaN   \n",
       "mean                   7.996012e-02                 3.621608e-02   \n",
       "std                    2.137324e-01                 1.358796e-01   \n",
       "min                    0.000000e+00                 0.000000e+00   \n",
       "25%                    0.000000e+00                 0.000000e+00   \n",
       "50%                    0.000000e+00                 0.000000e+00   \n",
       "75%                    3.000000e-02                 2.000000e-02   \n",
       "max                    1.000000e+00                 1.000000e+00   \n",
       "\n",
       "        dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "count           1.306823e+06              1.306823e+06          1.306823e+06   \n",
       "unique                   NaN                       NaN                   NaN   \n",
       "top                      NaN                       NaN                   NaN   \n",
       "freq                     NaN                       NaN                   NaN   \n",
       "mean            1.512192e-01              1.510151e-01          2.999681e-02   \n",
       "std             3.438952e-01              3.441303e-01          1.622720e-01   \n",
       "min             0.000000e+00              0.000000e+00          0.000000e+00   \n",
       "25%             0.000000e+00              0.000000e+00          0.000000e+00   \n",
       "50%             0.000000e+00              0.000000e+00          0.000000e+00   \n",
       "75%             0.000000e+00              0.000000e+00          0.000000e+00   \n",
       "max             1.000000e+00              1.000000e+00          1.000000e+00   \n",
       "\n",
       "        dst_host_srv_rerror_rate    label  \n",
       "count               1.306823e+06  1306823  \n",
       "unique                       NaN       15  \n",
       "top                          NaN  normal.  \n",
       "freq                         NaN   838525  \n",
       "mean                2.909875e-02      NaN  \n",
       "std                 1.580536e-01      NaN  \n",
       "min                 0.000000e+00      NaN  \n",
       "25%                 0.000000e+00      NaN  \n",
       "50%                 0.000000e+00      NaN  \n",
       "75%                 0.000000e+00      NaN  \n",
       "max                 1.000000e+00      NaN  "
      ]
     },
     "execution_count": 29,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "total_df=pd.concat([total_df, focus], ignore_index=True)\n",
    "total_df.drop_duplicates(inplace=True)\n",
    "total_df.describe(include='all')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "normal.                838525\n",
       "tcp_syn_flood          212454\n",
       "udp_flood              105583\n",
       "tcp_rst_flood           72402\n",
       "tcp_fin_flood           28096\n",
       "http_flood              24291\n",
       "other                    6361\n",
       "tcp_null_scan            6329\n",
       "tcp_connection_scan      6255\n",
       "udp_scan                 5024\n",
       "icmp_ping_scan           1234\n",
       "guest_passwd              178\n",
       "http_slow                  87\n",
       "ping_of_death               2\n",
       "icmp_flood                  2\n",
       "Name: label, dtype: int64"
      ]
     },
     "execution_count": 30,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "total_df['label'].value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "metadata": {},
   "outputs": [],
   "source": [
    "total_df.to_csv('data/mydata.csv')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.2"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}