Python编写的基于异常行动检测的入侵检测

import numpy as np
import pandas as pd
from scipy import stats
from sklearn.preprocessing import StandardScaler
from sklearn.cluster import KMeans
from sklearn.decomposition import PCA
import matplotlib.pyplot as plt

# 读取HTTP要求日志文件，并将数据转化为DataFrame格式
http_log = pd.read_csv('http_log.csv')
http_df = pd.DataFrame(http_log)

# 定义一个函数，用于计算Z-score指标
def calculate_zscore(column):
    zscore = np.abs(stats.zscore(column))
    return zscore

# 计算每一个要求的（IP地址，User-Agent，要求时间）中的每一个指标的Z-score值
http_df['src_ip_zscore'] = calculate_zscore(http_df['src_ip'])
http_df['user_agent_zscore'] = calculate_zscore(http_df['user_agent'])
http_df['request_time_zscore'] = calculate_zscore(http_df['request_time'])

# 将计算得到的Z-score值进行归一化处理
scaler = StandardScaler()
scaled_http = scaler.fit_transform(http_df[['src_ip_zscore', 'user_agent_zscore', 'request_time_zscore']])

# 使用K-Means算法对数据进行聚类，选择聚成两类
kmeans = KMeans(n_clusters=2)
kmeans.fit(scaled_http)

# 将聚类结果绘制成散点图
pca = PCA(n_components=2)
reduced_http = pca.fit_transform(scaled_http)
fig, ax = plt.subplots(figsize=(15,8))
scatter = ax.scatter(reduced_http[:,0], reduced_http[:,1], c=kmeans.labels_, cmap='rainbow')
ax.set_xlabel('Dimension 1')
ax.set_ylabel('Dimension 2')
legend = ax.legend(*scatter.legend_elements(), loc='upper right', title='Clusters')
plt.show()