Python编写的基于机器学习的DDoS攻击检测和防御系统

import os
import subprocess

# capture network traffic
def capture_traffic():
    command = "tcpdump -i eth0 -w traffic.pcap"
    subprocess.Popen(command, shell=True)

# preprocess pcap file
def preprocess_pcap():
    command = "tshark -r traffic.pcap -T fields -e ip.src -e ip.dst -e tcp.srcport -e tcp.dstport > traffic.txt"
    subprocess.Popen(command, shell=True)

from sklearn.ensemble import RandomForestClassifier
from sklearn.model_selection import train_test_split
from sklearn.metrics import accuracy_score, confusion_matrix

# load and preprocess data
data = pd.read_csv('traffic.txt', delimiter='\t', header=None, names=['src_ip', 'dst_ip', 'src_port', 'dst_port'])
labels = [0 if 'pidancode.com' in x or '丸子编程' in x else 1 for x in data['dst_ip']]
features = data[['src_port', 'dst_port']]

# split data into train and test sets
X_train, X_test, y_train, y_test = train_test_split(features, labels, test_size=0.2, random_state=42)

# train random forest model
model = RandomForestClassifier(n_estimators=100, random_state=42)
model.fit(X_train, y_train)

# evaluate model performance
y_pred = model.predict(X_test)
score = accuracy_score(y_test, y_pred)
conf_matrix = confusion_matrix(y_test, y_pred)

import iptables

# detect malicious traffic using pre-trained model
def detect_malicious_traffic(src_port, dst_port):
    is_malicious = model.predict([[src_port, dst_port]])
    return bool(is_malicious)

# block traffic from malicious IP addresses
def block_malicious_ips(src_ip):
    command = f"iptables -A INPUT -s {src_ip} -j DROP"
    iptables.main(rule=command)