使用K近鄰演算法檢測Rootkit

基於telnet連線的rootkit檢測流程：

KDD 99 資料（41維特徵）->篩選與rootkit相關特徵->基於tcp內容的特徵->向量化->與rootkit相關的特徵向量->KNN演算法+10折交叉驗證->評估效果

這裡用的是KDD 99資料集,篩選標記為rootkit和normal且是telnet協議的資料

        if(x1[41] in ['rootkit.','normal.']) and (x1[2] == 'telnet'):
            if x1[41] == 'rootkit.':
                y.append(1)
            else:
                y.append(0)
 

2、特徵化

挑選與rootkit相關的特徵作為樣本特徵

            x1 = x1[9:21]
            v.append(x1)
    for x1 in v:
        v1 = []
        for x2 in x1:
            v1.append(float(x2))
        w.append(v1)

3、訓練樣本

例項化KNN演算法，k設定為3

    model = KNeighborsClassifier(n_neighbors=3)

4、效果驗證

使用十折交叉驗證

model_selection.cross_val_score(model,x,y,n_jobs=-1,cv=10)
 

完整程式碼：

import re
import matplotlib.pyplot as plt
import os
from sklearn.feature_extraction.text import CountVectorizer
from sklearn import model_selection
import os
from sklearn.naive_bayes import GaussianNB
from sklearn.neighbors import KNeighborsClassifier

def load_kdd99(filename):
    x = []
    with open(filename) as f:
        for line in f:
            line = line.strip('\n')
            line = line.split(',')
            x.append(line)
    return x
def get_rookit2andNormal(x):
    v = [];w = [];y = []
    for x1 in x:
        if(x1[41] in ['rootkit.','normal.']) and (x1[2] == 'telnet'):
            if x1[41] == 'rootkit.':
                y.append(1)
            else:
                y.append(0)
            x1 = x1[9:21]
            v.append(x1)
    for x1 in v:
        v1 = []
        for x2 in x1:
            v1.append(float(x2))
        w.append(v1)
    return w,y
if __name__ == '__main__':
    v = load_kdd99("G:/data/kddcup99/corrected")
    x,y = get_rookit2andNormal(v)
    model = KNeighborsClassifier(n_neighbors=3)
    print(model_selection.cross_val_score(model,x,y,n_jobs=-1,cv=10))
 

使用K近鄰演算法檢測WebShell

載入ADFA-LD中的正常樣本資料

def load_adfa_training_files(rootdir):
    x=[]
    y=[]
    list = os.listdir(rootdir) #列出該路徑下的所有檔案
    for i in range(0, len(list)):
        path = os.path.join(rootdir, list[i]) #將list[i]新增到rootdir路徑後
        if os.path.isfile(path): #判斷該路徑下是不是檔案
            x.append(load_one_flle(path))
            y.append(0)
    return x,y

定義遍歷目錄下的檔案函式，遞迴遍歷所有目錄，直到得到所有檔案

def dirlist(path, allfile):
    filelist = os.listdir(path)
    for filename in filelist:
        filepath = os.path.join(path, filename)
        if os.path.isdir(filepath):
            dirlist(filepath, allfile)
        else:
            allfile.append(filepath)
    return allfile

def load_adfa_webshell_files(rootdir):
    x=[]
    y=[]
    allfile=dirlist(rootdir,[])
    for file in allfile:
        if re.match(r"G:/data/ADFA-LD/Attack_Data_Master/Web_Shell_\d+/UAD-W*",file): #正則化處理，匹配相應檔案
            x.append(load_one_flle(file))
            y.append(1)
    return x,y

2、特徵化

ADFA-LD資料集記錄了函式的呼叫序列，每個檔案包含的函式呼叫序列個數都不一致，用詞集模型進行特徵化

    x1,y1=load_adfa_training_files("G:/data/ADFA-LD/Training_Data_Master/")
    x2,y2=load_adfa_webshell_files("G:/data/ADFA-LD/Attack_Data_Master/")
    x=x1+x2
    y=y1+y2
vectorizer = CountVectorizer(min_df=1)
    x=vectorizer.fit_transform(x)
    x=x.toarray()

接下來與上面過程一樣，完整程式碼：

import re
import matplotlib.pyplot as plt
import os
from sklearn.feature_extraction.text import CountVectorizer
from sklearn import model_selection
import os
from sklearn.datasets import load_iris
from sklearn import tree
import numpy as np
from sklearn.neighbors import KNeighborsClassifier


def load_one_flle(filename):
    x=[]
    with open(filename) as f:
        line=f.readline()
        line=line.strip('\n')
    return line

def load_adfa_training_files(rootdir):
    x=[]
    y=[]
    list = os.listdir(rootdir)
    for i in range(0, len(list)):
        path = os.path.join(rootdir, list[i])
        if os.path.isfile(path):
            x.append(load_one_flle(path))
            y.append(0)
    return x,y

def dirlist(path, allfile):
    filelist = os.listdir(path)
    for filename in filelist:
        filepath = os.path.join(path, filename)
        if os.path.isdir(filepath):
            dirlist(filepath, allfile)
        else:
            allfile.append(filepath)
    return allfile

def load_adfa_webshell_files(rootdir):
    x=[]
    y=[]
    allfile=dirlist(rootdir,[])
    for file in allfile:
        if re.match(r"G:/data/ADFA-LD/Attack_Data_Master/Web_Shell_\d+/UAD-W*",file):
            x.append(load_one_flle(file))
            y.append(1)
    return x,y



if __name__ == '__main__':

    x1,y1=load_adfa_training_files("G:/data/ADFA-LD/Training_Data_Master/")
    x2,y2=load_adfa_webshell_files("G:/data/ADFA-LD/Attack_Data_Master/")
    x=x1+x2
    y=y1+y2
    vectorizer = CountVectorizer(min_df=1)
    x=vectorizer.fit_transform(x)
    x=x.toarray()
    clf = KNeighborsClassifier(n_neighbors=3)
    scores=model_selection.cross_val_score(clf, x, y, n_jobs=-1, cv=10)
    print (scores)
    print (np.mean(scores))