Mallicious Network Data Prediction.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "import pandas as pd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/home/awantik/anaconda3/lib/python3.7/site-packages/IPython/core/interactiveshell.py:3049: DtypeWarning: Columns (1,3,47) have mixed types. Specify dtype option on import or set low_memory=False.\n",
      "  interactivity=interactivity, compiler=compiler, result=result)\n"
     ]
    }
   ],
   "source": [
    "network_data = pd.read_csv('Data/UNSW-NB15_1.csv', header=None)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>0</th>\n",
       "      <th>1</th>\n",
       "      <th>2</th>\n",
       "      <th>3</th>\n",
       "      <th>4</th>\n",
       "      <th>5</th>\n",
       "      <th>6</th>\n",
       "      <th>7</th>\n",
       "      <th>8</th>\n",
       "      <th>9</th>\n",
       "      <th>...</th>\n",
       "      <th>39</th>\n",
       "      <th>40</th>\n",
       "      <th>41</th>\n",
       "      <th>42</th>\n",
       "      <th>43</th>\n",
       "      <th>44</th>\n",
       "      <th>45</th>\n",
       "      <th>46</th>\n",
       "      <th>47</th>\n",
       "      <th>48</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>1390</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>0.001055</td>\n",
       "      <td>132</td>\n",
       "      <td>164</td>\n",
       "      <td>31</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>3</td>\n",
       "      <td>7</td>\n",
       "      <td>1</td>\n",
       "      <td>3</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>33661</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>1024</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>0.036133</td>\n",
       "      <td>528</td>\n",
       "      <td>304</td>\n",
       "      <td>31</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>2</td>\n",
       "      <td>4</td>\n",
       "      <td>2</td>\n",
       "      <td>3</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>2</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>59.166.0.6</td>\n",
       "      <td>1464</td>\n",
       "      <td>149.171.126.7</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>0.001119</td>\n",
       "      <td>146</td>\n",
       "      <td>178</td>\n",
       "      <td>31</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>12</td>\n",
       "      <td>8</td>\n",
       "      <td>1</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>59.166.0.5</td>\n",
       "      <td>3593</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>0.001209</td>\n",
       "      <td>132</td>\n",
       "      <td>164</td>\n",
       "      <td>31</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>6</td>\n",
       "      <td>9</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>49664</td>\n",
       "      <td>149.171.126.0</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>0.001169</td>\n",
       "      <td>146</td>\n",
       "      <td>178</td>\n",
       "      <td>31</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>7</td>\n",
       "      <td>9</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 49 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "           0      1              2     3    4    5         6    7    8   9   \\\n",
       "0  59.166.0.0   1390  149.171.126.6    53  udp  CON  0.001055  132  164  31   \n",
       "1  59.166.0.0  33661  149.171.126.9  1024  udp  CON  0.036133  528  304  31   \n",
       "2  59.166.0.6   1464  149.171.126.7    53  udp  CON  0.001119  146  178  31   \n",
       "3  59.166.0.5   3593  149.171.126.5    53  udp  CON  0.001209  132  164  31   \n",
       "4  59.166.0.3  49664  149.171.126.0    53  udp  CON  0.001169  146  178  31   \n",
       "\n",
       "   ...  39  40  41 42  43  44  45  46   47  48  \n",
       "0  ...   0   3   7  1   3   1   1   1  NaN   0  \n",
       "1  ...   0   2   4  2   3   1   1   2  NaN   0  \n",
       "2  ...   0  12   8  1   2   2   1   1  NaN   0  \n",
       "3  ...   0   6   9  1   1   1   1   1  NaN   0  \n",
       "4  ...   0   7   9  1   1   1   1   1  NaN   0  \n",
       "\n",
       "[5 rows x 49 columns]"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "network_data.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [],
   "source": [
    "schema = pd.read_csv('Data/NUSW-NB15_features.csv', encoding='latin', index_col='No.')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [],
   "source": [
    "columns = schema.Name.to_list()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [],
   "source": [
    "network_data.columns = columns"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>srcip</th>\n",
       "      <th>sport</th>\n",
       "      <th>dstip</th>\n",
       "      <th>dsport</th>\n",
       "      <th>proto</th>\n",
       "      <th>state</th>\n",
       "      <th>dur</th>\n",
       "      <th>sbytes</th>\n",
       "      <th>dbytes</th>\n",
       "      <th>sttl</th>\n",
       "      <th>...</th>\n",
       "      <th>ct_ftp_cmd</th>\n",
       "      <th>ct_srv_src</th>\n",
       "      <th>ct_srv_dst</th>\n",
       "      <th>ct_dst_ltm</th>\n",
       "      <th>ct_src_ ltm</th>\n",
       "      <th>ct_src_dport_ltm</th>\n",
       "      <th>ct_dst_sport_ltm</th>\n",
       "      <th>ct_dst_src_ltm</th>\n",
       "      <th>attack_cat</th>\n",
       "      <th>Label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>1390</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>0.001055</td>\n",
       "      <td>132</td>\n",
       "      <td>164</td>\n",
       "      <td>31</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>3</td>\n",
       "      <td>7</td>\n",
       "      <td>1</td>\n",
       "      <td>3</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>33661</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>1024</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>0.036133</td>\n",
       "      <td>528</td>\n",
       "      <td>304</td>\n",
       "      <td>31</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>2</td>\n",
       "      <td>4</td>\n",
       "      <td>2</td>\n",
       "      <td>3</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>2</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>59.166.0.6</td>\n",
       "      <td>1464</td>\n",
       "      <td>149.171.126.7</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>0.001119</td>\n",
       "      <td>146</td>\n",
       "      <td>178</td>\n",
       "      <td>31</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>12</td>\n",
       "      <td>8</td>\n",
       "      <td>1</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>59.166.0.5</td>\n",
       "      <td>3593</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>0.001209</td>\n",
       "      <td>132</td>\n",
       "      <td>164</td>\n",
       "      <td>31</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>6</td>\n",
       "      <td>9</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>49664</td>\n",
       "      <td>149.171.126.0</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>0.001169</td>\n",
       "      <td>146</td>\n",
       "      <td>178</td>\n",
       "      <td>31</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>7</td>\n",
       "      <td>9</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 49 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "        srcip  sport          dstip dsport proto state       dur  sbytes  \\\n",
       "0  59.166.0.0   1390  149.171.126.6     53   udp   CON  0.001055     132   \n",
       "1  59.166.0.0  33661  149.171.126.9   1024   udp   CON  0.036133     528   \n",
       "2  59.166.0.6   1464  149.171.126.7     53   udp   CON  0.001119     146   \n",
       "3  59.166.0.5   3593  149.171.126.5     53   udp   CON  0.001209     132   \n",
       "4  59.166.0.3  49664  149.171.126.0     53   udp   CON  0.001169     146   \n",
       "\n",
       "   dbytes  sttl  ...  ct_ftp_cmd  ct_srv_src  ct_srv_dst ct_dst_ltm  \\\n",
       "0     164    31  ...           0           3           7          1   \n",
       "1     304    31  ...           0           2           4          2   \n",
       "2     178    31  ...           0          12           8          1   \n",
       "3     164    31  ...           0           6           9          1   \n",
       "4     178    31  ...           0           7           9          1   \n",
       "\n",
       "   ct_src_ ltm  ct_src_dport_ltm  ct_dst_sport_ltm  ct_dst_src_ltm  \\\n",
       "0            3                 1                 1               1   \n",
       "1            3                 1                 1               2   \n",
       "2            2                 2                 1               1   \n",
       "3            1                 1                 1               1   \n",
       "4            1                 1                 1               1   \n",
       "\n",
       "   attack_cat  Label  \n",
       "0         NaN      0  \n",
       "1         NaN      0  \n",
       "2         NaN      0  \n",
       "3         NaN      0  \n",
       "4         NaN      0  \n",
       "\n",
       "[5 rows x 49 columns]"
      ]
     },
     "execution_count": 29,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "network_data.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>srcip</th>\n",
       "      <th>sport</th>\n",
       "      <th>dstip</th>\n",
       "      <th>dsport</th>\n",
       "      <th>proto</th>\n",
       "      <th>state</th>\n",
       "      <th>service</th>\n",
       "      <th>attack_cat</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>1390</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>33661</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>1024</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>59.166.0.6</td>\n",
       "      <td>1464</td>\n",
       "      <td>149.171.126.7</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>59.166.0.5</td>\n",
       "      <td>3593</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>49664</td>\n",
       "      <td>149.171.126.0</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>32119</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>111</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>59.166.0.6</td>\n",
       "      <td>2142</td>\n",
       "      <td>149.171.126.4</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>10.40.182.3</td>\n",
       "      <td>0</td>\n",
       "      <td>10.40.182.3</td>\n",
       "      <td>0</td>\n",
       "      <td>arp</td>\n",
       "      <td>INT</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>59.166.0.5</td>\n",
       "      <td>40726</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>59.166.0.7</td>\n",
       "      <td>12660</td>\n",
       "      <td>149.171.126.4</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>10.40.170.2</td>\n",
       "      <td>0</td>\n",
       "      <td>10.40.170.2</td>\n",
       "      <td>0</td>\n",
       "      <td>arp</td>\n",
       "      <td>INT</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>10.40.170.2</td>\n",
       "      <td>0</td>\n",
       "      <td>10.40.170.2</td>\n",
       "      <td>0</td>\n",
       "      <td>arp</td>\n",
       "      <td>INT</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>10.40.182.3</td>\n",
       "      <td>0</td>\n",
       "      <td>10.40.182.3</td>\n",
       "      <td>0</td>\n",
       "      <td>arp</td>\n",
       "      <td>INT</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>59.166.0.1</td>\n",
       "      <td>48847</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>59.166.0.1</td>\n",
       "      <td>24266</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>41049</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>59.166.0.1</td>\n",
       "      <td>10393</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>44307</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16</th>\n",
       "      <td>59.166.0.2</td>\n",
       "      <td>62539</td>\n",
       "      <td>149.171.126.4</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>59.166.0.1</td>\n",
       "      <td>21270</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>111</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>18</th>\n",
       "      <td>59.166.0.1</td>\n",
       "      <td>8989</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>111</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>19</th>\n",
       "      <td>59.166.0.4</td>\n",
       "      <td>49346</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td>175.45.176.3</td>\n",
       "      <td>21223</td>\n",
       "      <td>149.171.126.18</td>\n",
       "      <td>32780</td>\n",
       "      <td>udp</td>\n",
       "      <td>INT</td>\n",
       "      <td>-</td>\n",
       "      <td>Exploits</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>21</th>\n",
       "      <td>175.45.176.2</td>\n",
       "      <td>23357</td>\n",
       "      <td>149.171.126.16</td>\n",
       "      <td>80</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>http</td>\n",
       "      <td>Exploits</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td>175.45.176.0</td>\n",
       "      <td>13284</td>\n",
       "      <td>149.171.126.16</td>\n",
       "      <td>80</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>http</td>\n",
       "      <td>Reconnaissance</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>23</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>4192</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>24</th>\n",
       "      <td>59.166.0.2</td>\n",
       "      <td>26872</td>\n",
       "      <td>149.171.126.8</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25</th>\n",
       "      <td>59.166.0.8</td>\n",
       "      <td>24946</td>\n",
       "      <td>149.171.126.2</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>26</th>\n",
       "      <td>59.166.0.9</td>\n",
       "      <td>5685</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>27</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>22848</td>\n",
       "      <td>149.171.126.1</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>28</th>\n",
       "      <td>59.166.0.5</td>\n",
       "      <td>28565</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>29</th>\n",
       "      <td>59.166.0.7</td>\n",
       "      <td>46719</td>\n",
       "      <td>149.171.126.4</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699971</th>\n",
       "      <td>59.166.0.1</td>\n",
       "      <td>46807</td>\n",
       "      <td>149.171.126.1</td>\n",
       "      <td>80</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699972</th>\n",
       "      <td>59.166.0.7</td>\n",
       "      <td>60323</td>\n",
       "      <td>149.171.126.1</td>\n",
       "      <td>5190</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699973</th>\n",
       "      <td>59.166.0.9</td>\n",
       "      <td>65260</td>\n",
       "      <td>149.171.126.3</td>\n",
       "      <td>143</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699974</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>36648</td>\n",
       "      <td>149.171.126.8</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699975</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>14404</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>41875</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699976</th>\n",
       "      <td>59.166.0.2</td>\n",
       "      <td>60849</td>\n",
       "      <td>149.171.126.7</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699977</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>14472</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>39979</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699978</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>18827</td>\n",
       "      <td>149.171.126.7</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699979</th>\n",
       "      <td>59.166.0.8</td>\n",
       "      <td>24528</td>\n",
       "      <td>149.171.126.1</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699980</th>\n",
       "      <td>59.166.0.4</td>\n",
       "      <td>19461</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>6881</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699981</th>\n",
       "      <td>59.166.0.1</td>\n",
       "      <td>35327</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>80</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699982</th>\n",
       "      <td>59.166.0.2</td>\n",
       "      <td>9969</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>8650</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699983</th>\n",
       "      <td>59.166.0.8</td>\n",
       "      <td>33100</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>80</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699984</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>12691</td>\n",
       "      <td>149.171.126.3</td>\n",
       "      <td>14273</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699985</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>18895</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>80</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699986</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>21661</td>\n",
       "      <td>149.171.126.0</td>\n",
       "      <td>80</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699987</th>\n",
       "      <td>59.166.0.6</td>\n",
       "      <td>10213</td>\n",
       "      <td>149.171.126.3</td>\n",
       "      <td>46030</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699988</th>\n",
       "      <td>59.166.0.6</td>\n",
       "      <td>31786</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>14228</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699989</th>\n",
       "      <td>59.166.0.6</td>\n",
       "      <td>52262</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>51065</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699990</th>\n",
       "      <td>59.166.0.4</td>\n",
       "      <td>28517</td>\n",
       "      <td>149.171.126.8</td>\n",
       "      <td>80</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699991</th>\n",
       "      <td>59.166.0.8</td>\n",
       "      <td>34947</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>49439</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699992</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>48114</td>\n",
       "      <td>149.171.126.3</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699993</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>48812</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699994</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>48114</td>\n",
       "      <td>149.171.126.3</td>\n",
       "      <td>53</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699995</th>\n",
       "      <td>59.166.0.6</td>\n",
       "      <td>8543</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>45536</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699996</th>\n",
       "      <td>59.166.0.8</td>\n",
       "      <td>12520</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>31010</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699997</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>18895</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>80</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>http</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699998</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>30103</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>5190</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699999</th>\n",
       "      <td>59.166.0.6</td>\n",
       "      <td>30388</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>111</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>700000</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>6055</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>54145</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>700001 rows × 8 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "               srcip  sport           dstip dsport proto state service  \\\n",
       "0         59.166.0.0   1390   149.171.126.6     53   udp   CON     dns   \n",
       "1         59.166.0.0  33661   149.171.126.9   1024   udp   CON       -   \n",
       "2         59.166.0.6   1464   149.171.126.7     53   udp   CON     dns   \n",
       "3         59.166.0.5   3593   149.171.126.5     53   udp   CON     dns   \n",
       "4         59.166.0.3  49664   149.171.126.0     53   udp   CON     dns   \n",
       "5         59.166.0.0  32119   149.171.126.9    111   udp   CON       -   \n",
       "6         59.166.0.6   2142   149.171.126.4     53   udp   CON     dns   \n",
       "7        10.40.182.3      0     10.40.182.3      0   arp   INT       -   \n",
       "8         59.166.0.5  40726   149.171.126.6     53   udp   CON     dns   \n",
       "9         59.166.0.7  12660   149.171.126.4     53   udp   CON     dns   \n",
       "10       10.40.170.2      0     10.40.170.2      0   arp   INT       -   \n",
       "11       10.40.170.2      0     10.40.170.2      0   arp   INT       -   \n",
       "12       10.40.182.3      0     10.40.182.3      0   arp   INT       -   \n",
       "13        59.166.0.1  48847   149.171.126.5     53   udp   CON     dns   \n",
       "14        59.166.0.1  24266   149.171.126.9  41049   udp   CON       -   \n",
       "15        59.166.0.1  10393   149.171.126.6  44307   udp   CON       -   \n",
       "16        59.166.0.2  62539   149.171.126.4     53   udp   CON     dns   \n",
       "17        59.166.0.1  21270   149.171.126.9    111   udp   CON       -   \n",
       "18        59.166.0.1   8989   149.171.126.6    111   udp   CON       -   \n",
       "19        59.166.0.4  49346   149.171.126.5     53   udp   CON     dns   \n",
       "20      175.45.176.3  21223  149.171.126.18  32780   udp   INT       -   \n",
       "21      175.45.176.2  23357  149.171.126.16     80   tcp   FIN    http   \n",
       "22      175.45.176.0  13284  149.171.126.16     80   tcp   FIN    http   \n",
       "23        59.166.0.3   4192   149.171.126.9     53   udp   CON     dns   \n",
       "24        59.166.0.2  26872   149.171.126.8     53   udp   CON     dns   \n",
       "25        59.166.0.8  24946   149.171.126.2     53   udp   CON     dns   \n",
       "26        59.166.0.9   5685   149.171.126.6     53   udp   CON     dns   \n",
       "27        59.166.0.0  22848   149.171.126.1     53   udp   CON     dns   \n",
       "28        59.166.0.5  28565   149.171.126.9     53   udp   CON     dns   \n",
       "29        59.166.0.7  46719   149.171.126.4     53   udp   CON     dns   \n",
       "...              ...    ...             ...    ...   ...   ...     ...   \n",
       "699971    59.166.0.1  46807   149.171.126.1     80   tcp   FIN       -   \n",
       "699972    59.166.0.7  60323   149.171.126.1   5190   tcp   FIN       -   \n",
       "699973    59.166.0.9  65260   149.171.126.3    143   tcp   FIN       -   \n",
       "699974    59.166.0.0  36648   149.171.126.8     53   udp   CON       -   \n",
       "699975    59.166.0.3  14404   149.171.126.5  41875   tcp   FIN       -   \n",
       "699976    59.166.0.2  60849   149.171.126.7     53   udp   CON       -   \n",
       "699977    59.166.0.3  14472   149.171.126.5  39979   tcp   FIN       -   \n",
       "699978    59.166.0.3  18827   149.171.126.7     53   udp   CON       -   \n",
       "699979    59.166.0.8  24528   149.171.126.1     53   udp   CON       -   \n",
       "699980    59.166.0.4  19461   149.171.126.6   6881   tcp   FIN       -   \n",
       "699981    59.166.0.1  35327   149.171.126.5     80   tcp   FIN       -   \n",
       "699982    59.166.0.2   9969   149.171.126.9   8650   tcp   FIN       -   \n",
       "699983    59.166.0.8  33100   149.171.126.6     80   tcp   FIN       -   \n",
       "699984    59.166.0.3  12691   149.171.126.3  14273   tcp   FIN       -   \n",
       "699985    59.166.0.0  18895   149.171.126.9     80   tcp   FIN       -   \n",
       "699986    59.166.0.3  21661   149.171.126.0     80   tcp   FIN       -   \n",
       "699987    59.166.0.6  10213   149.171.126.3  46030   tcp   FIN       -   \n",
       "699988    59.166.0.6  31786   149.171.126.5  14228   udp   CON       -   \n",
       "699989    59.166.0.6  52262   149.171.126.5  51065   tcp   FIN       -   \n",
       "699990    59.166.0.4  28517   149.171.126.8     80   tcp   FIN       -   \n",
       "699991    59.166.0.8  34947   149.171.126.6  49439   tcp   FIN       -   \n",
       "699992    59.166.0.3  48114   149.171.126.3     53   udp   CON     dns   \n",
       "699993    59.166.0.3  48812   149.171.126.6     53   udp   CON       -   \n",
       "699994    59.166.0.3  48114   149.171.126.3     53   udp   CON       -   \n",
       "699995    59.166.0.6   8543   149.171.126.6  45536   tcp   FIN       -   \n",
       "699996    59.166.0.8  12520   149.171.126.6  31010   tcp   FIN       -   \n",
       "699997    59.166.0.0  18895   149.171.126.9     80   tcp   FIN    http   \n",
       "699998    59.166.0.0  30103   149.171.126.5   5190   tcp   FIN       -   \n",
       "699999    59.166.0.6  30388   149.171.126.5    111   udp   CON       -   \n",
       "700000    59.166.0.0   6055   149.171.126.5  54145   tcp   FIN       -   \n",
       "\n",
       "            attack_cat  \n",
       "0                  NaN  \n",
       "1                  NaN  \n",
       "2                  NaN  \n",
       "3                  NaN  \n",
       "4                  NaN  \n",
       "5                  NaN  \n",
       "6                  NaN  \n",
       "7                  NaN  \n",
       "8                  NaN  \n",
       "9                  NaN  \n",
       "10                 NaN  \n",
       "11                 NaN  \n",
       "12                 NaN  \n",
       "13                 NaN  \n",
       "14                 NaN  \n",
       "15                 NaN  \n",
       "16                 NaN  \n",
       "17                 NaN  \n",
       "18                 NaN  \n",
       "19                 NaN  \n",
       "20            Exploits  \n",
       "21            Exploits  \n",
       "22      Reconnaissance  \n",
       "23                 NaN  \n",
       "24                 NaN  \n",
       "25                 NaN  \n",
       "26                 NaN  \n",
       "27                 NaN  \n",
       "28                 NaN  \n",
       "29                 NaN  \n",
       "...                ...  \n",
       "699971             NaN  \n",
       "699972             NaN  \n",
       "699973             NaN  \n",
       "699974             NaN  \n",
       "699975             NaN  \n",
       "699976             NaN  \n",
       "699977             NaN  \n",
       "699978             NaN  \n",
       "699979             NaN  \n",
       "699980             NaN  \n",
       "699981             NaN  \n",
       "699982             NaN  \n",
       "699983             NaN  \n",
       "699984             NaN  \n",
       "699985             NaN  \n",
       "699986             NaN  \n",
       "699987             NaN  \n",
       "699988             NaN  \n",
       "699989             NaN  \n",
       "699990             NaN  \n",
       "699991             NaN  \n",
       "699992             NaN  \n",
       "699993             NaN  \n",
       "699994             NaN  \n",
       "699995             NaN  \n",
       "699996             NaN  \n",
       "699997             NaN  \n",
       "699998             NaN  \n",
       "699999             NaN  \n",
       "700000             NaN  \n",
       "\n",
       "[700001 rows x 8 columns]"
      ]
     },
     "execution_count": 17,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "network_data.select_dtypes(include=['object'])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "<class 'pandas.core.frame.DataFrame'>\n",
      "RangeIndex: 700001 entries, 0 to 700000\n",
      "Data columns (total 49 columns):\n",
      "srcip               700001 non-null object\n",
      "sport               700001 non-null object\n",
      "dstip               700001 non-null object\n",
      "dsport              700001 non-null object\n",
      "proto               700001 non-null object\n",
      "state               700001 non-null object\n",
      "dur                 700001 non-null float64\n",
      "sbytes              700001 non-null int64\n",
      "dbytes              700001 non-null int64\n",
      "sttl                700001 non-null int64\n",
      "dttl                700001 non-null int64\n",
      "sloss               700001 non-null int64\n",
      "dloss               700001 non-null int64\n",
      "service             700001 non-null object\n",
      "Sload               700001 non-null float64\n",
      "Dload               700001 non-null float64\n",
      "Spkts               700001 non-null int64\n",
      "Dpkts               700001 non-null int64\n",
      "swin                700001 non-null int64\n",
      "dwin                700001 non-null int64\n",
      "stcpb               700001 non-null int64\n",
      "dtcpb               700001 non-null int64\n",
      "smeansz             700001 non-null int64\n",
      "dmeansz             700001 non-null int64\n",
      "trans_depth         700001 non-null int64\n",
      "res_bdy_len         700001 non-null int64\n",
      "Sjit                700001 non-null float64\n",
      "Djit                700001 non-null float64\n",
      "Stime               700001 non-null int64\n",
      "Ltime               700001 non-null int64\n",
      "Sintpkt             700001 non-null float64\n",
      "Dintpkt             700001 non-null float64\n",
      "tcprtt              700001 non-null float64\n",
      "synack              700001 non-null float64\n",
      "ackdat              700001 non-null float64\n",
      "is_sm_ips_ports     700001 non-null int64\n",
      "ct_state_ttl        700001 non-null int64\n",
      "ct_flw_http_mthd    700001 non-null int64\n",
      "is_ftp_login        700001 non-null int64\n",
      "ct_ftp_cmd          700001 non-null int64\n",
      "ct_srv_src          700001 non-null int64\n",
      "ct_srv_dst          700001 non-null int64\n",
      "ct_dst_ltm          700001 non-null int64\n",
      "ct_src_ ltm         700001 non-null int64\n",
      "ct_src_dport_ltm    700001 non-null int64\n",
      "ct_dst_sport_ltm    700001 non-null int64\n",
      "ct_dst_src_ltm      700001 non-null int64\n",
      "attack_cat          22215 non-null object\n",
      "Label               700001 non-null int64\n",
      "dtypes: float64(10), int64(31), object(8)\n",
      "memory usage: 261.7+ MB\n"
     ]
    }
   ],
   "source": [
    "network_data.info()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "0    677786\n",
       "1     22215\n",
       "Name: Label, dtype: int64"
      ]
     },
     "execution_count": 19,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "network_data.Label.value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "53       107485\n",
       "80        61279\n",
       "5190      33429\n",
       "53        29812\n",
       "6881      28222\n",
       "25        25071\n",
       "111       23335\n",
       "21        14979\n",
       "22        14769\n",
       "143       14589\n",
       "80        13348\n",
       "5190       7505\n",
       "6881       6669\n",
       "111        5611\n",
       "25         5221\n",
       "0          5085\n",
       "0          4588\n",
       "22         3306\n",
       "21         2957\n",
       "143        2869\n",
       "179        2339\n",
       "520        1082\n",
       "179         728\n",
       "445         656\n",
       "49160       552\n",
       "29644       530\n",
       "2627        520\n",
       "1512        499\n",
       "52579       468\n",
       "42035       466\n",
       "          ...  \n",
       "21132         1\n",
       "61017         1\n",
       "61015         1\n",
       "26153         1\n",
       "9352          1\n",
       "26155         1\n",
       "27597         1\n",
       "55396         1\n",
       "56874         1\n",
       "44225         1\n",
       "33305         1\n",
       "26165         1\n",
       "26167         1\n",
       "64001         1\n",
       "33147         1\n",
       "21765         1\n",
       "37293         1\n",
       "36151         1\n",
       "60992         1\n",
       "26175         1\n",
       "53592         1\n",
       "58700         1\n",
       "9601          1\n",
       "45891         1\n",
       "2768          1\n",
       "26184         1\n",
       "60986         1\n",
       "43943         1\n",
       "60981         1\n",
       "20563         1\n",
       "Name: dsport, Length: 87819, dtype: int64"
      ]
     },
     "execution_count": 20,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "network_data.dsport"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "metadata": {},
   "outputs": [],
   "source": [
    "network_data.drop('attack_cat',axis=1,inplace=True)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 54,
   "metadata": {},
   "outputs": [],
   "source": [
    "def f(r):\n",
    "    try:\n",
    "        x = int(r)\n",
    "    except:\n",
    "        if r == '0x000b':\n",
    "            x = 11\n",
    "        if r == '0x000c':\n",
    "            x = 12\n",
    "        x = 99999\n",
    "    finally:\n",
    "        return x\n",
    "    \n",
    "network_data['sport'] = network_data.sport.map(f)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 61,
   "metadata": {},
   "outputs": [],
   "source": [
    "def f(r):\n",
    "    try:\n",
    "        x = int(r)\n",
    "    except:\n",
    "        x = 0\n",
    "        x = int(r,16)\n",
    "    finally:\n",
    "        return x\n",
    "    \n",
    "network_data['dsport']  = network_data.dsport.map(f)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 63,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>srcip</th>\n",
       "      <th>dstip</th>\n",
       "      <th>proto</th>\n",
       "      <th>state</th>\n",
       "      <th>service</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>59.166.0.6</td>\n",
       "      <td>149.171.126.7</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>59.166.0.5</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>149.171.126.0</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>59.166.0.6</td>\n",
       "      <td>149.171.126.4</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>10.40.182.3</td>\n",
       "      <td>10.40.182.3</td>\n",
       "      <td>arp</td>\n",
       "      <td>INT</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>59.166.0.5</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>59.166.0.7</td>\n",
       "      <td>149.171.126.4</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>10.40.170.2</td>\n",
       "      <td>10.40.170.2</td>\n",
       "      <td>arp</td>\n",
       "      <td>INT</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>10.40.170.2</td>\n",
       "      <td>10.40.170.2</td>\n",
       "      <td>arp</td>\n",
       "      <td>INT</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>10.40.182.3</td>\n",
       "      <td>10.40.182.3</td>\n",
       "      <td>arp</td>\n",
       "      <td>INT</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>59.166.0.1</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>59.166.0.1</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>59.166.0.1</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16</th>\n",
       "      <td>59.166.0.2</td>\n",
       "      <td>149.171.126.4</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>59.166.0.1</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>18</th>\n",
       "      <td>59.166.0.1</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>19</th>\n",
       "      <td>59.166.0.4</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td>175.45.176.3</td>\n",
       "      <td>149.171.126.18</td>\n",
       "      <td>udp</td>\n",
       "      <td>INT</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>21</th>\n",
       "      <td>175.45.176.2</td>\n",
       "      <td>149.171.126.16</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>http</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td>175.45.176.0</td>\n",
       "      <td>149.171.126.16</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>http</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>23</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>24</th>\n",
       "      <td>59.166.0.2</td>\n",
       "      <td>149.171.126.8</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25</th>\n",
       "      <td>59.166.0.8</td>\n",
       "      <td>149.171.126.2</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>26</th>\n",
       "      <td>59.166.0.9</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>27</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>149.171.126.1</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>28</th>\n",
       "      <td>59.166.0.5</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>29</th>\n",
       "      <td>59.166.0.7</td>\n",
       "      <td>149.171.126.4</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699971</th>\n",
       "      <td>59.166.0.1</td>\n",
       "      <td>149.171.126.1</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699972</th>\n",
       "      <td>59.166.0.7</td>\n",
       "      <td>149.171.126.1</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699973</th>\n",
       "      <td>59.166.0.9</td>\n",
       "      <td>149.171.126.3</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699974</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>149.171.126.8</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699975</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699976</th>\n",
       "      <td>59.166.0.2</td>\n",
       "      <td>149.171.126.7</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699977</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699978</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>149.171.126.7</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699979</th>\n",
       "      <td>59.166.0.8</td>\n",
       "      <td>149.171.126.1</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699980</th>\n",
       "      <td>59.166.0.4</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699981</th>\n",
       "      <td>59.166.0.1</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699982</th>\n",
       "      <td>59.166.0.2</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699983</th>\n",
       "      <td>59.166.0.8</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699984</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>149.171.126.3</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699985</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699986</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>149.171.126.0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699987</th>\n",
       "      <td>59.166.0.6</td>\n",
       "      <td>149.171.126.3</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699988</th>\n",
       "      <td>59.166.0.6</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699989</th>\n",
       "      <td>59.166.0.6</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699990</th>\n",
       "      <td>59.166.0.4</td>\n",
       "      <td>149.171.126.8</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699991</th>\n",
       "      <td>59.166.0.8</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699992</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>149.171.126.3</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>dns</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699993</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699994</th>\n",
       "      <td>59.166.0.3</td>\n",
       "      <td>149.171.126.3</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699995</th>\n",
       "      <td>59.166.0.6</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699996</th>\n",
       "      <td>59.166.0.8</td>\n",
       "      <td>149.171.126.6</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699997</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>149.171.126.9</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>http</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699998</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699999</th>\n",
       "      <td>59.166.0.6</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>udp</td>\n",
       "      <td>CON</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>700000</th>\n",
       "      <td>59.166.0.0</td>\n",
       "      <td>149.171.126.5</td>\n",
       "      <td>tcp</td>\n",
       "      <td>FIN</td>\n",
       "      <td>-</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>700001 rows × 5 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "               srcip           dstip proto state service\n",
       "0         59.166.0.0   149.171.126.6   udp   CON     dns\n",
       "1         59.166.0.0   149.171.126.9   udp   CON       -\n",
       "2         59.166.0.6   149.171.126.7   udp   CON     dns\n",
       "3         59.166.0.5   149.171.126.5   udp   CON     dns\n",
       "4         59.166.0.3   149.171.126.0   udp   CON     dns\n",
       "5         59.166.0.0   149.171.126.9   udp   CON       -\n",
       "6         59.166.0.6   149.171.126.4   udp   CON     dns\n",
       "7        10.40.182.3     10.40.182.3   arp   INT       -\n",
       "8         59.166.0.5   149.171.126.6   udp   CON     dns\n",
       "9         59.166.0.7   149.171.126.4   udp   CON     dns\n",
       "10       10.40.170.2     10.40.170.2   arp   INT       -\n",
       "11       10.40.170.2     10.40.170.2   arp   INT       -\n",
       "12       10.40.182.3     10.40.182.3   arp   INT       -\n",
       "13        59.166.0.1   149.171.126.5   udp   CON     dns\n",
       "14        59.166.0.1   149.171.126.9   udp   CON       -\n",
       "15        59.166.0.1   149.171.126.6   udp   CON       -\n",
       "16        59.166.0.2   149.171.126.4   udp   CON     dns\n",
       "17        59.166.0.1   149.171.126.9   udp   CON       -\n",
       "18        59.166.0.1   149.171.126.6   udp   CON       -\n",
       "19        59.166.0.4   149.171.126.5   udp   CON     dns\n",
       "20      175.45.176.3  149.171.126.18   udp   INT       -\n",
       "21      175.45.176.2  149.171.126.16   tcp   FIN    http\n",
       "22      175.45.176.0  149.171.126.16   tcp   FIN    http\n",
       "23        59.166.0.3   149.171.126.9   udp   CON     dns\n",
       "24        59.166.0.2   149.171.126.8   udp   CON     dns\n",
       "25        59.166.0.8   149.171.126.2   udp   CON     dns\n",
       "26        59.166.0.9   149.171.126.6   udp   CON     dns\n",
       "27        59.166.0.0   149.171.126.1   udp   CON     dns\n",
       "28        59.166.0.5   149.171.126.9   udp   CON     dns\n",
       "29        59.166.0.7   149.171.126.4   udp   CON     dns\n",
       "...              ...             ...   ...   ...     ...\n",
       "699971    59.166.0.1   149.171.126.1   tcp   FIN       -\n",
       "699972    59.166.0.7   149.171.126.1   tcp   FIN       -\n",
       "699973    59.166.0.9   149.171.126.3   tcp   FIN       -\n",
       "699974    59.166.0.0   149.171.126.8   udp   CON       -\n",
       "699975    59.166.0.3   149.171.126.5   tcp   FIN       -\n",
       "699976    59.166.0.2   149.171.126.7   udp   CON       -\n",
       "699977    59.166.0.3   149.171.126.5   tcp   FIN       -\n",
       "699978    59.166.0.3   149.171.126.7   udp   CON       -\n",
       "699979    59.166.0.8   149.171.126.1   udp   CON       -\n",
       "699980    59.166.0.4   149.171.126.6   tcp   FIN       -\n",
       "699981    59.166.0.1   149.171.126.5   tcp   FIN       -\n",
       "699982    59.166.0.2   149.171.126.9   tcp   FIN       -\n",
       "699983    59.166.0.8   149.171.126.6   tcp   FIN       -\n",
       "699984    59.166.0.3   149.171.126.3   tcp   FIN       -\n",
       "699985    59.166.0.0   149.171.126.9   tcp   FIN       -\n",
       "699986    59.166.0.3   149.171.126.0   tcp   FIN       -\n",
       "699987    59.166.0.6   149.171.126.3   tcp   FIN       -\n",
       "699988    59.166.0.6   149.171.126.5   udp   CON       -\n",
       "699989    59.166.0.6   149.171.126.5   tcp   FIN       -\n",
       "699990    59.166.0.4   149.171.126.8   tcp   FIN       -\n",
       "699991    59.166.0.8   149.171.126.6   tcp   FIN       -\n",
       "699992    59.166.0.3   149.171.126.3   udp   CON     dns\n",
       "699993    59.166.0.3   149.171.126.6   udp   CON       -\n",
       "699994    59.166.0.3   149.171.126.3   udp   CON       -\n",
       "699995    59.166.0.6   149.171.126.6   tcp   FIN       -\n",
       "699996    59.166.0.8   149.171.126.6   tcp   FIN       -\n",
       "699997    59.166.0.0   149.171.126.9   tcp   FIN    http\n",
       "699998    59.166.0.0   149.171.126.5   tcp   FIN       -\n",
       "699999    59.166.0.6   149.171.126.5   udp   CON       -\n",
       "700000    59.166.0.0   149.171.126.5   tcp   FIN       -\n",
       "\n",
       "[700001 rows x 5 columns]"
      ]
     },
     "execution_count": 63,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "network_data.select_dtypes('object')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 46,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "0         False\n",
       "1         False\n",
       "2         False\n",
       "3         False\n",
       "4         False\n",
       "5         False\n",
       "6         False\n",
       "7          True\n",
       "8         False\n",
       "9         False\n",
       "10         True\n",
       "11         True\n",
       "12         True\n",
       "13        False\n",
       "14        False\n",
       "15        False\n",
       "16        False\n",
       "17        False\n",
       "18        False\n",
       "19        False\n",
       "20        False\n",
       "21        False\n",
       "22        False\n",
       "23        False\n",
       "24        False\n",
       "25        False\n",
       "26        False\n",
       "27        False\n",
       "28        False\n",
       "29        False\n",
       "          ...  \n",
       "699971    False\n",
       "699972    False\n",
       "699973    False\n",
       "699974    False\n",
       "699975    False\n",
       "699976    False\n",
       "699977    False\n",
       "699978    False\n",
       "699979    False\n",
       "699980    False\n",
       "699981    False\n",
       "699982    False\n",
       "699983    False\n",
       "699984    False\n",
       "699985    False\n",
       "699986    False\n",
       "699987    False\n",
       "699988    False\n",
       "699989    False\n",
       "699990    False\n",
       "699991    False\n",
       "699992    False\n",
       "699993    False\n",
       "699994    False\n",
       "699995    False\n",
       "699996    False\n",
       "699997    False\n",
       "699998    False\n",
       "699999    False\n",
       "700000    False\n",
       "Name: sport, Length: 700001, dtype: bool"
      ]
     },
     "execution_count": 46,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "network_data.sport"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 48,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "0         False\n",
       "1         False\n",
       "2         False\n",
       "3         False\n",
       "4         False\n",
       "5         False\n",
       "6         False\n",
       "7         False\n",
       "8         False\n",
       "9         False\n",
       "10        False\n",
       "11        False\n",
       "12        False\n",
       "13        False\n",
       "14        False\n",
       "15        False\n",
       "16        False\n",
       "17        False\n",
       "18        False\n",
       "19        False\n",
       "20        False\n",
       "21        False\n",
       "22        False\n",
       "23        False\n",
       "24        False\n",
       "25        False\n",
       "26        False\n",
       "27        False\n",
       "28        False\n",
       "29        False\n",
       "          ...  \n",
       "699971    False\n",
       "699972    False\n",
       "699973    False\n",
       "699974    False\n",
       "699975    False\n",
       "699976    False\n",
       "699977    False\n",
       "699978    False\n",
       "699979    False\n",
       "699980    False\n",
       "699981    False\n",
       "699982    False\n",
       "699983    False\n",
       "699984    False\n",
       "699985    False\n",
       "699986    False\n",
       "699987    False\n",
       "699988    False\n",
       "699989    False\n",
       "699990    False\n",
       "699991    False\n",
       "699992    False\n",
       "699993    False\n",
       "699994    False\n",
       "699995    False\n",
       "699996    False\n",
       "699997    False\n",
       "699998    False\n",
       "699999    False\n",
       "700000    False\n",
       "Name: sport, Length: 700001, dtype: bool"
      ]
     },
     "execution_count": 48,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "network_data.sport == '0x00b'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 64,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "array(['udp', 'arp', 'tcp', 'ospf', 'icmp', 'igmp', 'sctp', 'udt', 'sep',\n",
       "       'sun-nd', 'swipe', 'mobile', 'pim', 'rtp', 'ipnip', 'ip', 'ggp',\n",
       "       'st2', 'egp', 'cbt', 'emcon', 'nvp', 'igp', 'xnet', 'argus',\n",
       "       'bbn-rcc', 'chaos', 'pup', 'hmp', 'mux', 'dcn', 'prm', 'trunk-1',\n",
       "       'xns-idp', 'trunk-2', 'leaf-1', 'leaf-2', 'irtp', 'rdp', 'iso-tp4',\n",
       "       'netblt', 'mfe-nsp', 'merit-inp', '3pc', 'xtp', 'idpr', 'tp++',\n",
       "       'ddp', 'idpr-cmtp', 'ipv6', 'il', 'idrp', 'ipv6-frag', 'sdrp',\n",
       "       'ipv6-route', 'gre', 'rsvp', 'mhrp', 'bna', 'esp', 'i-nlsp',\n",
       "       'narp', 'ipv6-no', 'tlsp', 'skip', 'ipv6-opts', 'any', 'cftp',\n",
       "       'sat-expak', 'kryptolan', 'rvd', 'ippc', 'sat-mon', 'ipcv', 'visa',\n",
       "       'cpnx', 'cphb', 'wsn', 'pvp', 'br-sat-mon', 'wb-mon', 'wb-expak',\n",
       "       'iso-ip', 'secure-vmtp', 'vmtp', 'vines', 'ttp', 'nsfnet-igp',\n",
       "       'dgp', 'tcf', 'eigrp', 'sprite-rpc', 'larp', 'mtp', 'ax.25',\n",
       "       'ipip', 'micp', 'aes-sp3-d', 'encap', 'etherip', 'pri-enc', 'gmtp',\n",
       "       'pnni', 'ifmp', 'aris', 'qnx', 'a/n', 'scps', 'snp', 'ipcomp',\n",
       "       'compaq-peer', 'ipx-n-ip', 'vrrp', 'zero', 'pgm', 'iatp', 'ddx',\n",
       "       'l2tp', 'srp', 'stp', 'smp', 'uti', 'sm', 'ptp', 'fire', 'crtp',\n",
       "       'isis', 'crudp', 'sccopmce', 'sps', 'pipe', 'iplt', 'unas', 'fc',\n",
       "       'ib'], dtype=object)"
      ]
     },
     "execution_count": 64,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "network_data.proto.unique()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.3"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}