SeleccionCaracteristicas.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "0f75118a",
   "metadata": {},
   "source": [
    "# Pre-procesamiento y selección de características"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "6968e626",
   "metadata": {},
   "outputs": [],
   "source": [
    "import pandas as pd\n",
    "import matplotlib.pyplot as plt\n",
    "import seaborn as sns\n",
    "%matplotlib inline\n",
    "\n",
    "from sklearn.feature_selection import SelectKBest\n",
    "from sklearn.feature_selection import chi2, f_regression"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "c8c633f4",
   "metadata": {},
   "outputs": [],
   "source": [
    "df1 = pd.read_csv('dataset-part1.csv')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "9b97eec6",
   "metadata": {},
   "outputs": [],
   "source": [
    "df2 = pd.read_csv('dataset-part2.csv')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "cf0259f2",
   "metadata": {},
   "outputs": [],
   "source": [
    "frames = [df1, df2]\n",
    "df_final = pd.concat(frames)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "d4bf519c",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "(12207873, 50)"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df_final.shape"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "c8688d8d",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>BIFLOW_DIRECTION</th>\n",
       "      <th>DIRECTION</th>\n",
       "      <th>DST_TO_SRC_SECOND_BYTES</th>\n",
       "      <th>FIREWALL_EVENT</th>\n",
       "      <th>FIRST_SWITCHED</th>\n",
       "      <th>FLOW_ACTIVE_TIMEOUT</th>\n",
       "      <th>FLOW_DURATION_MICROSECONDS</th>\n",
       "      <th>FLOW_DURATION_MILLISECONDS</th>\n",
       "      <th>FLOW_END_MILLISECONDS</th>\n",
       "      <th>FLOW_END_SEC</th>\n",
       "      <th>...</th>\n",
       "      <th>TCP_WIN_MSS_IN</th>\n",
       "      <th>TCP_WIN_MSS_OUT</th>\n",
       "      <th>TCP_WIN_SCALE_IN</th>\n",
       "      <th>TCP_WIN_SCALE_OUT</th>\n",
       "      <th>SRC_TOS</th>\n",
       "      <th>DST_TOS</th>\n",
       "      <th>L7_PROTO_NAME</th>\n",
       "      <th>SAMPLING_INTERVAL</th>\n",
       "      <th>TOTAL_FLOWS_EXP</th>\n",
       "      <th>LABEL</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>40</td>\n",
       "      <td>0</td>\n",
       "      <td>1616660040</td>\n",
       "      <td>120</td>\n",
       "      <td>339</td>\n",
       "      <td>0</td>\n",
       "      <td>1616660040010</td>\n",
       "      <td>1616660040</td>\n",
       "      <td>...</td>\n",
       "      <td>1460</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>Unknown</td>\n",
       "      <td>1</td>\n",
       "      <td>2293398</td>\n",
       "      <td>Normal flow</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>,</td>\n",
       "      <td>0</td>\n",
       "      <td>1616660040</td>\n",
       "      <td>120</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1616660040068</td>\n",
       "      <td>1616660040</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>40</td>\n",
       "      <td>0</td>\n",
       "      <td>ICMP</td>\n",
       "      <td>1</td>\n",
       "      <td>2293400</td>\n",
       "      <td>Normal flow</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>104</td>\n",
       "      <td>0</td>\n",
       "      <td>1616660040</td>\n",
       "      <td>120</td>\n",
       "      <td>44725</td>\n",
       "      <td>44</td>\n",
       "      <td>1616660040114</td>\n",
       "      <td>1616660040</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>TLS</td>\n",
       "      <td>1</td>\n",
       "      <td>2293404</td>\n",
       "      <td>Normal flow</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>,</td>\n",
       "      <td>0</td>\n",
       "      <td>1616660040</td>\n",
       "      <td>120</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1616660040122</td>\n",
       "      <td>1616660040</td>\n",
       "      <td>...</td>\n",
       "      <td>1440</td>\n",
       "      <td>0</td>\n",
       "      <td>8</td>\n",
       "      <td>0</td>\n",
       "      <td>40</td>\n",
       "      <td>0</td>\n",
       "      <td>Unknown</td>\n",
       "      <td>1</td>\n",
       "      <td>2293407</td>\n",
       "      <td>Normal flow</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>40</td>\n",
       "      <td>0</td>\n",
       "      <td>1616660040</td>\n",
       "      <td>120</td>\n",
       "      <td>1114</td>\n",
       "      <td>1</td>\n",
       "      <td>1616660040184</td>\n",
       "      <td>1616660040</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>TLS</td>\n",
       "      <td>1</td>\n",
       "      <td>2293409</td>\n",
       "      <td>Normal flow</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 50 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "   BIFLOW_DIRECTION  DIRECTION DST_TO_SRC_SECOND_BYTES  FIREWALL_EVENT  \\\n",
       "0                 1          0                      40               0   \n",
       "1                 1          0                       ,               0   \n",
       "2                 1          0                     104               0   \n",
       "3                 1          0                       ,               0   \n",
       "4                 1          0                      40               0   \n",
       "\n",
       "   FIRST_SWITCHED  FLOW_ACTIVE_TIMEOUT  FLOW_DURATION_MICROSECONDS  \\\n",
       "0      1616660040                  120                         339   \n",
       "1      1616660040                  120                           0   \n",
       "2      1616660040                  120                       44725   \n",
       "3      1616660040                  120                           0   \n",
       "4      1616660040                  120                        1114   \n",
       "\n",
       "   FLOW_DURATION_MILLISECONDS  FLOW_END_MILLISECONDS  FLOW_END_SEC  ...  \\\n",
       "0                           0          1616660040010    1616660040  ...   \n",
       "1                           0          1616660040068    1616660040  ...   \n",
       "2                          44          1616660040114    1616660040  ...   \n",
       "3                           0          1616660040122    1616660040  ...   \n",
       "4                           1          1616660040184    1616660040  ...   \n",
       "\n",
       "   TCP_WIN_MSS_IN  TCP_WIN_MSS_OUT  TCP_WIN_SCALE_IN  TCP_WIN_SCALE_OUT  \\\n",
       "0            1460                0                 0                  0   \n",
       "1               0                0                 0                  0   \n",
       "2               0                0                 0                  0   \n",
       "3            1440                0                 8                  0   \n",
       "4               0                0                 0                  0   \n",
       "\n",
       "   SRC_TOS  DST_TOS  L7_PROTO_NAME SAMPLING_INTERVAL TOTAL_FLOWS_EXP  \\\n",
       "0        0        0        Unknown                 1         2293398   \n",
       "1       40        0           ICMP                 1         2293400   \n",
       "2        0        0            TLS                 1         2293404   \n",
       "3       40        0        Unknown                 1         2293407   \n",
       "4        0        0            TLS                 1         2293409   \n",
       "\n",
       "         LABEL  \n",
       "0  Normal flow  \n",
       "1  Normal flow  \n",
       "2  Normal flow  \n",
       "3  Normal flow  \n",
       "4  Normal flow  \n",
       "\n",
       "[5 rows x 50 columns]"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df_final.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "id": "f0423b08",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "<class 'pandas.core.frame.DataFrame'>\n",
      "Int64Index: 12207873 entries, 0 to 8637206\n",
      "Data columns (total 50 columns):\n",
      " #   Column                      Dtype \n",
      "---  ------                      ----- \n",
      " 0   BIFLOW_DIRECTION            int64 \n",
      " 1   DIRECTION                   int64 \n",
      " 2   DST_TO_SRC_SECOND_BYTES     object\n",
      " 3   FIREWALL_EVENT              int64 \n",
      " 4   FIRST_SWITCHED              int64 \n",
      " 5   FLOW_ACTIVE_TIMEOUT         int64 \n",
      " 6   FLOW_DURATION_MICROSECONDS  int64 \n",
      " 7   FLOW_DURATION_MILLISECONDS  int64 \n",
      " 8   FLOW_END_MILLISECONDS       int64 \n",
      " 9   FLOW_END_SEC                int64 \n",
      " 10  FLOW_ID                     int64 \n",
      " 11  FLOW_INACTIVE_TIMEOUT       int64 \n",
      " 12  FLOW_START_MILLISECONDS     int64 \n",
      " 13  FLOW_START_SEC              int64 \n",
      " 14  FRAME_LENGTH                int64 \n",
      " 15  IN_BYTES                    int64 \n",
      " 16  IN_PKTS                     int64 \n",
      " 17  IPV4_DST_ADDR               object\n",
      " 18  IPV4_SRC_ADDR               object\n",
      " 19  L4_DST_PORT                 int64 \n",
      " 20  L4_SRC_PORT                 int64 \n",
      " 21  LAST_SWITCHED               int64 \n",
      " 22  MAX_IP_PKT_LEN              int64 \n",
      " 23  MIN_IP_PKT_LEN              int64 \n",
      " 24  OOORDER_IN_PKTS             int64 \n",
      " 25  OOORDER_OUT_PKTS            int64 \n",
      " 26  OUT_BYTES                   int64 \n",
      " 27  OUT_PKTS                    int64 \n",
      " 28  PROTOCOL                    int64 \n",
      " 29  PROTOCOL_MAP                object\n",
      " 30  RETRANSMITTED_IN_BYTES      int64 \n",
      " 31  RETRANSMITTED_IN_PKTS       int64 \n",
      " 32  RETRANSMITTED_OUT_BYTES     int64 \n",
      " 33  RETRANSMITTED_OUT_PKTS      int64 \n",
      " 34  SRC_TO_DST_SECOND_BYTES     object\n",
      " 35  TCP_FLAGS                   int64 \n",
      " 36  TCP_WIN_MAX_IN              int64 \n",
      " 37  TCP_WIN_MAX_OUT             int64 \n",
      " 38  TCP_WIN_MIN_IN              int64 \n",
      " 39  TCP_WIN_MIN_OUT             int64 \n",
      " 40  TCP_WIN_MSS_IN              int64 \n",
      " 41  TCP_WIN_MSS_OUT             int64 \n",
      " 42  TCP_WIN_SCALE_IN            int64 \n",
      " 43  TCP_WIN_SCALE_OUT           int64 \n",
      " 44  SRC_TOS                     int64 \n",
      " 45  DST_TOS                     int64 \n",
      " 46  L7_PROTO_NAME               object\n",
      " 47  SAMPLING_INTERVAL           int64 \n",
      " 48  TOTAL_FLOWS_EXP             int64 \n",
      " 49  LABEL                       object\n",
      "dtypes: int64(43), object(7)\n",
      "memory usage: 4.6+ GB\n"
     ]
    }
   ],
   "source": [
    "df_final.info()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "59cd29ee",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>BIFLOW_DIRECTION</th>\n",
       "      <th>DIRECTION</th>\n",
       "      <th>FIREWALL_EVENT</th>\n",
       "      <th>FIRST_SWITCHED</th>\n",
       "      <th>FLOW_ACTIVE_TIMEOUT</th>\n",
       "      <th>FLOW_DURATION_MICROSECONDS</th>\n",
       "      <th>FLOW_DURATION_MILLISECONDS</th>\n",
       "      <th>FLOW_END_MILLISECONDS</th>\n",
       "      <th>FLOW_END_SEC</th>\n",
       "      <th>FLOW_ID</th>\n",
       "      <th>...</th>\n",
       "      <th>TCP_WIN_MIN_IN</th>\n",
       "      <th>TCP_WIN_MIN_OUT</th>\n",
       "      <th>TCP_WIN_MSS_IN</th>\n",
       "      <th>TCP_WIN_MSS_OUT</th>\n",
       "      <th>TCP_WIN_SCALE_IN</th>\n",
       "      <th>TCP_WIN_SCALE_OUT</th>\n",
       "      <th>SRC_TOS</th>\n",
       "      <th>DST_TOS</th>\n",
       "      <th>SAMPLING_INTERVAL</th>\n",
       "      <th>TOTAL_FLOWS_EXP</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>count</th>\n",
       "      <td>12207873.0</td>\n",
       "      <td>1.220787e+07</td>\n",
       "      <td>12207873.0</td>\n",
       "      <td>1.220787e+07</td>\n",
       "      <td>12207873.0</td>\n",
       "      <td>1.220787e+07</td>\n",
       "      <td>1.220787e+07</td>\n",
       "      <td>1.220787e+07</td>\n",
       "      <td>1.220787e+07</td>\n",
       "      <td>1.220787e+07</td>\n",
       "      <td>...</td>\n",
       "      <td>1.220787e+07</td>\n",
       "      <td>1.220787e+07</td>\n",
       "      <td>1.220787e+07</td>\n",
       "      <td>1.220787e+07</td>\n",
       "      <td>1.220787e+07</td>\n",
       "      <td>1.220787e+07</td>\n",
       "      <td>1.220787e+07</td>\n",
       "      <td>1.220787e+07</td>\n",
       "      <td>12207873.0</td>\n",
       "      <td>1.220787e+07</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>mean</th>\n",
       "      <td>1.0</td>\n",
       "      <td>2.158525e-03</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.617770e+09</td>\n",
       "      <td>120.0</td>\n",
       "      <td>2.162737e+07</td>\n",
       "      <td>2.162695e+04</td>\n",
       "      <td>1.617770e+12</td>\n",
       "      <td>1.617770e+09</td>\n",
       "      <td>5.890479e+07</td>\n",
       "      <td>...</td>\n",
       "      <td>1.729981e+04</td>\n",
       "      <td>7.105164e+03</td>\n",
       "      <td>7.082952e+02</td>\n",
       "      <td>2.986968e+02</td>\n",
       "      <td>1.946507e+00</td>\n",
       "      <td>1.632270e+00</td>\n",
       "      <td>9.030550e+00</td>\n",
       "      <td>5.588796e+00</td>\n",
       "      <td>1.0</td>\n",
       "      <td>5.890479e+07</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>std</th>\n",
       "      <td>0.0</td>\n",
       "      <td>4.640976e-02</td>\n",
       "      <td>0.0</td>\n",
       "      <td>7.090651e+05</td>\n",
       "      <td>0.0</td>\n",
       "      <td>3.997485e+07</td>\n",
       "      <td>3.997481e+04</td>\n",
       "      <td>7.090782e+08</td>\n",
       "      <td>7.090782e+05</td>\n",
       "      <td>3.531791e+07</td>\n",
       "      <td>...</td>\n",
       "      <td>2.771698e+04</td>\n",
       "      <td>1.481242e+04</td>\n",
       "      <td>7.240367e+02</td>\n",
       "      <td>5.977433e+02</td>\n",
       "      <td>3.211679e+00</td>\n",
       "      <td>3.208334e+00</td>\n",
       "      <td>3.387427e+01</td>\n",
       "      <td>2.379983e+01</td>\n",
       "      <td>0.0</td>\n",
       "      <td>3.531791e+07</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>min</th>\n",
       "      <td>1.0</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.616660e+09</td>\n",
       "      <td>120.0</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>1.616660e+12</td>\n",
       "      <td>1.616660e+09</td>\n",
       "      <td>2.293398e+06</td>\n",
       "      <td>...</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>1.0</td>\n",
       "      <td>2.293398e+06</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25%</th>\n",
       "      <td>1.0</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.616673e+09</td>\n",
       "      <td>120.0</td>\n",
       "      <td>4.610000e+02</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>1.616673e+12</td>\n",
       "      <td>1.616673e+09</td>\n",
       "      <td>5.345536e+06</td>\n",
       "      <td>...</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>1.0</td>\n",
       "      <td>5.345536e+06</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>50%</th>\n",
       "      <td>1.0</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.618222e+09</td>\n",
       "      <td>120.0</td>\n",
       "      <td>2.998000e+04</td>\n",
       "      <td>2.900000e+01</td>\n",
       "      <td>1.618222e+12</td>\n",
       "      <td>1.618222e+09</td>\n",
       "      <td>7.978476e+07</td>\n",
       "      <td>...</td>\n",
       "      <td>1.024000e+03</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>1.0</td>\n",
       "      <td>7.978476e+07</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>75%</th>\n",
       "      <td>1.0</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.618232e+09</td>\n",
       "      <td>120.0</td>\n",
       "      <td>1.373936e+07</td>\n",
       "      <td>1.373900e+04</td>\n",
       "      <td>1.618232e+12</td>\n",
       "      <td>1.618232e+09</td>\n",
       "      <td>8.283673e+07</td>\n",
       "      <td>...</td>\n",
       "      <td>6.424000e+04</td>\n",
       "      <td>5.010000e+02</td>\n",
       "      <td>1.460000e+03</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>7.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>1.0</td>\n",
       "      <td>8.283673e+07</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>max</th>\n",
       "      <td>1.0</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.618262e+09</td>\n",
       "      <td>120.0</td>\n",
       "      <td>1.199999e+08</td>\n",
       "      <td>1.199990e+05</td>\n",
       "      <td>1.618263e+12</td>\n",
       "      <td>1.618263e+09</td>\n",
       "      <td>8.588870e+07</td>\n",
       "      <td>...</td>\n",
       "      <td>6.553500e+04</td>\n",
       "      <td>6.553500e+04</td>\n",
       "      <td>8.974000e+03</td>\n",
       "      <td>6.547500e+04</td>\n",
       "      <td>1.400000e+01</td>\n",
       "      <td>1.400000e+01</td>\n",
       "      <td>2.530000e+02</td>\n",
       "      <td>2.530000e+02</td>\n",
       "      <td>1.0</td>\n",
       "      <td>8.588870e+07</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>8 rows × 43 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "       BIFLOW_DIRECTION     DIRECTION  FIREWALL_EVENT  FIRST_SWITCHED  \\\n",
       "count        12207873.0  1.220787e+07      12207873.0    1.220787e+07   \n",
       "mean                1.0  2.158525e-03             0.0    1.617770e+09   \n",
       "std                 0.0  4.640976e-02             0.0    7.090651e+05   \n",
       "min                 1.0  0.000000e+00             0.0    1.616660e+09   \n",
       "25%                 1.0  0.000000e+00             0.0    1.616673e+09   \n",
       "50%                 1.0  0.000000e+00             0.0    1.618222e+09   \n",
       "75%                 1.0  0.000000e+00             0.0    1.618232e+09   \n",
       "max                 1.0  1.000000e+00             0.0    1.618262e+09   \n",
       "\n",
       "       FLOW_ACTIVE_TIMEOUT  FLOW_DURATION_MICROSECONDS  \\\n",
       "count           12207873.0                1.220787e+07   \n",
       "mean                 120.0                2.162737e+07   \n",
       "std                    0.0                3.997485e+07   \n",
       "min                  120.0                0.000000e+00   \n",
       "25%                  120.0                4.610000e+02   \n",
       "50%                  120.0                2.998000e+04   \n",
       "75%                  120.0                1.373936e+07   \n",
       "max                  120.0                1.199999e+08   \n",
       "\n",
       "       FLOW_DURATION_MILLISECONDS  FLOW_END_MILLISECONDS  FLOW_END_SEC  \\\n",
       "count                1.220787e+07           1.220787e+07  1.220787e+07   \n",
       "mean                 2.162695e+04           1.617770e+12  1.617770e+09   \n",
       "std                  3.997481e+04           7.090782e+08  7.090782e+05   \n",
       "min                  0.000000e+00           1.616660e+12  1.616660e+09   \n",
       "25%                  0.000000e+00           1.616673e+12  1.616673e+09   \n",
       "50%                  2.900000e+01           1.618222e+12  1.618222e+09   \n",
       "75%                  1.373900e+04           1.618232e+12  1.618232e+09   \n",
       "max                  1.199990e+05           1.618263e+12  1.618263e+09   \n",
       "\n",
       "            FLOW_ID  ...  TCP_WIN_MIN_IN  TCP_WIN_MIN_OUT  TCP_WIN_MSS_IN  \\\n",
       "count  1.220787e+07  ...    1.220787e+07     1.220787e+07    1.220787e+07   \n",
       "mean   5.890479e+07  ...    1.729981e+04     7.105164e+03    7.082952e+02   \n",
       "std    3.531791e+07  ...    2.771698e+04     1.481242e+04    7.240367e+02   \n",
       "min    2.293398e+06  ...    0.000000e+00     0.000000e+00    0.000000e+00   \n",
       "25%    5.345536e+06  ...    0.000000e+00     0.000000e+00    0.000000e+00   \n",
       "50%    7.978476e+07  ...    1.024000e+03     0.000000e+00    0.000000e+00   \n",
       "75%    8.283673e+07  ...    6.424000e+04     5.010000e+02    1.460000e+03   \n",
       "max    8.588870e+07  ...    6.553500e+04     6.553500e+04    8.974000e+03   \n",
       "\n",
       "       TCP_WIN_MSS_OUT  TCP_WIN_SCALE_IN  TCP_WIN_SCALE_OUT       SRC_TOS  \\\n",
       "count     1.220787e+07      1.220787e+07       1.220787e+07  1.220787e+07   \n",
       "mean      2.986968e+02      1.946507e+00       1.632270e+00  9.030550e+00   \n",
       "std       5.977433e+02      3.211679e+00       3.208334e+00  3.387427e+01   \n",
       "min       0.000000e+00      0.000000e+00       0.000000e+00  0.000000e+00   \n",
       "25%       0.000000e+00      0.000000e+00       0.000000e+00  0.000000e+00   \n",
       "50%       0.000000e+00      0.000000e+00       0.000000e+00  0.000000e+00   \n",
       "75%       0.000000e+00      7.000000e+00       0.000000e+00  0.000000e+00   \n",
       "max       6.547500e+04      1.400000e+01       1.400000e+01  2.530000e+02   \n",
       "\n",
       "            DST_TOS  SAMPLING_INTERVAL  TOTAL_FLOWS_EXP  \n",
       "count  1.220787e+07         12207873.0     1.220787e+07  \n",
       "mean   5.588796e+00                1.0     5.890479e+07  \n",
       "std    2.379983e+01                0.0     3.531791e+07  \n",
       "min    0.000000e+00                1.0     2.293398e+06  \n",
       "25%    0.000000e+00                1.0     5.345536e+06  \n",
       "50%    0.000000e+00                1.0     7.978476e+07  \n",
       "75%    0.000000e+00                1.0     8.283673e+07  \n",
       "max    2.530000e+02                1.0     8.588870e+07  \n",
       "\n",
       "[8 rows x 43 columns]"
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df_final.describe()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "4afa0aba",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "BIFLOW_DIRECTION              0\n",
       "DIRECTION                     0\n",
       "DST_TO_SRC_SECOND_BYTES       0\n",
       "FIREWALL_EVENT                0\n",
       "FIRST_SWITCHED                0\n",
       "FLOW_ACTIVE_TIMEOUT           0\n",
       "FLOW_DURATION_MICROSECONDS    0\n",
       "FLOW_DURATION_MILLISECONDS    0\n",
       "FLOW_END_MILLISECONDS         0\n",
       "FLOW_END_SEC                  0\n",
       "FLOW_ID                       0\n",
       "FLOW_INACTIVE_TIMEOUT         0\n",
       "FLOW_START_MILLISECONDS       0\n",
       "FLOW_START_SEC                0\n",
       "FRAME_LENGTH                  0\n",
       "IN_BYTES                      0\n",
       "IN_PKTS                       0\n",
       "IPV4_DST_ADDR                 0\n",
       "IPV4_SRC_ADDR                 0\n",
       "L4_DST_PORT                   0\n",
       "L4_SRC_PORT                   0\n",
       "LAST_SWITCHED                 0\n",
       "MAX_IP_PKT_LEN                0\n",
       "MIN_IP_PKT_LEN                0\n",
       "OOORDER_IN_PKTS               0\n",
       "OOORDER_OUT_PKTS              0\n",
       "OUT_BYTES                     0\n",
       "OUT_PKTS                      0\n",
       "PROTOCOL                      0\n",
       "PROTOCOL_MAP                  0\n",
       "RETRANSMITTED_IN_BYTES        0\n",
       "RETRANSMITTED_IN_PKTS         0\n",
       "RETRANSMITTED_OUT_BYTES       0\n",
       "RETRANSMITTED_OUT_PKTS        0\n",
       "SRC_TO_DST_SECOND_BYTES       0\n",
       "TCP_FLAGS                     0\n",
       "TCP_WIN_MAX_IN                0\n",
       "TCP_WIN_MAX_OUT               0\n",
       "TCP_WIN_MIN_IN                0\n",
       "TCP_WIN_MIN_OUT               0\n",
       "TCP_WIN_MSS_IN                0\n",
       "TCP_WIN_MSS_OUT               0\n",
       "TCP_WIN_SCALE_IN              0\n",
       "TCP_WIN_SCALE_OUT             0\n",
       "SRC_TOS                       0\n",
       "DST_TOS                       0\n",
       "L7_PROTO_NAME                 0\n",
       "SAMPLING_INTERVAL             0\n",
       "TOTAL_FLOWS_EXP               0\n",
       "LABEL                         0\n",
       "dtype: int64"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df_final.isnull().sum()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "id": "fd287144",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "BIFLOW_DIRECTION               int64\n",
       "DIRECTION                      int64\n",
       "DST_TO_SRC_SECOND_BYTES       object\n",
       "FIREWALL_EVENT                 int64\n",
       "FIRST_SWITCHED                 int64\n",
       "FLOW_ACTIVE_TIMEOUT            int64\n",
       "FLOW_DURATION_MICROSECONDS     int64\n",
       "FLOW_DURATION_MILLISECONDS     int64\n",
       "FLOW_END_MILLISECONDS          int64\n",
       "FLOW_END_SEC                   int64\n",
       "FLOW_ID                        int64\n",
       "FLOW_INACTIVE_TIMEOUT          int64\n",
       "FLOW_START_MILLISECONDS        int64\n",
       "FLOW_START_SEC                 int64\n",
       "FRAME_LENGTH                   int64\n",
       "IN_BYTES                       int64\n",
       "IN_PKTS                        int64\n",
       "IPV4_DST_ADDR                 object\n",
       "IPV4_SRC_ADDR                 object\n",
       "L4_DST_PORT                    int64\n",
       "L4_SRC_PORT                    int64\n",
       "LAST_SWITCHED                  int64\n",
       "MAX_IP_PKT_LEN                 int64\n",
       "MIN_IP_PKT_LEN                 int64\n",
       "OOORDER_IN_PKTS                int64\n",
       "OOORDER_OUT_PKTS               int64\n",
       "OUT_BYTES                      int64\n",
       "OUT_PKTS                       int64\n",
       "PROTOCOL                       int64\n",
       "PROTOCOL_MAP                  object\n",
       "RETRANSMITTED_IN_BYTES         int64\n",
       "RETRANSMITTED_IN_PKTS          int64\n",
       "RETRANSMITTED_OUT_BYTES        int64\n",
       "RETRANSMITTED_OUT_PKTS         int64\n",
       "SRC_TO_DST_SECOND_BYTES       object\n",
       "TCP_FLAGS                      int64\n",
       "TCP_WIN_MAX_IN                 int64\n",
       "TCP_WIN_MAX_OUT                int64\n",
       "TCP_WIN_MIN_IN                 int64\n",
       "TCP_WIN_MIN_OUT                int64\n",
       "TCP_WIN_MSS_IN                 int64\n",
       "TCP_WIN_MSS_OUT                int64\n",
       "TCP_WIN_SCALE_IN               int64\n",
       "TCP_WIN_SCALE_OUT              int64\n",
       "SRC_TOS                        int64\n",
       "DST_TOS                        int64\n",
       "L7_PROTO_NAME                 object\n",
       "SAMPLING_INTERVAL              int64\n",
       "TOTAL_FLOWS_EXP                int64\n",
       "LABEL                         object\n",
       "dtype: object"
      ]
     },
     "execution_count": 10,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df_final.dtypes"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "bdb42b4e",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "BIFLOW_DIRECTION - 1\n",
      "DIRECTION - 2\n",
      "DST_TO_SRC_SECOND_BYTES - 569243\n",
      "FIREWALL_EVENT - 1\n",
      "FIRST_SWITCHED - 101845\n",
      "FLOW_ACTIVE_TIMEOUT - 1\n",
      "FLOW_DURATION_MICROSECONDS - 3285923\n",
      "FLOW_DURATION_MILLISECONDS - 104699\n",
      "FLOW_END_MILLISECONDS - 7829766\n",
      "FLOW_END_SEC - 101898\n",
      "FLOW_ID - 12207873\n",
      "FLOW_INACTIVE_TIMEOUT - 1\n",
      "FLOW_START_MILLISECONDS - 7753548\n",
      "FLOW_START_SEC - 101845\n",
      "FRAME_LENGTH - 1\n",
      "IN_BYTES - 76968\n",
      "IN_PKTS - 8575\n",
      "IPV4_DST_ADDR - 440887\n",
      "IPV4_SRC_ADDR - 88463\n",
      "L4_DST_PORT - 65536\n",
      "L4_SRC_PORT - 65118\n",
      "LAST_SWITCHED - 101898\n",
      "MAX_IP_PKT_LEN - 1\n",
      "MIN_IP_PKT_LEN - 1\n",
      "OOORDER_IN_PKTS - 21\n",
      "OOORDER_OUT_PKTS - 26\n",
      "OUT_BYTES - 91938\n",
      "OUT_PKTS - 9597\n",
      "PROTOCOL - 5\n",
      "PROTOCOL_MAP - 5\n",
      "RETRANSMITTED_IN_BYTES - 2983\n",
      "RETRANSMITTED_IN_PKTS - 446\n",
      "RETRANSMITTED_OUT_BYTES - 8643\n",
      "RETRANSMITTED_OUT_PKTS - 1626\n",
      "SRC_TO_DST_SECOND_BYTES - 3160289\n",
      "TCP_FLAGS - 54\n",
      "TCP_WIN_MAX_IN - 16345\n",
      "TCP_WIN_MAX_OUT - 11685\n",
      "TCP_WIN_MIN_IN - 16455\n",
      "TCP_WIN_MIN_OUT - 10863\n",
      "TCP_WIN_MSS_IN - 135\n",
      "TCP_WIN_MSS_OUT - 63\n",
      "TCP_WIN_SCALE_IN - 15\n",
      "TCP_WIN_SCALE_OUT - 15\n",
      "SRC_TOS - 102\n",
      "DST_TOS - 74\n",
      "L7_PROTO_NAME - 457\n",
      "SAMPLING_INTERVAL - 1\n",
      "TOTAL_FLOWS_EXP - 12207873\n",
      "LABEL - 4\n"
     ]
    }
   ],
   "source": [
    "for i in df_final.columns:\n",
    "    print(i + ' - ' + str(len(df_final[i].unique())))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "91246127",
   "metadata": {},
   "source": [
    "Descartamos columnas con un único valor, ya que si para todos los datos es el mismo valor, no está aportando nueva información al modelo"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "id": "97e01c80",
   "metadata": {},
   "outputs": [],
   "source": [
    "df_final.drop(['SAMPLING_INTERVAL', 'MIN_IP_PKT_LEN', 'MAX_IP_PKT_LEN', 'FRAME_LENGTH', 'FLOW_INACTIVE_TIMEOUT', \n",
    "               'FLOW_ACTIVE_TIMEOUT', 'FIREWALL_EVENT', 'BIFLOW_DIRECTION'\n",
    "              ], axis=1, inplace=True)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "6507e550",
   "metadata": {},
   "source": [
    "Descartamos columnas que están en microsegundos y en segundos, ya que tenemos sus valores correspondientes en milisegundos, dado que la mayor cantidad de características está en milisegundos, se optó por esta medida "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "id": "2d7caab1",
   "metadata": {},
   "outputs": [],
   "source": [
    "df_final.drop(['FLOW_DURATION_MICROSECONDS', 'FLOW_END_SEC', 'FLOW_START_SEC'], axis=1, inplace=True)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "7882c73c",
   "metadata": {},
   "source": [
    "Descartamos algunas columnas de las cuales por el tipo de información contenida se considera dificil de extraer información valiosa"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "id": "d227b958",
   "metadata": {},
   "outputs": [],
   "source": [
    "df_final.drop(['L7_PROTO_NAME', 'SRC_TO_DST_SECOND_BYTES', 'DST_TO_SRC_SECOND_BYTES', \n",
    "               'FLOW_ID', 'IPV4_DST_ADDR', 'IPV4_SRC_ADDR'\n",
    "              ], axis=1, inplace=True)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "id": "a9347560",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "Index(['DIRECTION', 'FIRST_SWITCHED', 'FLOW_DURATION_MILLISECONDS',\n",
       "       'FLOW_END_MILLISECONDS', 'FLOW_START_MILLISECONDS', 'IN_BYTES',\n",
       "       'IN_PKTS', 'L4_DST_PORT', 'L4_SRC_PORT', 'LAST_SWITCHED',\n",
       "       'OOORDER_IN_PKTS', 'OOORDER_OUT_PKTS', 'OUT_BYTES', 'OUT_PKTS',\n",
       "       'RETRANSMITTED_IN_BYTES', 'RETRANSMITTED_IN_PKTS',\n",
       "       'RETRANSMITTED_OUT_BYTES', 'RETRANSMITTED_OUT_PKTS', 'TCP_FLAGS',\n",
       "       'TCP_WIN_MAX_IN', 'TCP_WIN_MAX_OUT', 'TCP_WIN_MIN_IN',\n",
       "       'TCP_WIN_MIN_OUT', 'TCP_WIN_MSS_IN', 'TCP_WIN_MSS_OUT',\n",
       "       'TCP_WIN_SCALE_IN', 'TCP_WIN_SCALE_OUT', 'SRC_TOS', 'DST_TOS',\n",
       "       'TOTAL_FLOWS_EXP', 'LABEL', 'PROTOCOL_MAP_icmp',\n",
       "       'PROTOCOL_MAP_ipv6-icmp', 'PROTOCOL_MAP_tcp', 'PROTOCOL_MAP_udp',\n",
       "       'PROTOCOL_6', 'PROTOCOL_17', 'PROTOCOL_47', 'PROTOCOL_58'],\n",
       "      dtype='object')"
      ]
     },
     "execution_count": 15,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "var_dummies = ['PROTOCOL_MAP', 'PROTOCOL']\n",
    "\n",
    "for i in var_dummies:\n",
    "    # convertir a variables dummies\n",
    "    value_dummies = pd.get_dummies(df_final[i], prefix=i, drop_first=True)\n",
    "    df_final = pd.concat([df_final.drop(i, axis=1), value_dummies], axis=1)\n",
    "\n",
    "df_final.columns"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "id": "1e36c81b",
   "metadata": {},
   "outputs": [],
   "source": [
    "x = df_final.drop(['LABEL'], axis=1)\n",
    "y = df_final['LABEL']"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "6ec998f7",
   "metadata": {},
   "source": [
    "Evaluamos las caracteristicas para ver cuales son las mas apropiadas a utilizar"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "id": "ea38be3b",
   "metadata": {},
   "outputs": [],
   "source": [
    "select = SelectKBest(score_func=chi2, k=15)\n",
    "z = select.fit_transform(x, y)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "id": "b8d552bf",
   "metadata": {},
   "outputs": [],
   "source": [
    "filter = select.get_support()\n",
    "features = list(x.columns)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "id": "9420d676",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "FLOW_DURATION_MILLISECONDS\n",
      "FLOW_END_MILLISECONDS\n",
      "FLOW_START_MILLISECONDS\n",
      "IN_BYTES\n",
      "L4_DST_PORT\n",
      "L4_SRC_PORT\n",
      "OUT_BYTES\n",
      "RETRANSMITTED_OUT_BYTES\n",
      "TCP_WIN_MAX_IN\n",
      "TCP_WIN_MAX_OUT\n",
      "TCP_WIN_MIN_IN\n",
      "TCP_WIN_MIN_OUT\n",
      "TCP_WIN_MSS_IN\n",
      "TCP_WIN_MSS_OUT\n",
      "TOTAL_FLOWS_EXP\n"
     ]
    }
   ],
   "source": [
    "selected_features = []\n",
    "\n",
    "for i in range(0, len(features)):\n",
    "    if filter[i]:\n",
    "        print(features[i])\n",
    "        selected_features.append(features[i])"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ee7cfa8f",
   "metadata": {},
   "source": [
    "Convertimos nuestro target a una variable categórica"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "id": "33339ad5",
   "metadata": {},
   "outputs": [],
   "source": [
    "codes = {'Normal flow': 0, 'SYN Scan - aggressive': 1, 'Denial of Service R-U-Dead-Yet': 2, 'Denial of Service Slowloris': 3}\n",
    "\n",
    "df_final['LABEL'] = df_final['LABEL'].astype('category')\n",
    "df_final['LABEL'] = df_final['LABEL'].map(codes)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "id": "8c9a0e5a",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "0          0\n",
       "1          0\n",
       "2          0\n",
       "3          0\n",
       "4          0\n",
       "          ..\n",
       "8637202    0\n",
       "8637203    0\n",
       "8637204    0\n",
       "8637205    0\n",
       "8637206    0\n",
       "Name: LABEL, Length: 12207873, dtype: category\n",
       "Categories (4, int64): [2, 3, 0, 1]"
      ]
     },
     "execution_count": 21,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df_final['LABEL']"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "id": "4482c1e4",
   "metadata": {},
   "outputs": [],
   "source": [
    "selected_features.append('LABEL')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "id": "969bd1f5",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "['FLOW_DURATION_MILLISECONDS', 'FLOW_END_MILLISECONDS', 'FLOW_START_MILLISECONDS', 'IN_BYTES', 'L4_DST_PORT', 'L4_SRC_PORT', 'OUT_BYTES', 'RETRANSMITTED_OUT_BYTES', 'TCP_WIN_MAX_IN', 'TCP_WIN_MAX_OUT', 'TCP_WIN_MIN_IN', 'TCP_WIN_MIN_OUT', 'TCP_WIN_MSS_IN', 'TCP_WIN_MSS_OUT', 'TOTAL_FLOWS_EXP', 'LABEL']\n"
     ]
    }
   ],
   "source": [
    "print(selected_features)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "id": "f31202d1",
   "metadata": {},
   "outputs": [],
   "source": [
    "df = df_final[selected_features]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "id": "407856a7",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>FLOW_DURATION_MILLISECONDS</th>\n",
       "      <th>FLOW_END_MILLISECONDS</th>\n",
       "      <th>FLOW_START_MILLISECONDS</th>\n",
       "      <th>IN_BYTES</th>\n",
       "      <th>L4_DST_PORT</th>\n",
       "      <th>L4_SRC_PORT</th>\n",
       "      <th>OUT_BYTES</th>\n",
       "      <th>RETRANSMITTED_OUT_BYTES</th>\n",
       "      <th>TCP_WIN_MAX_IN</th>\n",
       "      <th>TCP_WIN_MAX_OUT</th>\n",
       "      <th>TCP_WIN_MIN_IN</th>\n",
       "      <th>TCP_WIN_MIN_OUT</th>\n",
       "      <th>TCP_WIN_MSS_IN</th>\n",
       "      <th>TCP_WIN_MSS_OUT</th>\n",
       "      <th>TOTAL_FLOWS_EXP</th>\n",
       "      <th>LABEL</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>0</td>\n",
       "      <td>1616660040010</td>\n",
       "      <td>1616660040010</td>\n",
       "      <td>44</td>\n",
       "      <td>60541</td>\n",
       "      <td>22351</td>\n",
       "      <td>40</td>\n",
       "      <td>0</td>\n",
       "      <td>1024</td>\n",
       "      <td>0</td>\n",
       "      <td>1024</td>\n",
       "      <td>0</td>\n",
       "      <td>1460</td>\n",
       "      <td>0</td>\n",
       "      <td>2293398</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>0</td>\n",
       "      <td>1616660040068</td>\n",
       "      <td>1616660040068</td>\n",
       "      <td>68</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2293400</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>44</td>\n",
       "      <td>1616660040114</td>\n",
       "      <td>1616660040070</td>\n",
       "      <td>189</td>\n",
       "      <td>24650</td>\n",
       "      <td>443</td>\n",
       "      <td>104</td>\n",
       "      <td>0</td>\n",
       "      <td>122</td>\n",
       "      <td>1634</td>\n",
       "      <td>122</td>\n",
       "      <td>1634</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2293404</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>0</td>\n",
       "      <td>1616660040122</td>\n",
       "      <td>1616660040122</td>\n",
       "      <td>52</td>\n",
       "      <td>8728</td>\n",
       "      <td>61075</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>8192</td>\n",
       "      <td>0</td>\n",
       "      <td>8192</td>\n",
       "      <td>0</td>\n",
       "      <td>1440</td>\n",
       "      <td>0</td>\n",
       "      <td>2293407</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>1</td>\n",
       "      <td>1616660040184</td>\n",
       "      <td>1616660040183</td>\n",
       "      <td>189</td>\n",
       "      <td>443</td>\n",
       "      <td>39762</td>\n",
       "      <td>40</td>\n",
       "      <td>0</td>\n",
       "      <td>502</td>\n",
       "      <td>0</td>\n",
       "      <td>502</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2293409</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "   FLOW_DURATION_MILLISECONDS  FLOW_END_MILLISECONDS  FLOW_START_MILLISECONDS  \\\n",
       "0                           0          1616660040010            1616660040010   \n",
       "1                           0          1616660040068            1616660040068   \n",
       "2                          44          1616660040114            1616660040070   \n",
       "3                           0          1616660040122            1616660040122   \n",
       "4                           1          1616660040184            1616660040183   \n",
       "\n",
       "   IN_BYTES  L4_DST_PORT  L4_SRC_PORT  OUT_BYTES  RETRANSMITTED_OUT_BYTES  \\\n",
       "0        44        60541        22351         40                        0   \n",
       "1        68            0            0          0                        0   \n",
       "2       189        24650          443        104                        0   \n",
       "3        52         8728        61075          0                        0   \n",
       "4       189          443        39762         40                        0   \n",
       "\n",
       "   TCP_WIN_MAX_IN  TCP_WIN_MAX_OUT  TCP_WIN_MIN_IN  TCP_WIN_MIN_OUT  \\\n",
       "0            1024                0            1024                0   \n",
       "1               0                0               0                0   \n",
       "2             122             1634             122             1634   \n",
       "3            8192                0            8192                0   \n",
       "4             502                0             502                0   \n",
       "\n",
       "   TCP_WIN_MSS_IN  TCP_WIN_MSS_OUT  TOTAL_FLOWS_EXP LABEL  \n",
       "0            1460                0          2293398     0  \n",
       "1               0                0          2293400     0  \n",
       "2               0                0          2293404     0  \n",
       "3            1440                0          2293407     0  \n",
       "4               0                0          2293409     0  "
      ]
     },
     "execution_count": 25,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "538081d8",
   "metadata": {},
   "source": [
    "Extraemos un dataset unicamente con las variables que nos interesan"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "id": "1d2e5a88",
   "metadata": {},
   "outputs": [],
   "source": [
    "df.to_csv('datafinal.csv', index = False)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "bda9ac83",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.10"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}