1_Zscore_Anomaly_Detection.ipynb

{
  "nbformat": 4,
  "nbformat_minor": 0,
  "metadata": {
    "colab": {
      "name": "1. Zscore - Anomaly Detection.ipynb",
      "provenance": []
    },
    "kernelspec": {
      "name": "python3",
      "display_name": "Python 3"
    }
  },
  "cells": [
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "AkHj4PQDsRCD"
      },
      "source": [
        "# Anomaly Detection\r\n",
        "\r\n",
        "Anomaly detection is a process for identifying unexpected data, event or behavior that require some examination. It is a well-established field within data science and there is a large number of algorithms to detect anomalies in a dataset depending on data type and business context. \r\n",
        "\r\n",
        "### z-score\r\n",
        "Z-score is probably the simplest algorithm that can rapidly screen candidates for further examination to determine whether they are suspicious or not.\r\n",
        "\r\n",
        "### What is Z-score\r\n",
        "Simply speaking, Z-score is a statistical measure that tells you how far is a data point from the rest of the dataset. In a more technical term, Z-score tells how many standard deviations away a given observation is from the mean.\r\n",
        "For example, a Z score of 2.5 means that the data point is 2.5 standard deviation far from the mean. And since it is far from the center, it’s flagged as an outlier/anomaly."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "klR0XIwcr3Il"
      },
      "source": [
        "import pandas as pd\r\n",
        "import numpy as np\r\n",
        "\r\n",
        "from sklearn import metrics\r\n",
        "from scipy.stats import zscore\r\n",
        "\r\n",
        "\r\n",
        "import io\r\n",
        "import requests\r\n",
        "import os\r\n",
        "\r\n",
        "from sklearn.model_selection import train_test_split\r\n",
        "from sklearn import metrics\r\n",
        "\r\n",
        "from pandas.api.types import is_string_dtype\r\n",
        "from pandas.api.types import is_numeric_dtype\r\n",
        "\r\n",
        "from tensorflow.keras.models import Sequential\r\n",
        "from tensorflow.keras.layers import Dense, Activation\r\n",
        "from tensorflow.keras.callbacks import EarlyStopping\r\n"
      ],
      "execution_count": 35,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "TV_3SCa7MRBe"
      },
      "source": [
        "## Data\r\n"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "X2SSoYU_MxDW",
        "outputId": "016d0c1e-af87-4c7b-bdf3-b32584427e4b"
      },
      "source": [
        "from tensorflow.keras.utils import get_file\r\n",
        "\r\n",
        "try:\r\n",
        "    path = get_file('kddcup.data_10_percent.gz', origin=\r\n",
        "    'http://kdd.ics.uci.edu/databases/kddcup99/kddcup.data_10_percent.gz')\r\n",
        "except:\r\n",
        "    print('Error downloading')\r\n",
        "    raise\r\n",
        "    \r\n",
        "print(path)"
      ],
      "execution_count": 36,
      "outputs": [
        {
          "output_type": "stream",
          "text": [
            "/root/.keras/datasets/kddcup.data_10_percent.gz\n"
          ],
          "name": "stdout"
        }
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/",
          "height": 206
        },
        "id": "QILRBZc4s0zX",
        "outputId": "c7fdf648-7245-4a0a-c295-b60d847fe41e"
      },
      "source": [
        "df = pd.read_csv(path, header=None)\r\n",
        "df.head()"
      ],
      "execution_count": 37,
      "outputs": [
        {
          "output_type": "execute_result",
          "data": {
            "text/html": [
              "<div>\n",
              "<style scoped>\n",
              "    .dataframe tbody tr th:only-of-type {\n",
              "        vertical-align: middle;\n",
              "    }\n",
              "\n",
              "    .dataframe tbody tr th {\n",
              "        vertical-align: top;\n",
              "    }\n",
              "\n",
              "    .dataframe thead th {\n",
              "        text-align: right;\n",
              "    }\n",
              "</style>\n",
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>0</th>\n",
              "      <th>1</th>\n",
              "      <th>2</th>\n",
              "      <th>3</th>\n",
              "      <th>4</th>\n",
              "      <th>5</th>\n",
              "      <th>6</th>\n",
              "      <th>7</th>\n",
              "      <th>8</th>\n",
              "      <th>9</th>\n",
              "      <th>10</th>\n",
              "      <th>11</th>\n",
              "      <th>12</th>\n",
              "      <th>13</th>\n",
              "      <th>14</th>\n",
              "      <th>15</th>\n",
              "      <th>16</th>\n",
              "      <th>17</th>\n",
              "      <th>18</th>\n",
              "      <th>19</th>\n",
              "      <th>20</th>\n",
              "      <th>21</th>\n",
              "      <th>22</th>\n",
              "      <th>23</th>\n",
              "      <th>24</th>\n",
              "      <th>25</th>\n",
              "      <th>26</th>\n",
              "      <th>27</th>\n",
              "      <th>28</th>\n",
              "      <th>29</th>\n",
              "      <th>30</th>\n",
              "      <th>31</th>\n",
              "      <th>32</th>\n",
              "      <th>33</th>\n",
              "      <th>34</th>\n",
              "      <th>35</th>\n",
              "      <th>36</th>\n",
              "      <th>37</th>\n",
              "      <th>38</th>\n",
              "      <th>39</th>\n",
              "      <th>40</th>\n",
              "      <th>41</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0</td>\n",
              "      <td>tcp</td>\n",
              "      <td>http</td>\n",
              "      <td>SF</td>\n",
              "      <td>181</td>\n",
              "      <td>5450</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>8</td>\n",
              "      <td>8</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>9</td>\n",
              "      <td>9</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.11</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>normal.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0</td>\n",
              "      <td>tcp</td>\n",
              "      <td>http</td>\n",
              "      <td>SF</td>\n",
              "      <td>239</td>\n",
              "      <td>486</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>8</td>\n",
              "      <td>8</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>19</td>\n",
              "      <td>19</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.05</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>normal.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0</td>\n",
              "      <td>tcp</td>\n",
              "      <td>http</td>\n",
              "      <td>SF</td>\n",
              "      <td>235</td>\n",
              "      <td>1337</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>8</td>\n",
              "      <td>8</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>29</td>\n",
              "      <td>29</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.03</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>normal.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0</td>\n",
              "      <td>tcp</td>\n",
              "      <td>http</td>\n",
              "      <td>SF</td>\n",
              "      <td>219</td>\n",
              "      <td>1337</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>6</td>\n",
              "      <td>6</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>39</td>\n",
              "      <td>39</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.03</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>normal.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0</td>\n",
              "      <td>tcp</td>\n",
              "      <td>http</td>\n",
              "      <td>SF</td>\n",
              "      <td>217</td>\n",
              "      <td>2032</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>6</td>\n",
              "      <td>6</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>49</td>\n",
              "      <td>49</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.02</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>normal.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>\n",
              "</div>"
            ],
            "text/plain": [
              "   0    1     2   3    4     5   6   ...    35   36   37   38   39   40       41\n",
              "0   0  tcp  http  SF  181  5450   0  ...  0.11  0.0  0.0  0.0  0.0  0.0  normal.\n",
              "1   0  tcp  http  SF  239   486   0  ...  0.05  0.0  0.0  0.0  0.0  0.0  normal.\n",
              "2   0  tcp  http  SF  235  1337   0  ...  0.03  0.0  0.0  0.0  0.0  0.0  normal.\n",
              "3   0  tcp  http  SF  219  1337   0  ...  0.03  0.0  0.0  0.0  0.0  0.0  normal.\n",
              "4   0  tcp  http  SF  217  2032   0  ...  0.02  0.0  0.0  0.0  0.0  0.0  normal.\n",
              "\n",
              "[5 rows x 42 columns]"
            ]
          },
          "metadata": {
            "tags": []
          },
          "execution_count": 37
        }
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "uLbwtJ8uNFwW"
      },
      "source": [
        "df.columns = [\r\n",
        "    'duration',\r\n",
        "    'protocol_type',\r\n",
        "    'service',\r\n",
        "    'flag',\r\n",
        "    'src_bytes',\r\n",
        "    'dst_bytes',\r\n",
        "    'land',\r\n",
        "    'wrong_fragment',\r\n",
        "    'urgent',\r\n",
        "    'hot',\r\n",
        "    'num_failed_logins',\r\n",
        "    'logged_in',\r\n",
        "    'num_compromised',\r\n",
        "    'root_shell',\r\n",
        "    'su_attempted',\r\n",
        "    'num_root',\r\n",
        "    'num_file_creations',\r\n",
        "    'num_shells',\r\n",
        "    'num_access_files',\r\n",
        "    'num_outbound_cmds',\r\n",
        "    'is_host_login',\r\n",
        "    'is_guest_login',\r\n",
        "    'count',\r\n",
        "    'srv_count',\r\n",
        "    'serror_rate',\r\n",
        "    'srv_serror_rate',\r\n",
        "    'rerror_rate',\r\n",
        "    'srv_rerror_rate',\r\n",
        "    'same_srv_rate',\r\n",
        "    'diff_srv_rate',\r\n",
        "    'srv_diff_host_rate',\r\n",
        "    'dst_host_count',\r\n",
        "    'dst_host_srv_count',\r\n",
        "    'dst_host_same_srv_rate',\r\n",
        "    'dst_host_diff_srv_rate',\r\n",
        "    'dst_host_same_src_port_rate',\r\n",
        "    'dst_host_srv_diff_host_rate',\r\n",
        "    'dst_host_serror_rate',\r\n",
        "    'dst_host_srv_serror_rate',\r\n",
        "    'dst_host_rerror_rate',\r\n",
        "    'dst_host_srv_rerror_rate',\r\n",
        "    'outcome'\r\n",
        "]"
      ],
      "execution_count": 38,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/",
          "height": 226
        },
        "id": "Wih4fFWwNQ2N",
        "outputId": "03ebbb8c-f23e-4bd3-8eeb-7b6b37c0f738"
      },
      "source": [
        "df.head()"
      ],
      "execution_count": 39,
      "outputs": [
        {
          "output_type": "execute_result",
          "data": {
            "text/html": [
              "<div>\n",
              "<style scoped>\n",
              "    .dataframe tbody tr th:only-of-type {\n",
              "        vertical-align: middle;\n",
              "    }\n",
              "\n",
              "    .dataframe tbody tr th {\n",
              "        vertical-align: top;\n",
              "    }\n",
              "\n",
              "    .dataframe thead th {\n",
              "        text-align: right;\n",
              "    }\n",
              "</style>\n",
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>duration</th>\n",
              "      <th>protocol_type</th>\n",
              "      <th>service</th>\n",
              "      <th>flag</th>\n",
              "      <th>src_bytes</th>\n",
              "      <th>dst_bytes</th>\n",
              "      <th>land</th>\n",
              "      <th>wrong_fragment</th>\n",
              "      <th>urgent</th>\n",
              "      <th>hot</th>\n",
              "      <th>num_failed_logins</th>\n",
              "      <th>logged_in</th>\n",
              "      <th>num_compromised</th>\n",
              "      <th>root_shell</th>\n",
              "      <th>su_attempted</th>\n",
              "      <th>num_root</th>\n",
              "      <th>num_file_creations</th>\n",
              "      <th>num_shells</th>\n",
              "      <th>num_access_files</th>\n",
              "      <th>num_outbound_cmds</th>\n",
              "      <th>is_host_login</th>\n",
              "      <th>is_guest_login</th>\n",
              "      <th>count</th>\n",
              "      <th>srv_count</th>\n",
              "      <th>serror_rate</th>\n",
              "      <th>srv_serror_rate</th>\n",
              "      <th>rerror_rate</th>\n",
              "      <th>srv_rerror_rate</th>\n",
              "      <th>same_srv_rate</th>\n",
              "      <th>diff_srv_rate</th>\n",
              "      <th>srv_diff_host_rate</th>\n",
              "      <th>dst_host_count</th>\n",
              "      <th>dst_host_srv_count</th>\n",
              "      <th>dst_host_same_srv_rate</th>\n",
              "      <th>dst_host_diff_srv_rate</th>\n",
              "      <th>dst_host_same_src_port_rate</th>\n",
              "      <th>dst_host_srv_diff_host_rate</th>\n",
              "      <th>dst_host_serror_rate</th>\n",
              "      <th>dst_host_srv_serror_rate</th>\n",
              "      <th>dst_host_rerror_rate</th>\n",
              "      <th>dst_host_srv_rerror_rate</th>\n",
              "      <th>outcome</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0</td>\n",
              "      <td>tcp</td>\n",
              "      <td>http</td>\n",
              "      <td>SF</td>\n",
              "      <td>181</td>\n",
              "      <td>5450</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>8</td>\n",
              "      <td>8</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>9</td>\n",
              "      <td>9</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.11</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>normal.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0</td>\n",
              "      <td>tcp</td>\n",
              "      <td>http</td>\n",
              "      <td>SF</td>\n",
              "      <td>239</td>\n",
              "      <td>486</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>8</td>\n",
              "      <td>8</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>19</td>\n",
              "      <td>19</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.05</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>normal.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0</td>\n",
              "      <td>tcp</td>\n",
              "      <td>http</td>\n",
              "      <td>SF</td>\n",
              "      <td>235</td>\n",
              "      <td>1337</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>8</td>\n",
              "      <td>8</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>29</td>\n",
              "      <td>29</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.03</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>normal.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0</td>\n",
              "      <td>tcp</td>\n",
              "      <td>http</td>\n",
              "      <td>SF</td>\n",
              "      <td>219</td>\n",
              "      <td>1337</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>6</td>\n",
              "      <td>6</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>39</td>\n",
              "      <td>39</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.03</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>normal.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0</td>\n",
              "      <td>tcp</td>\n",
              "      <td>http</td>\n",
              "      <td>SF</td>\n",
              "      <td>217</td>\n",
              "      <td>2032</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>6</td>\n",
              "      <td>6</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>49</td>\n",
              "      <td>49</td>\n",
              "      <td>1.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.02</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>0.0</td>\n",
              "      <td>normal.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>\n",
              "</div>"
            ],
            "text/plain": [
              "   duration protocol_type  ... dst_host_srv_rerror_rate  outcome\n",
              "0         0           tcp  ...                      0.0  normal.\n",
              "1         0           tcp  ...                      0.0  normal.\n",
              "2         0           tcp  ...                      0.0  normal.\n",
              "3         0           tcp  ...                      0.0  normal.\n",
              "4         0           tcp  ...                      0.0  normal.\n",
              "\n",
              "[5 rows x 42 columns]"
            ]
          },
          "metadata": {
            "tags": []
          },
          "execution_count": 39
        }
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "kX5iba1gRnuu"
      },
      "source": [
        "### Save the modified dataset:"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "hvtq_KuGs7Yo"
      },
      "source": [
        "#df.to_csv('KDD99_dataset.csv')"
      ],
      "execution_count": 40,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "hsxMdhWEtBr1",
        "outputId": "d4e716a9-1efe-4e72-e2ff-2ac85acd0fba"
      },
      "source": [
        "df.columns"
      ],
      "execution_count": 41,
      "outputs": [
        {
          "output_type": "execute_result",
          "data": {
            "text/plain": [
              "Index(['duration', 'protocol_type', 'service', 'flag', 'src_bytes',\n",
              "       'dst_bytes', 'land', 'wrong_fragment', 'urgent', 'hot',\n",
              "       'num_failed_logins', 'logged_in', 'num_compromised', 'root_shell',\n",
              "       'su_attempted', 'num_root', 'num_file_creations', 'num_shells',\n",
              "       'num_access_files', 'num_outbound_cmds', 'is_host_login',\n",
              "       'is_guest_login', 'count', 'srv_count', 'serror_rate',\n",
              "       'srv_serror_rate', 'rerror_rate', 'srv_rerror_rate', 'same_srv_rate',\n",
              "       'diff_srv_rate', 'srv_diff_host_rate', 'dst_host_count',\n",
              "       'dst_host_srv_count', 'dst_host_same_srv_rate',\n",
              "       'dst_host_diff_srv_rate', 'dst_host_same_src_port_rate',\n",
              "       'dst_host_srv_diff_host_rate', 'dst_host_serror_rate',\n",
              "       'dst_host_srv_serror_rate', 'dst_host_rerror_rate',\n",
              "       'dst_host_srv_rerror_rate', 'outcome'],\n",
              "      dtype='object')"
            ]
          },
          "metadata": {
            "tags": []
          },
          "execution_count": 41
        }
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "ieDsF7BylrB6",
        "outputId": "4d71a393-639b-4a15-830f-f598257a591d"
      },
      "source": [
        "df.shape"
      ],
      "execution_count": 42,
      "outputs": [
        {
          "output_type": "execute_result",
          "data": {
            "text/plain": [
              "(494021, 42)"
            ]
          },
          "metadata": {
            "tags": []
          },
          "execution_count": 42
        }
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "xepENEFLutL4"
      },
      "source": [
        "## Data Analysis"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "U_qH1I9kYmS7",
        "outputId": "2912cf4d-7f5b-45b0-9271-b7847d53f2d6"
      },
      "source": [
        "df.isnull().sum()"
      ],
      "execution_count": 43,
      "outputs": [
        {
          "output_type": "execute_result",
          "data": {
            "text/plain": [
              "duration                       0\n",
              "protocol_type                  0\n",
              "service                        0\n",
              "flag                           0\n",
              "src_bytes                      0\n",
              "dst_bytes                      0\n",
              "land                           0\n",
              "wrong_fragment                 0\n",
              "urgent                         0\n",
              "hot                            0\n",
              "num_failed_logins              0\n",
              "logged_in                      0\n",
              "num_compromised                0\n",
              "root_shell                     0\n",
              "su_attempted                   0\n",
              "num_root                       0\n",
              "num_file_creations             0\n",
              "num_shells                     0\n",
              "num_access_files               0\n",
              "num_outbound_cmds              0\n",
              "is_host_login                  0\n",
              "is_guest_login                 0\n",
              "count                          0\n",
              "srv_count                      0\n",
              "serror_rate                    0\n",
              "srv_serror_rate                0\n",
              "rerror_rate                    0\n",
              "srv_rerror_rate                0\n",
              "same_srv_rate                  0\n",
              "diff_srv_rate                  0\n",
              "srv_diff_host_rate             0\n",
              "dst_host_count                 0\n",
              "dst_host_srv_count             0\n",
              "dst_host_same_srv_rate         0\n",
              "dst_host_diff_srv_rate         0\n",
              "dst_host_same_src_port_rate    0\n",
              "dst_host_srv_diff_host_rate    0\n",
              "dst_host_serror_rate           0\n",
              "dst_host_srv_serror_rate       0\n",
              "dst_host_rerror_rate           0\n",
              "dst_host_srv_rerror_rate       0\n",
              "outcome                        0\n",
              "dtype: int64"
            ]
          },
          "metadata": {
            "tags": []
          },
          "execution_count": 43
        }
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "9dhbeb8EN6Qc"
      },
      "source": [
        "### analyze_column()\r\n",
        "Since, there are a lot of columns to understand we are building as custom function\r\n",
        "\r\n",
        "This function takes a column name (in quotes eg. 'column name')\r\n",
        "\r\n",
        "And, returns:\r\n",
        "- A sample of the data.\r\n",
        "- If the column's data is Numerical or String.\r\n",
        "- Types of categories.\r\n",
        "- Count of all the categories.\r\n",
        "\r\n",
        "With this function we can easily analyse all the columns and understand the data.\r\n"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "tsI14S6du9zv"
      },
      "source": [
        "def analyze_column(col):\r\n",
        "  \r\n",
        "  categories = df[col].unique()\r\n",
        "  count = df[col].value_counts()\r\n",
        "  ucount = df[col].nunique()\r\n",
        "\r\n",
        "  print(df[col].sample(10))\r\n",
        "  if is_numeric_dtype(df[col]) == True:\r\n",
        "    print(\"\\n\\n\\nNumeric DataType\")\r\n",
        "  elif is_string_dtype(df[col]) == True:\r\n",
        "    print(\"\\n\\n\\nString DataType\")\r\n",
        "  else:\r\n",
        "    print(\"Unknown Datatype\")\r\n",
        "\r\n",
        "  print(\"\\n\\n\\nCategories:\",categories)\r\n",
        "  print(\"\\n\\n\\nNumber of Categories:\",ucount)\r\n",
        "  print(\"\\nCounts:\\n\",count)"
      ],
      "execution_count": 44,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "SiYHm2YEOTaV",
        "outputId": "6a8888f7-be5b-46cd-b3bc-8290af69280c"
      },
      "source": [
        "analyze_column('num_file_creations')"
      ],
      "execution_count": 45,
      "outputs": [
        {
          "output_type": "stream",
          "text": [
            "370527    0\n",
            "278580    0\n",
            "476070    0\n",
            "229961    0\n",
            "136647    0\n",
            "314089    0\n",
            "319715    0\n",
            "416625    0\n",
            "441253    0\n",
            "339780    0\n",
            "Name: num_file_creations, dtype: int64\n",
            "\n",
            "\n",
            "\n",
            "Numeric DataType\n",
            "\n",
            "\n",
            "\n",
            "Categories: [ 0  1  2  4 15  9 16 28 10 21 14  5  7  8 12 25 22 20]\n",
            "\n",
            "\n",
            "\n",
            "Number of Categories: 18\n",
            "\n",
            "Counts:\n",
            " 0     493756\n",
            "1        207\n",
            "2         36\n",
            "4          7\n",
            "16         2\n",
            "9          1\n",
            "5          1\n",
            "7          1\n",
            "8          1\n",
            "28         1\n",
            "25         1\n",
            "12         1\n",
            "14         1\n",
            "15         1\n",
            "20         1\n",
            "21         1\n",
            "22         1\n",
            "10         1\n",
            "Name: num_file_creations, dtype: int64\n"
          ],
          "name": "stdout"
        }
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "jZ96iz7Q1AsE",
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "outputId": "d3c5f722-58a0-449a-fac9-967d218fda1e"
      },
      "source": [
        "df.info()"
      ],
      "execution_count": 46,
      "outputs": [
        {
          "output_type": "stream",
          "text": [
            "<class 'pandas.core.frame.DataFrame'>\n",
            "RangeIndex: 494021 entries, 0 to 494020\n",
            "Data columns (total 42 columns):\n",
            " #   Column                       Non-Null Count   Dtype  \n",
            "---  ------                       --------------   -----  \n",
            " 0   duration                     494021 non-null  int64  \n",
            " 1   protocol_type                494021 non-null  object \n",
            " 2   service                      494021 non-null  object \n",
            " 3   flag                         494021 non-null  object \n",
            " 4   src_bytes                    494021 non-null  int64  \n",
            " 5   dst_bytes                    494021 non-null  int64  \n",
            " 6   land                         494021 non-null  int64  \n",
            " 7   wrong_fragment               494021 non-null  int64  \n",
            " 8   urgent                       494021 non-null  int64  \n",
            " 9   hot                          494021 non-null  int64  \n",
            " 10  num_failed_logins            494021 non-null  int64  \n",
            " 11  logged_in                    494021 non-null  int64  \n",
            " 12  num_compromised              494021 non-null  int64  \n",
            " 13  root_shell                   494021 non-null  int64  \n",
            " 14  su_attempted                 494021 non-null  int64  \n",
            " 15  num_root                     494021 non-null  int64  \n",
            " 16  num_file_creations           494021 non-null  int64  \n",
            " 17  num_shells                   494021 non-null  int64  \n",
            " 18  num_access_files             494021 non-null  int64  \n",
            " 19  num_outbound_cmds            494021 non-null  int64  \n",
            " 20  is_host_login                494021 non-null  int64  \n",
            " 21  is_guest_login               494021 non-null  int64  \n",
            " 22  count                        494021 non-null  int64  \n",
            " 23  srv_count                    494021 non-null  int64  \n",
            " 24  serror_rate                  494021 non-null  float64\n",
            " 25  srv_serror_rate              494021 non-null  float64\n",
            " 26  rerror_rate                  494021 non-null  float64\n",
            " 27  srv_rerror_rate              494021 non-null  float64\n",
            " 28  same_srv_rate                494021 non-null  float64\n",
            " 29  diff_srv_rate                494021 non-null  float64\n",
            " 30  srv_diff_host_rate           494021 non-null  float64\n",
            " 31  dst_host_count               494021 non-null  int64  \n",
            " 32  dst_host_srv_count           494021 non-null  int64  \n",
            " 33  dst_host_same_srv_rate       494021 non-null  float64\n",
            " 34  dst_host_diff_srv_rate       494021 non-null  float64\n",
            " 35  dst_host_same_src_port_rate  494021 non-null  float64\n",
            " 36  dst_host_srv_diff_host_rate  494021 non-null  float64\n",
            " 37  dst_host_serror_rate         494021 non-null  float64\n",
            " 38  dst_host_srv_serror_rate     494021 non-null  float64\n",
            " 39  dst_host_rerror_rate         494021 non-null  float64\n",
            " 40  dst_host_srv_rerror_rate     494021 non-null  float64\n",
            " 41  outcome                      494021 non-null  object \n",
            "dtypes: float64(15), int64(23), object(4)\n",
            "memory usage: 158.3+ MB\n"
          ],
          "name": "stdout"
        }
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "g3rJOOh5UQwd"
      },
      "source": [
        "### Encoding features\r\n",
        "From the insights drawn by alaysis of the columns individually, we decide to convert some columns to Z-scores and others to a One Hot Encoding.\r\n"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "YG_433emYOt0"
      },
      "source": [
        "def encode_numeric_zscore(df, name, mean=None, sd=None):\r\n",
        "    if mean is None:\r\n",
        "        mean = df[name].mean()\r\n",
        "\r\n",
        "    if sd is None:\r\n",
        "        sd = df[name].std()\r\n",
        "\r\n",
        "    df[name] = (df[name] - mean) / sd\r\n",
        "\r\n",
        "\r\n",
        "\r\n",
        "def encode_text_dummy(df, name):\r\n",
        "    dummies = pd.get_dummies(df[name])\r\n",
        "    for x in dummies.columns:\r\n",
        "        dummy_name = f\"{name}-{x}\"\r\n",
        "        df[dummy_name] = dummies[x]\r\n",
        "    df.drop(name, axis=1, inplace=True)"
      ],
      "execution_count": 47,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "2k4brIxIUT1d"
      },
      "source": [
        "encode_text_dummy(df, 'protocol_type')\r\n",
        "encode_text_dummy(df, 'service')\r\n",
        "encode_text_dummy(df, 'flag')\r\n",
        "encode_text_dummy(df, 'land')\r\n",
        "encode_text_dummy(df, 'logged_in')\r\n",
        "encode_text_dummy(df, 'is_host_login')\r\n",
        "encode_text_dummy(df, 'is_guest_login')\r\n",
        "\r\n",
        "\r\n",
        "\r\n",
        "encode_numeric_zscore(df, 'duration')\r\n",
        "encode_numeric_zscore(df, 'src_bytes')\r\n",
        "encode_numeric_zscore(df, 'dst_bytes')\r\n",
        "encode_numeric_zscore(df, 'wrong_fragment')\r\n",
        "encode_numeric_zscore(df, 'urgent')\r\n",
        "encode_numeric_zscore(df, 'hot')\r\n",
        "encode_numeric_zscore(df, 'num_failed_logins')\r\n",
        "encode_numeric_zscore(df, 'num_compromised')\r\n",
        "encode_numeric_zscore(df, 'root_shell')\r\n",
        "encode_numeric_zscore(df, 'su_attempted')\r\n",
        "encode_numeric_zscore(df, 'num_root')\r\n",
        "encode_numeric_zscore(df, 'num_file_creations')\r\n",
        "encode_numeric_zscore(df, 'num_shells')\r\n",
        "encode_numeric_zscore(df, 'num_access_files')\r\n",
        "encode_numeric_zscore(df, 'num_outbound_cmds')\r\n",
        "encode_numeric_zscore(df, 'count')\r\n",
        "encode_numeric_zscore(df, 'srv_count')\r\n",
        "encode_numeric_zscore(df, 'serror_rate')\r\n",
        "encode_numeric_zscore(df, 'srv_serror_rate')\r\n",
        "encode_numeric_zscore(df, 'rerror_rate')\r\n",
        "encode_numeric_zscore(df, 'srv_rerror_rate')\r\n",
        "encode_numeric_zscore(df, 'same_srv_rate')\r\n",
        "encode_numeric_zscore(df, 'diff_srv_rate')\r\n",
        "encode_numeric_zscore(df, 'srv_diff_host_rate')\r\n",
        "encode_numeric_zscore(df, 'dst_host_count')\r\n",
        "encode_numeric_zscore(df, 'dst_host_srv_count')\r\n",
        "encode_numeric_zscore(df, 'dst_host_same_srv_rate')\r\n",
        "encode_numeric_zscore(df, 'dst_host_diff_srv_rate')\r\n",
        "encode_numeric_zscore(df, 'dst_host_same_src_port_rate')\r\n",
        "encode_numeric_zscore(df, 'dst_host_srv_diff_host_rate')\r\n",
        "encode_numeric_zscore(df, 'dst_host_serror_rate')\r\n",
        "encode_numeric_zscore(df, 'dst_host_srv_serror_rate')\r\n",
        "encode_numeric_zscore(df, 'dst_host_rerror_rate')\r\n",
        "encode_numeric_zscore(df, 'dst_host_srv_rerror_rate')"
      ],
      "execution_count": 50,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/",
          "height": 273
        },
        "id": "Ax1MC0IhjBsx",
        "outputId": "cf2e04fa-179f-47f7-e92b-b2185bc37423"
      },
      "source": [
        "df.head()"
      ],
      "execution_count": 51,
      "outputs": [
        {
          "output_type": "execute_result",
          "data": {
            "text/html": [
              "<div>\n",
              "<style scoped>\n",
              "    .dataframe tbody tr th:only-of-type {\n",
              "        vertical-align: middle;\n",
              "    }\n",
              "\n",
              "    .dataframe tbody tr th {\n",
              "        vertical-align: top;\n",
              "    }\n",
              "\n",
              "    .dataframe thead th {\n",
              "        text-align: right;\n",
              "    }\n",
              "</style>\n",
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>duration</th>\n",
              "      <th>src_bytes</th>\n",
              "      <th>dst_bytes</th>\n",
              "      <th>wrong_fragment</th>\n",
              "      <th>urgent</th>\n",
              "      <th>hot</th>\n",
              "      <th>num_failed_logins</th>\n",
              "      <th>num_compromised</th>\n",
              "      <th>root_shell</th>\n",
              "      <th>su_attempted</th>\n",
              "      <th>num_root</th>\n",
              "      <th>num_file_creations</th>\n",
              "      <th>num_shells</th>\n",
              "      <th>num_access_files</th>\n",
              "      <th>num_outbound_cmds</th>\n",
              "      <th>count</th>\n",
              "      <th>srv_count</th>\n",
              "      <th>serror_rate</th>\n",
              "      <th>srv_serror_rate</th>\n",
              "      <th>rerror_rate</th>\n",
              "      <th>srv_rerror_rate</th>\n",
              "      <th>same_srv_rate</th>\n",
              "      <th>diff_srv_rate</th>\n",
              "      <th>srv_diff_host_rate</th>\n",
              "      <th>dst_host_count</th>\n",
              "      <th>dst_host_srv_count</th>\n",
              "      <th>dst_host_same_srv_rate</th>\n",
              "      <th>dst_host_diff_srv_rate</th>\n",
              "      <th>dst_host_same_src_port_rate</th>\n",
              "      <th>dst_host_srv_diff_host_rate</th>\n",
              "      <th>dst_host_serror_rate</th>\n",
              "      <th>dst_host_srv_serror_rate</th>\n",
              "      <th>dst_host_rerror_rate</th>\n",
              "      <th>dst_host_srv_rerror_rate</th>\n",
              "      <th>outcome</th>\n",
              "      <th>protocol_type-icmp</th>\n",
              "      <th>protocol_type-tcp</th>\n",
              "      <th>protocol_type-udp</th>\n",
              "      <th>service-IRC</th>\n",
              "      <th>service-X11</th>\n",
              "      <th>...</th>\n",
              "      <th>service-printer</th>\n",
              "      <th>service-private</th>\n",
              "      <th>service-red_i</th>\n",
              "      <th>service-remote_job</th>\n",
              "      <th>service-rje</th>\n",
              "      <th>service-shell</th>\n",
              "      <th>service-smtp</th>\n",
              "      <th>service-sql_net</th>\n",
              "      <th>service-ssh</th>\n",
              "      <th>service-sunrpc</th>\n",
              "      <th>service-supdup</th>\n",
              "      <th>service-systat</th>\n",
              "      <th>service-telnet</th>\n",
              "      <th>service-tftp_u</th>\n",
              "      <th>service-tim_i</th>\n",
              "      <th>service-time</th>\n",
              "      <th>service-urh_i</th>\n",
              "      <th>service-urp_i</th>\n",
              "      <th>service-uucp</th>\n",
              "      <th>service-uucp_path</th>\n",
              "      <th>service-vmnet</th>\n",
              "      <th>service-whois</th>\n",
              "      <th>flag-OTH</th>\n",
              "      <th>flag-REJ</th>\n",
              "      <th>flag-RSTO</th>\n",
              "      <th>flag-RSTOS0</th>\n",
              "      <th>flag-RSTR</th>\n",
              "      <th>flag-S0</th>\n",
              "      <th>flag-S1</th>\n",
              "      <th>flag-S2</th>\n",
              "      <th>flag-S3</th>\n",
              "      <th>flag-SF</th>\n",
              "      <th>flag-SH</th>\n",
              "      <th>land-0</th>\n",
              "      <th>land-1</th>\n",
              "      <th>logged_in-0</th>\n",
              "      <th>logged_in-1</th>\n",
              "      <th>is_host_login-0</th>\n",
              "      <th>is_guest_login-0</th>\n",
              "      <th>is_guest_login-1</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>-0.067792</td>\n",
              "      <td>-0.002879</td>\n",
              "      <td>0.138664</td>\n",
              "      <td>-0.04772</td>\n",
              "      <td>-0.002571</td>\n",
              "      <td>-0.044136</td>\n",
              "      <td>-0.009782</td>\n",
              "      <td>-0.005679</td>\n",
              "      <td>-0.010552</td>\n",
              "      <td>-0.004676</td>\n",
              "      <td>-0.00564</td>\n",
              "      <td>-0.011232</td>\n",
              "      <td>-0.009919</td>\n",
              "      <td>-0.027632</td>\n",
              "      <td>NaN</td>\n",
              "      <td>-1.521415</td>\n",
              "      <td>-1.156639</td>\n",
              "      <td>-0.464089</td>\n",
              "      <td>-0.46352</td>\n",
              "      <td>-0.24796</td>\n",
              "      <td>-0.248631</td>\n",
              "      <td>0.536987</td>\n",
              "      <td>-0.255243</td>\n",
              "      <td>-0.203633</td>\n",
              "      <td>-3.451532</td>\n",
              "      <td>-1.694313</td>\n",
              "      <td>0.599396</td>\n",
              "      <td>-0.282866</td>\n",
              "      <td>-1.022076</td>\n",
              "      <td>-0.158629</td>\n",
              "      <td>-0.464417</td>\n",
              "      <td>-0.463202</td>\n",
              "      <td>-0.252039</td>\n",
              "      <td>-0.249464</td>\n",
              "      <td>normal.</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>...</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>1</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>-0.067792</td>\n",
              "      <td>-0.002820</td>\n",
              "      <td>-0.011578</td>\n",
              "      <td>-0.04772</td>\n",
              "      <td>-0.002571</td>\n",
              "      <td>-0.044136</td>\n",
              "      <td>-0.009782</td>\n",
              "      <td>-0.005679</td>\n",
              "      <td>-0.010552</td>\n",
              "      <td>-0.004676</td>\n",
              "      <td>-0.00564</td>\n",
              "      <td>-0.011232</td>\n",
              "      <td>-0.009919</td>\n",
              "      <td>-0.027632</td>\n",
              "      <td>NaN</td>\n",
              "      <td>-1.521415</td>\n",
              "      <td>-1.156639</td>\n",
              "      <td>-0.464089</td>\n",
              "      <td>-0.46352</td>\n",
              "      <td>-0.24796</td>\n",
              "      <td>-0.248631</td>\n",
              "      <td>0.536987</td>\n",
              "      <td>-0.255243</td>\n",
              "      <td>-0.203633</td>\n",
              "      <td>-3.297081</td>\n",
              "      <td>-1.600009</td>\n",
              "      <td>0.599396</td>\n",
              "      <td>-0.282866</td>\n",
              "      <td>-1.146736</td>\n",
              "      <td>-0.158629</td>\n",
              "      <td>-0.464417</td>\n",
              "      <td>-0.463202</td>\n",
              "      <td>-0.252039</td>\n",
              "      <td>-0.249464</td>\n",
              "      <td>normal.</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>...</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>1</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>-0.067792</td>\n",
              "      <td>-0.002824</td>\n",
              "      <td>0.014179</td>\n",
              "      <td>-0.04772</td>\n",
              "      <td>-0.002571</td>\n",
              "      <td>-0.044136</td>\n",
              "      <td>-0.009782</td>\n",
              "      <td>-0.005679</td>\n",
              "      <td>-0.010552</td>\n",
              "      <td>-0.004676</td>\n",
              "      <td>-0.00564</td>\n",
              "      <td>-0.011232</td>\n",
              "      <td>-0.009919</td>\n",
              "      <td>-0.027632</td>\n",
              "      <td>NaN</td>\n",
              "      <td>-1.521415</td>\n",
              "      <td>-1.156639</td>\n",
              "      <td>-0.464089</td>\n",
              "      <td>-0.46352</td>\n",
              "      <td>-0.24796</td>\n",
              "      <td>-0.248631</td>\n",
              "      <td>0.536987</td>\n",
              "      <td>-0.255243</td>\n",
              "      <td>-0.203633</td>\n",
              "      <td>-3.142630</td>\n",
              "      <td>-1.505706</td>\n",
              "      <td>0.599396</td>\n",
              "      <td>-0.282866</td>\n",
              "      <td>-1.188290</td>\n",
              "      <td>-0.158629</td>\n",
              "      <td>-0.464417</td>\n",
              "      <td>-0.463202</td>\n",
              "      <td>-0.252039</td>\n",
              "      <td>-0.249464</td>\n",
              "      <td>normal.</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>...</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>1</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>-0.067792</td>\n",
              "      <td>-0.002840</td>\n",
              "      <td>0.014179</td>\n",
              "      <td>-0.04772</td>\n",
              "      <td>-0.002571</td>\n",
              "      <td>-0.044136</td>\n",
              "      <td>-0.009782</td>\n",
              "      <td>-0.005679</td>\n",
              "      <td>-0.010552</td>\n",
              "      <td>-0.004676</td>\n",
              "      <td>-0.00564</td>\n",
              "      <td>-0.011232</td>\n",
              "      <td>-0.009919</td>\n",
              "      <td>-0.027632</td>\n",
              "      <td>NaN</td>\n",
              "      <td>-1.530798</td>\n",
              "      <td>-1.164758</td>\n",
              "      <td>-0.464089</td>\n",
              "      <td>-0.46352</td>\n",
              "      <td>-0.24796</td>\n",
              "      <td>-0.248631</td>\n",
              "      <td>0.536987</td>\n",
              "      <td>-0.255243</td>\n",
              "      <td>-0.203633</td>\n",
              "      <td>-2.988179</td>\n",
              "      <td>-1.411402</td>\n",
              "      <td>0.599396</td>\n",
              "      <td>-0.282866</td>\n",
              "      <td>-1.188290</td>\n",
              "      <td>-0.158629</td>\n",
              "      <td>-0.464417</td>\n",
              "      <td>-0.463202</td>\n",
              "      <td>-0.252039</td>\n",
              "      <td>-0.249464</td>\n",
              "      <td>normal.</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>...</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>1</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>-0.067792</td>\n",
              "      <td>-0.002842</td>\n",
              "      <td>0.035214</td>\n",
              "      <td>-0.04772</td>\n",
              "      <td>-0.002571</td>\n",
              "      <td>-0.044136</td>\n",
              "      <td>-0.009782</td>\n",
              "      <td>-0.005679</td>\n",
              "      <td>-0.010552</td>\n",
              "      <td>-0.004676</td>\n",
              "      <td>-0.00564</td>\n",
              "      <td>-0.011232</td>\n",
              "      <td>-0.009919</td>\n",
              "      <td>-0.027632</td>\n",
              "      <td>NaN</td>\n",
              "      <td>-1.530798</td>\n",
              "      <td>-1.164758</td>\n",
              "      <td>-0.464089</td>\n",
              "      <td>-0.46352</td>\n",
              "      <td>-0.24796</td>\n",
              "      <td>-0.248631</td>\n",
              "      <td>0.536987</td>\n",
              "      <td>-0.255243</td>\n",
              "      <td>-0.203633</td>\n",
              "      <td>-2.833728</td>\n",
              "      <td>-1.317098</td>\n",
              "      <td>0.599396</td>\n",
              "      <td>-0.282866</td>\n",
              "      <td>-1.209066</td>\n",
              "      <td>-0.158629</td>\n",
              "      <td>-0.464417</td>\n",
              "      <td>-0.463202</td>\n",
              "      <td>-0.252039</td>\n",
              "      <td>-0.249464</td>\n",
              "      <td>normal.</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>...</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "      <td>0</td>\n",
              "      <td>1</td>\n",
              "      <td>1</td>\n",
              "      <td>1</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>\n",
              "<p>5 rows × 122 columns</p>\n",
              "</div>"
            ],
            "text/plain": [
              "   duration  src_bytes  ...  is_guest_login-0  is_guest_login-1\n",
              "0 -0.067792  -0.002879  ...                 1                 0\n",
              "1 -0.067792  -0.002820  ...                 1                 0\n",
              "2 -0.067792  -0.002824  ...                 1                 0\n",
              "3 -0.067792  -0.002840  ...                 1                 0\n",
              "4 -0.067792  -0.002842  ...                 1                 0\n",
              "\n",
              "[5 rows x 122 columns]"
            ]
          },
          "metadata": {
            "tags": []
          },
          "execution_count": 51
        }
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "RKydcnJKayFx"
      },
      "source": [
        "df.dropna(inplace=True,axis=1)"
      ],
      "execution_count": 52,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "j9pkskj_a2Uo"
      },
      "source": [
        "# Convert to numpy - Classification\r\n",
        "x_columns = df.columns.drop('outcome')\r\n",
        "x = df[x_columns].values\r\n",
        "\r\n",
        "dummies = pd.get_dummies(df['outcome']) # Classification\r\n",
        "outcomes = dummies.columns\r\n",
        "num_classes = len(outcomes)\r\n",
        "\r\n",
        "y = dummies.values"
      ],
      "execution_count": 53,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "0WNzhd2VbL-B",
        "outputId": "0b0bf18b-f7fa-43b1-e70c-b4351fd64c79"
      },
      "source": [
        "df.groupby('outcome')['outcome'].count()"
      ],
      "execution_count": 54,
      "outputs": [
        {
          "output_type": "execute_result",
          "data": {
            "text/plain": [
              "outcome\n",
              "back.                 2203\n",
              "buffer_overflow.        30\n",
              "ftp_write.               8\n",
              "guess_passwd.           53\n",
              "imap.                   12\n",
              "ipsweep.              1247\n",
              "land.                   21\n",
              "loadmodule.              9\n",
              "multihop.                7\n",
              "neptune.            107201\n",
              "nmap.                  231\n",
              "normal.              97278\n",
              "perl.                    3\n",
              "phf.                     4\n",
              "pod.                   264\n",
              "portsweep.            1040\n",
              "rootkit.                10\n",
              "satan.                1589\n",
              "smurf.              280790\n",
              "spy.                     2\n",
              "teardrop.              979\n",
              "warezclient.          1020\n",
              "warezmaster.            20\n",
              "Name: outcome, dtype: int64"
            ]
          },
          "metadata": {
            "tags": []
          },
          "execution_count": 54
        }
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "iIAh17QabOUS"
      },
      "source": [
        "## Neural Network"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "mrTOBFRobTdC",
        "outputId": "2d0f7a36-e7ca-4f78-b4ff-14e089549336"
      },
      "source": [
        "x_train, x_test, y_train, y_test = train_test_split(x, y, test_size=0.2, random_state=42)\r\n",
        "\r\n",
        "# Create neural net\r\n",
        "model = Sequential()\r\n",
        "model.add(Dense(10, input_dim=x.shape[1], activation='relu'))\r\n",
        "model.add(Dense(50, input_dim=x.shape[1], activation='relu'))\r\n",
        "model.add(Dense(10, input_dim=x.shape[1], activation='relu'))\r\n",
        "\r\n",
        "model.add(Dense(1, kernel_initializer='normal'))\r\n",
        "\r\n",
        "model.add(Dense(y.shape[1],activation='softmax'))\r\n",
        "\r\n",
        "model.compile(loss='categorical_crossentropy',metrics=['accuracy'], optimizer='adam')\r\n",
        "monitor = EarlyStopping(monitor='val_loss', min_delta=1e-3, patience=5, verbose=1, mode='auto',restore_best_weights=True)\r\n",
        "model.fit(x_train,y_train,validation_data=(x_test,y_test), callbacks=[monitor],verbose=2,epochs=100)"
      ],
      "execution_count": 55,
      "outputs": [
        {
          "output_type": "stream",
          "text": [
            "Epoch 1/100\n",
            "12351/12351 - 32s - loss: 0.1461 - accuracy: 0.9654 - val_loss: 0.0661 - val_accuracy: 0.9831\n",
            "Epoch 2/100\n",
            "12351/12351 - 29s - loss: 0.0537 - accuracy: 0.9866 - val_loss: 0.0489 - val_accuracy: 0.9895\n",
            "Epoch 3/100\n",
            "12351/12351 - 29s - loss: 0.0472 - accuracy: 0.9895 - val_loss: 0.0471 - val_accuracy: 0.9890\n",
            "Epoch 4/100\n",
            "12351/12351 - 29s - loss: 0.0433 - accuracy: 0.9904 - val_loss: 0.0466 - val_accuracy: 0.9902\n",
            "Epoch 5/100\n",
            "12351/12351 - 29s - loss: 0.0414 - accuracy: 0.9907 - val_loss: 0.0407 - val_accuracy: 0.9901\n",
            "Epoch 6/100\n",
            "12351/12351 - 29s - loss: 0.0385 - accuracy: 0.9912 - val_loss: 0.0373 - val_accuracy: 0.9921\n",
            "Epoch 7/100\n",
            "12351/12351 - 29s - loss: 0.0387 - accuracy: 0.9922 - val_loss: 0.0353 - val_accuracy: 0.9929\n",
            "Epoch 8/100\n",
            "12351/12351 - 28s - loss: 0.0368 - accuracy: 0.9925 - val_loss: 0.0354 - val_accuracy: 0.9926\n",
            "Epoch 9/100\n",
            "12351/12351 - 28s - loss: 0.0416 - accuracy: 0.9928 - val_loss: 0.0365 - val_accuracy: 0.9922\n",
            "Epoch 10/100\n",
            "12351/12351 - 28s - loss: 0.0365 - accuracy: 0.9929 - val_loss: 0.0363 - val_accuracy: 0.9930\n",
            "Epoch 11/100\n",
            "12351/12351 - 28s - loss: 0.0336 - accuracy: 0.9930 - val_loss: 0.0324 - val_accuracy: 0.9932\n",
            "Epoch 12/100\n",
            "12351/12351 - 28s - loss: 0.0329 - accuracy: 0.9931 - val_loss: 0.0379 - val_accuracy: 0.9931\n",
            "Epoch 13/100\n",
            "12351/12351 - 28s - loss: 0.0327 - accuracy: 0.9932 - val_loss: 0.0350 - val_accuracy: 0.9932\n",
            "Epoch 14/100\n",
            "12351/12351 - 28s - loss: 0.0320 - accuracy: 0.9935 - val_loss: 0.0326 - val_accuracy: 0.9930\n",
            "Epoch 15/100\n",
            "12351/12351 - 27s - loss: 0.0322 - accuracy: 0.9936 - val_loss: 0.0338 - val_accuracy: 0.9934\n",
            "Epoch 16/100\n",
            "12351/12351 - 27s - loss: 0.0317 - accuracy: 0.9940 - val_loss: 0.0335 - val_accuracy: 0.9933\n",
            "Restoring model weights from the end of the best epoch.\n",
            "Epoch 00016: early stopping\n"
          ],
          "name": "stdout"
        },
        {
          "output_type": "execute_result",
          "data": {
            "text/plain": [
              "<tensorflow.python.keras.callbacks.History at 0x7f1810486470>"
            ]
          },
          "metadata": {
            "tags": []
          },
          "execution_count": 55
        }
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "cxkeTwVGcybF",
        "outputId": "1bbc3333-e200-4f06-f804-211efc3360ef"
      },
      "source": [
        "# Measure accuracy\r\n",
        "pred = model.predict(x_test)\r\n",
        "pred = np.argmax(pred,axis=1)\r\n",
        "y_eval = np.argmax(y_test,axis=1)\r\n",
        "score = metrics.accuracy_score(y_eval, pred)\r\n",
        "print(\"Validation score: {}\".format(score))"
      ],
      "execution_count": 56,
      "outputs": [
        {
          "output_type": "stream",
          "text": [
            "Validation score: 0.9931886038155964\n"
          ],
          "name": "stdout"
        }
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "Ss4vp_E_P8cl"
      },
      "source": [
        "## Model Pickle"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "L48I9e3NP75F"
      },
      "source": [
        "model.save(\"zscore_ANN.h5\")"
      ],
      "execution_count": 57,
      "outputs": []
    }
  ]
}