0001 Feature Extraction - PCAP2CSV/01.3 UNSW feature extraction IoTDevID.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### You can access the UNSW datasets used in our study from the links below.\n",
    "\n",
    "[ UNSW - IOT TRAFFIC TRACES - IEEE TMC 2018](https://iotanalytics.unsw.edu.au/iottraces)\n",
    "\n",
    "[ UNSW - IOT BENIGN AND ATTACK TRACES - ACM SOSR 2019](https://iotanalytics.unsw.edu.au/attack-data)\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Since these data are very large, we filter the data on a device and session basis. You can access the Pcap files obtained from this filtering process from [ this link (Used Pcap Files)](https://drive.google.com/file/d/1RSnQJNTHj8FoS1KvBxbCGaS4sYmX3sPF/view).\n",
    "\n",
    "\n",
    "<img src=\"unsw.jpg\" alt=\"unsw\" width=\"600\"/>\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "import pandas as pd\n",
    "import zipfile\n",
    "import os\n",
    "import shutil"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 75,
   "metadata": {},
   "outputs": [],
   "source": [
    "path=\"UNSW_PCAP.zip\"\n",
    "with zipfile.ZipFile(path, 'r') as zip_ref:\n",
    "    zip_ref.extractall(\"./\")\n",
    "path=\"./UNSW_PCAP/\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [],
   "source": [
    "def folder(f_name): #this function creates a folder named \"attacks\" in the program directory.\n",
    "    try:\n",
    "        if not os.path.exists(f_name):\n",
    "            os.makedirs(f_name)\n",
    "    except OSError:\n",
    "        print (\"The folder could not be created!\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "['./UNSW_PCAP\\\\shared\\\\16-10-07.pcap2-NestDropcam@.pcap',\n",
       " './UNSW_PCAP\\\\shared\\\\unknownmaybecam.pcap',\n",
       " './UNSW_PCAP\\\\TEST\\\\16-09-23-PIX-STARPhoto-frame@.pcap',\n",
       " './UNSW_PCAP\\\\TEST\\\\16-09-23-TP-LinkDayNightCloudcamera@.pcap',\n",
       " './UNSW_PCAP\\\\TEST\\\\16-09-23-TribySpeaker@.pcap',\n",
       " './UNSW_PCAP\\\\TEST\\\\16-09-29-iHome@.pcap',\n",
       " './UNSW_PCAP\\\\TEST\\\\16-09-29-LightBulbsLiFXSmartBulb@.pcap',\n",
       " './UNSW_PCAP\\\\TEST\\\\16-10-04.pcap10-BlipcareBloodPressuremeter@.pcap',\n",
       " './UNSW_PCAP\\\\TEST\\\\HelloBarbie.pcap',\n",
       " './UNSW_PCAP\\\\TEST\\\\IPhone.pcap',\n",
       " './UNSW_PCAP\\\\TEST\\\\NESTProtectsmokealarm.pcap',\n",
       " './UNSW_PCAP\\\\TEST\\\\WithingsSmartscale.pcap',\n",
       " './UNSW_PCAP\\\\TRAIN\\\\16-10-01-SmartThings@.pcap',\n",
       " './UNSW_PCAP\\\\TRAIN\\\\16-10-14_00003_20161014041654-PIX-STARPhoto-frame@.pcap',\n",
       " './UNSW_PCAP\\\\TRAIN\\\\BlipcareBloodPressuremeter.pcap',\n",
       " './UNSW_PCAP\\\\TRAIN\\\\HelloBarbie.pcap',\n",
       " './UNSW_PCAP\\\\TRAIN\\\\IPhone.pcap',\n",
       " './UNSW_PCAP\\\\TRAIN\\\\LightBulbsLiFXSmartBulb.pcap']"
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "def find_the_way(path,file_format):\n",
    "    files_add = []\n",
    "    # r=root, d=directories, f = files\n",
    "    for r, d, f in os.walk(path):\n",
    "        for file in f:\n",
    "            if file_format in file:\n",
    "                files_add.append(os.path.join(r, file))  \n",
    "    return files_add\n",
    "#files_add=find_the_way(\"./\",'.pcap')\n",
    "files_add=find_the_way(\"./UNSW_PCAP\",'.pcap')\n",
    "files_add"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "xhtFBx88w82H"
   },
   "source": [
    "# PCAP2CSV"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {
    "executionInfo": {
     "elapsed": 54679,
     "status": "ok",
     "timestamp": 1618599130335,
     "user": {
      "displayName": "bozkır bilgesi",
      "photoUrl": "",
      "userId": "00518659040232779705"
     },
     "user_tz": -60
    },
    "id": "Rqb4fmeWw82I"
   },
   "outputs": [],
   "source": [
    "from scapy.all import*"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [],
   "source": [
    "import math\n",
    "import pandas as pd\n",
    "import os\n",
    "import numpy as np"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [],
   "source": [
    "def folder(f_name): #this function creates a folder.\n",
    "    try:\n",
    "        if not os.path.exists(f_name):\n",
    "            os.makedirs(f_name)\n",
    "    except OSError:\n",
    "        print (\"The folder could not be created!\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {
    "id": "xSBVZs3ow82O"
   },
   "outputs": [],
   "source": [
    "MAC_list={\n",
    "# UNSW IEEE TMC 2018 Data MAC and Device names\n",
    "\"d0:52:a8:00:67:5e\":\"Smart Things\",\n",
    "\"44:65:0d:56:cc:d3\":\"Amazon Echo\",\n",
    "\"70:ee:50:18:34:43\":\"Netatmo Welcome\",\n",
    "\"f4:f2:6d:93:51:f1\":\"TP-Link Day Night Cloud camera\",\n",
    "\"00:16:6c:ab:6b:88\":\"Samsung SmartCam\",\n",
    "\"30:8c:fb:2f:e4:b2\":\"Dropcam\",\n",
    "\"00:62:6e:51:27:2e\":\"Insteon Camera\",\n",
    "\"00:24:e4:11:18:a8\":\"Withings Smart Baby Monitor\",\n",
    "\"ec:1a:59:79:f4:89\":\"Belkin Wemo switch\",\n",
    "\"50:c7:bf:00:56:39\":\"TP-Link Smart plug\",\n",
    "\"74:c6:3b:29:d7:1d\":\"iHome\",\n",
    "\"ec:1a:59:83:28:11\":\"Belkin wemo motion sensor\",\n",
    "\"18:b4:30:25:be:e4\":\"NEST Protect smoke alarm\",\n",
    "\"70:ee:50:03:b8:ac\":\"Netatmo weather station\",\n",
    "\"00:24:e4:1b:6f:96\":\"Withings Smart scale\",\n",
    "\"74:6a:89:00:2e:25\":\"Blipcare Blood Pressure meter\",\n",
    "\"00:24:e4:20:28:c6\":\"Withings Aura smart sleep sensor\",\n",
    "\"d0:73:d5:01:83:08\":\"Light Bulbs LiFX Smart Bulb\",\n",
    "\"18:b7:9e:02:20:44\":\"Triby Speaker\",\n",
    "\"e0:76:d0:33:bb:85\":\"PIX-STAR Photo-frame\",\n",
    "\"70:5a:0f:e4:9b:c0\":\"HP Printer\",\n",
    "\"08:21:ef:3b:fc:e3\":\"Samsung Galaxy Tab\",\n",
    "\"e8:ab:fa:19:de:4f\":\"unknown maybe cam\",\n",
    "\"30:8c:fb:b6:ea:45\":\"Nest Dropcam\",\n",
    "\"40:f3:08:ff:1e:da\":\"Android Phone 1\",\n",
    "\"74:2f:68:81:69:42\":\"Laptop\",\n",
    "\"ac:bc:32:d4:6f:2f\":\"MacBook\",\n",
    "\"b4:ce:f6:a7:a3:c2\":\"Android Phone 2\",\n",
    "\"d0:a6:37:df:a1:e1\":\"IPhone\",\n",
    "\"f4:5c:89:93:cc:85\":\"MacBook-Iphone\",\n",
    "\"14:cc:20:51:33:ea\":\"TPLink Router Bridge LAN\",\n",
    "\"00:24:e4:10:ee:4c\":\"Withings Baby Monitor 2\",\n",
    "\"88:4a:ea:31:66:9d\":\"Ring Door Bell\",\n",
    "\"00:17:88:2b:9a:25\":\"Phillip Hue Lightbulb\",\n",
    "\"7c:70:bc:5d:5e:dc\":\"Canary Camera\",\n",
    "\"6c:ad:f8:5e:e4:61\":\"Google Chromecast\",\n",
    "\"28:c2:dd:ff:a5:2d\":\"Hello Barbie\",\n",
    "\"70:88:6b:10:0f:c6\":\"Awair air quality monitor\",\n",
    "\"b4:75:0e:ec:e5:a9\":\"Belkin Camera\",\n",
    "\"e0:76:d0:3f:00:ae\":\"August Doorbell Cam\",\n",
    "# Yourthings Data MAC and Device names\n",
    "'00:01:c0:18:7f:9b': 'Gateway',\n",
    " '00:04:4b:55:f6:4f': 'nVidiaShield',\n",
    " '00:12:16:ab:c0:22': 'ChineseWebcam',\n",
    " '00:17:88:21:f7:e4': 'PhilipsHUEHub',\n",
    " '00:1d:c9:23:f6:00': 'RingDoorbell',\n",
    " '00:21:cc:4d:59:35': 'Wink2Hub',\n",
    " '00:24:e4:2b:a5:34': 'WithingsHome',\n",
    " '00:7e:56:77:35:4d': 'KoogeekLightbulb',\n",
    " '08:05:81:ee:06:46': 'Roku4',\n",
    " '08:86:3b:6f:7a:15': 'BelkinWeMoMotionSensor',\n",
    " '08:86:3b:70:d7:39': 'BelkinWeMoSwitch',\n",
    " '0c:47:c9:4e:fe:5b': 'AmazonFireTV',\n",
    " '10:ce:a9:eb:5a:8a': 'BoseSoundTouch10',\n",
    " '18:b4:30:31:04:b9': 'NestProtect',\n",
    " '18:b4:30:40:1e:c5': 'NestGuard',\n",
    " '18:b4:30:58:3d:6c': 'NestCamera',\n",
    " '18:b4:30:8c:03:e4': 'NestCamIQ',\n",
    " '20:df:b9:20:87:39': 'GoogleHomeMini',\n",
    " '30:52:cb:a3:4f:5f': 'RokuTV',\n",
    " '3c:f7:a4:f2:15:87': 'iPhone',\n",
    " '40:9f:38:92:40:13': 'Roomba',\n",
    " '44:73:d6:01:3d:fd': 'LogitechLogiCircle',\n",
    " '48:d6:d5:98:53:84': 'GoogleHome',\n",
    " '50:c7:bf:92:a6:4a': 'TP-LinkSmartWiFiLEDBulb',\n",
    " '54:4a:16:f9:54:18': 'InsteonHub',\n",
    " '5c:aa:fd:6c:e0:d4': 'Sonos',\n",
    " '64:52:99:97:f8:40': 'ChamberlainmyQGarageOpener',\n",
    " '74:c2:46:1b:8e:e2': 'AmazonEchoGen1',\n",
    " '7c:64:56:60:71:74': 'SamsungSmartTV',\n",
    " '7c:70:bc:5d:09:d1': 'Canary',\n",
    " '94:10:3e:5c:2e:31': 'BelkinWeMoCrockpot',\n",
    " '94:10:3e:cc:67:95': 'BelkinWeMoLink',\n",
    " '94:4a:0c:08:7e:72': 'MiCasaVerdeVeraLite',\n",
    " 'a4:f1:e8:8d:b0:9e': 'AndroidTablet',\n",
    " 'ac:3f:a4:70:4a:d6': 'PiperNV',\n",
    " 'b0:4e:26:20:15:8a': 'TP-LinkWiFiPlug',\n",
    " 'b0:7f:b9:a6:47:4d': 'NetgearArloCamera',\n",
    " 'b0:c5:54:03:c7:09': 'D-LinkDCS-5009LCamera',\n",
    " 'b4:79:a7:22:f9:fc': 'WinkHub',\n",
    " 'c0:56:27:53:09:6d': 'BelkinNetcam',\n",
    " 'c8:db:26:02:bb:bb': 'LogitechHarmonyHub',\n",
    " 'cc:b8:a8:ad:4d:04': 'AugustDoorbellCam',\n",
    " 'd0:03:4b:39:12:e3': 'AppleTV(4thGen)',\n",
    " 'd0:52:a8:63:47:9e': 'SamsungSmartThingsHub',\n",
    " 'd0:73:d5:12:84:d1': 'LIFXVirtualBulb',\n",
    " 'd4:90:9c:cc:62:42': 'AppleHomePod',\n",
    " 'd8:f7:10:c2:29:be': 'HarmonKardonInvoke',\n",
    " 'e4:71:85:25:ce:ec': 'SecurifiAlmond',\n",
    " 'e8:b2:ac:af:62:0f': 'iPad',\n",
    " 'f4:5e:ab:5e:c0:23': 'CasetaWirelessHub',\n",
    " 'f4:f2:6d:ce:9a:5d': 'GoogleOnHub',\n",
    "# IoT devices captures MAC and Device names\n",
    "'00:17:88:24:76:ff': 'Hue-Device',\n",
    " '00:1a:22:03:cb:be': 'MAXGateway',\n",
    " '00:1a:22:05:c4:2e': 'HomeMaticPlug',\n",
    " '00:24:e4:24:80:2a': 'Withings',\n",
    " '00:b5:6d:06:08:ba': 'unknown',\n",
    " '1c:5f:2b:aa:fd:4e': 'D-LinkDevice',\n",
    " '20:f8:5e:ca:91:52': 'Aria',\n",
    " '24:77:03:7c:ea:dc': 'unknown',\n",
    " '28:b2:bd:c3:41:79': 'unknown',\n",
    " '38:0b:40:ef:85:41': 'unknown',\n",
    " '3c:49:37:03:17:db': 'EdnetCam',\n",
    " '3c:49:37:03:17:f0': 'EdnetCam',\n",
    " '50:c7:bf:00:c7:03': 'TP-LinkPlugHS110',\n",
    " '50:c7:bf:00:fc:a3': 'TP-LinkPlugHS100',\n",
    " '5c:cf:7f:06:d9:02': 'iKettle2',\n",
    " '5c:cf:7f:07:ae:fb': 'SmarterCoffee',\n",
    " '6c:72:20:c5:17:5a': 'D-LinkWaterSensor',\n",
    " '74:da:38:23:22:7b': 'EdimaxPlug2101W',\n",
    " '74:da:38:4a:76:49': 'EdimaxPlug1101W',\n",
    " '74:da:38:80:79:fc': 'EdimaxCam',\n",
    " '74:da:38:80:7a:08': 'EdimaxCam',\n",
    " '84:18:26:7b:5f:6b': 'Lightify',\n",
    " '90:8d:78:a8:e1:43': 'D-LinkSensor',\n",
    " '90:8d:78:a9:3d:6f': 'D-LinkSwitch',\n",
    " '90:8d:78:dd:0d:60': 'D-LinkSiren',\n",
    " '94:10:3e:34:0c:b5': 'WeMoSwitch',\n",
    " '94:10:3e:35:01:c1': 'WeMoSwitch',\n",
    " '94:10:3e:41:c2:05': 'WeMoInsightSwitch',\n",
    " '94:10:3e:42:80:69': 'WeMoInsightSwitch',\n",
    " '94:10:3e:cd:37:65': 'WeMoLink',\n",
    " 'ac:cf:23:62:3c:6e': 'EdnetGateway',\n",
    " 'b0:c5:54:1c:71:85': 'D-LinkDayCam',\n",
    " 'b0:c5:54:25:5b:0e': 'D-LinkCam',\n",
    " 'bc:f5:ac:f4:c0:9d': 'unknown'}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {
    "executionInfo": {
     "elapsed": 765,
     "status": "ok",
     "timestamp": 1618599164353,
     "user": {
      "displayName": "bozkır bilgesi",
      "photoUrl": "",
      "userId": "00518659040232779705"
     },
     "user_tz": -60
    },
    "id": "ak_Dk3mww82Q"
   },
   "outputs": [],
   "source": [
    "def shannon(data):\n",
    "    LOG_BASE = 2\n",
    "   # We determine the frequency of each byte\n",
    "   # in the dataset and if this frequency is not null we use it for the\n",
    "   # entropy calculation\n",
    "    dataSize = len(data)\n",
    "    ent = 0.0\n",
    "    freq={} \n",
    "    for c in data:\n",
    "        if c in freq:\n",
    "            freq[c] += 1\n",
    "        else:\n",
    "            freq[c] = 1\n",
    "   # to determine if each possible value of a byte is in the list\n",
    "    for key in freq.keys():\n",
    "        f = float(freq[key])/dataSize\n",
    "        if f > 0: # to avoid an error for log(0)\n",
    "            ent = ent + f * math.log(f, LOG_BASE)\n",
    "    return -ent\n",
    "\n",
    "def pre_entropy(payload):\n",
    "    \n",
    "    characters=[]\n",
    "    for i in payload:\n",
    "            characters.append(i)\n",
    "    return shannon(characters)\n",
    "            "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 86
    },
    "executionInfo": {
     "elapsed": 780,
     "status": "ok",
     "timestamp": 1618599167036,
     "user": {
      "displayName": "bozkır bilgesi",
      "photoUrl": "",
      "userId": "00518659040232779705"
     },
     "user_tz": -60
    },
    "id": "Jkfuo7JCw82Q",
    "outputId": "5fb49477-f3c3-40ec-8e81-8742dbbfff67"
   },
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {
    "executionInfo": {
     "elapsed": 2282,
     "status": "ok",
     "timestamp": 1618600263666,
     "user": {
      "displayName": "bozkır bilgesi",
      "photoUrl": "",
      "userId": "00518659040232779705"
     },
     "user_tz": -60
    },
    "id": "LA0otM18FyXn"
   },
   "outputs": [],
   "source": [
    "def port_class(port):\n",
    "    port_list=[0,53,67,68,80,123,443,1900,5353,49153]# private port list (0-Reserved,53-DNS, 67-BOOTP server, 68-BOOTP client...)\n",
    "    if port in port_list: #Is the port number in the list?\n",
    "        return port_list.index(port)+1 # return the port's index number in the list (actually with index+1)\n",
    "    elif 0 <= port <= 1023: # return 11 if the port number is in the range 0 :1023\n",
    "        return 11\n",
    "    elif  1024 <= port <= 49151 : # return 12 if the port number is in the range 1024:49151\n",
    "        return 12\n",
    "    elif 49152 <=port <= 65535 :# return 13 if the port number is in the range 49152:65535\n",
    "        return 13\n",
    "    else:# return 0 if no previous conditions are met\n",
    "        return 0\n",
    "    \n",
    "    \n",
    "def port_1023(port):\n",
    "    if 0 <= port <= 1023:\n",
    "        return port\n",
    "    elif  1024 <= port <= 49151 :\n",
    "        return 2\n",
    "    elif 49152 <=port <= 65535 :\n",
    "        return 3\n",
    "    else:\n",
    "        return 0"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {
    "executionInfo": {
     "elapsed": 832,
     "status": "ok",
     "timestamp": 1618599170305,
     "user": {
      "displayName": "bozkır bilgesi",
      "photoUrl": "",
      "userId": "00518659040232779705"
     },
     "user_tz": -60
    },
    "id": "zqssqFuLw82R"
   },
   "outputs": [],
   "source": [
    "header=\"pck_size,Ether_type,LLC_dsap,LLC_ssap,LLC_ctrl,EAPOL_version,EAPOL_type,EAPOL_len,IP_version,IP_ihl,IP_tos,IP_len,IP_flags,IP_Z,IP_MF,IP_id,IP_chksum,IP_DF,IP_frag,IP_ttl,IP_proto,IP_options,IP_add_count,ICMP_type,ICMP_code,ICMP_chksum,ICMP_id,ICMP_seq,ICMP_ts_ori,ICMP_ts_rx,ICMP_ts_tx,ICMP_ptr,ICMP_reserved,ICMP_length,ICMP_nexthopmtu,ICMP_unused,TCP_seq,TCP_ack,TCP_dataofs,TCP_reserved,TCP_flags,TCP_FIN,TCP_SYN,TCP_RST,TCP_PSH,TCP_ACK,TCP_URG,TCP_ECE,TCP_CWR,TCP_window,TCP_chksum,TCP_urgptr,TCP_options,UDP_len,UDP_chksum,DHCP_options,BOOTP_op,BOOTP_htype,BOOTP_hlen,BOOTP_hops,BOOTP_xid,BOOTP_secs,BOOTP_flags,BOOTP_sname,BOOTP_file,BOOTP_options,DNS_length,DNS_id,DNS_qr,DNS_opcode,DNS_aa,DNS_tc,DNS_rd,DNS_ra,DNS_z,DNS_ad,DNS_cd,DNS_rcode,DNS_qdcount,DNS_ancount,DNS_nscount,DNS_arcount,sport_class,dport_class,sport23,dport23,sport_bare,dport_bare,TCP_sport,TCP_dport,UDP_sport,UDP_dport,payload_bytes,entropy,MAC,Label\\n\"\n",
    "\n",
    "#header=\"pck_size,Ether_type,LLC_dsap,LLC_ssap,LLC_ctrl,EAPOL_version,EAPOL_type,EAPOL_len,IP_version,IP_ihl,IP_tos,IP_len,IP_flags,IP_frag,IP_ttl,IP_proto,IP_options,IP_add_count,ICMP_type,ICMP_code,ICMP_seq,ICMP_ts_ori,ICMP_ts_rx,ICMP_ts_tx,ICMP_gw,ICMP_ptr,ICMP_reserved,ICMP_length,ICMP_nexthopmtu,ICMP_unused,TCP_dataofs,TCP_reserved,TCP_flags,TCP_window,TCP_urgptr,UDP_len,BOOTP_op,BOOTP_htype,BOOTP_hlen,BOOTP_hops,BOOTP_secs,BOOTP_flags,DNS_length,DNS_qr,DNS_opcode,DNS_aa,DNS_tc,DNS_rd,DNS_ra,DNS_z,DNS_ad,DNS_cd,DNS_rcode,DNS_qdcount,DNS_ancount,DNS_nscount,DNS_arcount,sport,dport,entropy,Label,MAC\\n\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {
    "executionInfo": {
     "elapsed": 670,
     "status": "ok",
     "timestamp": 1618599182214,
     "user": {
      "displayName": "bozkır bilgesi",
      "photoUrl": "",
      "userId": "00518659040232779705"
     },
     "user_tz": -60
    },
    "id": "tZKgl-4Kw82R"
   },
   "outputs": [],
   "source": [
    "#flags\n",
    "#TCP\n",
    "FIN = 0x01\n",
    "SYN = 0x02\n",
    "RST = 0x04\n",
    "PSH = 0x08\n",
    "ACK = 0x10\n",
    "URG = 0x20\n",
    "ECE = 0x40\n",
    "CWR = 0x80\n",
    "#IP\n",
    "Z = 0x00\n",
    "MF= 0x01\n",
    "DF= 0x02\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {
    "id": "A6BKuGebw82S",
    "scrolled": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[====================]100%  -  1 / 18\n",
      "[====================]100%  -  2 / 18\n",
      "[====================]100%  -  3 / 18\n",
      "[====================]100%  -  4 / 18\n",
      "[=================== ]95%  -  5 / 18\n",
      "[====================]100%  -  6 / 18\n",
      "[====================]100%  -  7 / 18\n",
      "[===============================]155%  -  8 / 18\n",
      "[=====================]105%  -  9 / 18\n",
      "[====================]100%  -  10 / 18\n",
      "[====================]100%  -  11 / 18\n",
      "[====================]100%  -  12 / 18\n",
      "[====================]100%  -  13 / 18\n",
      "[====================]100%  -  14 / 18\n",
      "[========================]120%  -  15 / 18\n",
      "[====================]100%  -  16 / 18\n",
      "[====================]100%  -  17 / 18\n",
      "[====================]100%  -  18 / 18\n"
     ]
    }
   ],
   "source": [
    "\n",
    "\n",
    "ipf=[]\n",
    "tcpf=[]\n",
    "import time\n",
    "degistir=\"\"\n",
    "dst_ip_list={}\n",
    "Ether_adresses=[]\n",
    "IP_adresses=[]\n",
    "label_count=0\n",
    "\n",
    "\n",
    "\n",
    "for numero,i in enumerate (files_add):\n",
    "\n",
    "\n",
    "        \n",
    "    filename=i[:-4]+\".csv\"\n",
    "    ths = open(filename, \"w\")\n",
    "    ths.write(header)  \n",
    "    \n",
    "\n",
    "    #header=header\n",
    "    #ths.write(header)  \n",
    "    filename=str(i)\n",
    "    filename=filename.replace(\"\\\\\",\"/\")\n",
    "    #x = filename.rfind(\"/\")\n",
    "    filename=filename.split(\"/\")\n",
    "    \n",
    "    #break\n",
    "    pkt = rdpcap(i)\n",
    "    #print(\"\\n\",numero,\"/\",len(files_add),\"========\"+ i[8:]+\"========\\n\" )\n",
    "    #print(\"\\n\",numero,\"/\",len(files_add))\n",
    "    sayaç=len(pkt)//20\n",
    "    for jj, j in enumerate (pkt):\n",
    "        \n",
    "        try:        \n",
    "            if jj%sayaç==0:\n",
    "\n",
    "                    sys.stdout.write(\"\\r[\" + \"=\" * int(jj//sayaç) +  \" \" * int((sayaç*20 - jj)// sayaç) + \"]\" +  str(5*jj//sayaç) + \"%\")\n",
    "                    sys.stdout.flush()\n",
    "        except:pass\n",
    "        if j.haslayer(ARP):\n",
    "            continue\n",
    "        else:\n",
    "            \n",
    "            ts=j.time\n",
    "            try:pck_size=j.len\n",
    "            except:pck_size=0\n",
    "            if j.haslayer(Ether):\n",
    "\n",
    "                if j[Ether].dst not in Ether_adresses:\n",
    "                    Ether_adresses.append(j[Ether].dst)\n",
    "                if j[Ether].src not in Ether_adresses:\n",
    "                    Ether_adresses.append(j[Ether].src)\n",
    "\n",
    "\n",
    "                Ether_dst=j[Ether].dst#Ether_adresses.index(j[Ether].dst)+1\n",
    "                Ether_src=j[Ether].src#Ether_adj[Ether].dstresses.index(j[Ether].src)+1\n",
    "\n",
    "\n",
    "                Ether_type=j[Ether].type\n",
    "            else:\n",
    "                Ether_dst=0\n",
    "                Ether_src=0\n",
    "                Ether_type=0\n",
    "\n",
    "\n",
    "            if j.haslayer(ARP):\n",
    "                ARP_hwtype=j[ARP].hwtype\n",
    "                ARP_ptype=j[ARP].ptype\n",
    "                ARP_hwlen=j[ARP].hwlen\n",
    "                ARP_plen=j[ARP].plen\n",
    "                ARP_op=j[ARP].op\n",
    "\n",
    "\n",
    "                ARP_hwsrc=j[ARP].hwsrc\n",
    "                ARP_psrc=j[ARP].psrc\n",
    "                ARP_hwdst=j[ARP].hwdst\n",
    "                ARP_pdst=j[ARP].pdst\n",
    "\n",
    "                if j[ARP].hwsrc not in Ether_adresses:\n",
    "                    Ether_adresses.append(j[ARP].hwsrc)\n",
    "                if j[ARP].psrc not in IP_adresses:\n",
    "                    IP_adresses.append(j[ARP].psrc)           \n",
    "                if j[ARP].hwdst not in Ether_adresses:\n",
    "                    Ether_adresses.append(j[ARP].hwdst)\n",
    "                if j[ARP].pdst not in IP_adresses:\n",
    "                    IP_adresses.append(j[ARP].pdst)\n",
    "\n",
    "\n",
    "                ARP_hwsrc=j[ARP].hwsrc#Ether_adresses.index(j[ARP].hwsrc)+1\n",
    "                ARP_psrc=j[ARP].psrc#IP_adresses.index(j[ARP].psrc)+1\n",
    "                ARP_hwdst=j[ARP].hwdst#Ether_adresses.index(j[ARP].hwdst)+1\n",
    "                ARP_pdst=j[ARP].pdst#IP_adresses.index(j[ARP].pdst)+1\n",
    "\n",
    "\n",
    "            else:\n",
    "                ARP_hwtype=0\n",
    "                ARP_ptype=0\n",
    "                ARP_hwlen=0\n",
    "                ARP_plen=0\n",
    "                ARP_op=0\n",
    "                ARP_hwsrc=0\n",
    "                ARP_psrc=0\n",
    "                ARP_hwdst=0\n",
    "                ARP_pdst=0            \n",
    "\n",
    "\n",
    "            if j.haslayer(LLC):\n",
    "                LLC_dsap=j[LLC].dsap\n",
    "                LLC_ssap=j[LLC].ssap\n",
    "                LLC_ctrl=j[LLC].ctrl\n",
    "            else:\n",
    "                LLC_dsap=0\n",
    "                LLC_ssap=0\n",
    "                LLC_ctrl=0            \n",
    "\n",
    "\n",
    "\n",
    "            if j.haslayer(EAPOL):\n",
    "                EAPOL_version=j[EAPOL].version\n",
    "                EAPOL_type=j[EAPOL].type\n",
    "                EAPOL_len=j[EAPOL].len\n",
    "\n",
    "            else:\n",
    "                EAPOL_version=0\n",
    "                EAPOL_type=0\n",
    "                EAPOL_len=0            \n",
    "\n",
    "\n",
    "            if j.haslayer(IP):\n",
    "\n",
    "                IP_Z = 0\n",
    "                IP_MF= 0\n",
    "                IP_DF= 0\n",
    "\n",
    "                IP_version=j[IP].version\n",
    "                IP_ihl=j[IP].ihl\n",
    "                IP_tos=j[IP].tos\n",
    "                IP_len=j[IP].len\n",
    "                IP_id=j[IP].id\n",
    "                IP_flags=j[IP].flags\n",
    "\n",
    "                IP_frag=j[IP].frag\n",
    "                IP_ttl=j[IP].ttl\n",
    "                IP_proto=j[IP].proto\n",
    "                IP_chksum=j[IP].chksum\n",
    "\n",
    "\n",
    "                #if j[IP].options!=0:\n",
    "                IP_options=j[IP].options\n",
    "                if \"IPOption_Router_Alert\"   in str(IP_options):\n",
    "                    IP_options=1\n",
    "                else:IP_options=0\n",
    "                \n",
    "                \n",
    "                if j[Ether].src not in dst_ip_list:\n",
    "                    dst_ip_list[j[Ether].src]=[]\n",
    "                    dst_ip_list[j[Ether].src].append(j[IP].dst)\n",
    "                elif j[IP].dst not in dst_ip_list[j[Ether].src]:\n",
    "                    dst_ip_list[j[Ether].src].append(j[IP].dst)\n",
    "                IP_add_count=len(dst_ip_list[j.src])\n",
    "\n",
    "                #if IP_flags not in ipf: ipf.append(IP_flags)\n",
    "\n",
    "                if IP_flags & Z:IP_Z = 1\n",
    "                if IP_flags & MF:IP_MF = 1\n",
    "                if IP_flags & DF:IP_DF = 1\n",
    "                #if \"Flag\" in str(IP_flags):\n",
    "                    #IP_flags=str(IP_flags)\n",
    "                    #temp=IP_flags.find(\"(\")\n",
    "                    #IP_flags=int(IP_flags[6:temp-1])\n",
    "\n",
    "\n",
    "                if j[IP].src not in IP_adresses:\n",
    "                    IP_adresses.append(j[IP].src)\n",
    "                if j[IP].dst  not in IP_adresses:\n",
    "                    IP_adresses.append(j[IP].dst)           \n",
    "\n",
    "                IP_src=j[IP].src#IP_adresses.index(j[IP].src)+1\n",
    "                IP_dst=j[IP].dst#IP_adresses.index(j[IP].dst)+1                \n",
    "\n",
    "\n",
    "\n",
    "            else:\n",
    "                IP_Z = 0\n",
    "                IP_MF= 0\n",
    "                IP_DF= 0\n",
    "\n",
    "                IP_version=0\n",
    "                IP_ihl=0\n",
    "                IP_tos=0\n",
    "                IP_len=0\n",
    "                IP_id=0\n",
    "                IP_flags=0\n",
    "                IP_frag=0\n",
    "                IP_ttl=0\n",
    "                IP_proto=0\n",
    "                IP_chksum=0\n",
    "                IP_src=0\n",
    "                IP_dst=0\n",
    "                IP_options=0\n",
    "                IP_add_count=0            \n",
    "\n",
    "            if j.haslayer(ICMP):\n",
    "                ICMP_type=j[ICMP].type\n",
    "                ICMP_code=j[ICMP].code\n",
    "                ICMP_chksum=j[ICMP].chksum\n",
    "                ICMP_id=j[ICMP].id\n",
    "                ICMP_seq=j[ICMP].seq\n",
    "                ICMP_ts_ori=j[ICMP].ts_ori\n",
    "                ICMP_ts_rx=j[ICMP].ts_rx\n",
    "                ICMP_ts_tx=j[ICMP].ts_tx\n",
    "                ICMP_gw=j[ICMP].gw\n",
    "                ICMP_ptr=j[ICMP].ptr\n",
    "                ICMP_reserved=j[ICMP].reserved\n",
    "                ICMP_length=j[ICMP].length\n",
    "                ICMP_addr_mask=j[ICMP].addr_mask\n",
    "                ICMP_nexthopmtu=j[ICMP].nexthopmtu\n",
    "                ICMP_unused=j[ICMP].unused\n",
    "            else:\n",
    "                ICMP_type=0\n",
    "                ICMP_code=0\n",
    "                ICMP_chksum=0\n",
    "                ICMP_id=0\n",
    "                ICMP_seq=0\n",
    "                ICMP_ts_ori=0\n",
    "                ICMP_ts_rx=0\n",
    "                ICMP_ts_tx=0\n",
    "                ICMP_gw=0\n",
    "                ICMP_ptr=0\n",
    "                ICMP_reserved=0\n",
    "                ICMP_length=0\n",
    "                ICMP_addr_mask=0\n",
    "                ICMP_nexthopmtu=0\n",
    "                ICMP_unused=0\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "            if j.haslayer(TCP):\n",
    "                TCP_FIN = 0\n",
    "                TCP_SYN = 0\n",
    "                TCP_RST = 0\n",
    "                TCP_PSH = 0\n",
    "                TCP_ACK = 0\n",
    "                TCP_URG = 0\n",
    "                TCP_ECE = 0\n",
    "                TCP_CWR = 0\n",
    "                TCP_sport=j[TCP].sport\n",
    "                TCP_dport=j[TCP].dport\n",
    "                TCP_seq=j[TCP].seq\n",
    "                TCP_ack=j[TCP].ack\n",
    "                TCP_dataofs=j[TCP].dataofs\n",
    "                TCP_reserved=j[TCP].reserved\n",
    "                TCP_flags=j[TCP].flags\n",
    "\n",
    "                TCP_window=j[TCP].window\n",
    "                TCP_chksum=j[TCP].chksum\n",
    "                TCP_urgptr=j[TCP].urgptr\n",
    "                TCP_options=j[TCP].options\n",
    "                TCP_options= str(TCP_options).replace(\",\",\"-\")\n",
    "                if TCP_options!=\"0\":\n",
    "                    TCP_options=1\n",
    "                else:\n",
    "                    TCP_options=0\n",
    "                \n",
    "                \n",
    "                \n",
    "\n",
    "                #if TCP_flags not in tcpf:\n",
    "                    #tcpf.append(TCP_flags)\n",
    "                #print(TCP_options)\n",
    "                if TCP_flags & FIN:TCP_FIN = 1\n",
    "                if TCP_flags & SYN:TCP_SYN = 1\n",
    "                if TCP_flags & RST:TCP_RST = 1\n",
    "                if TCP_flags & PSH:TCP_PSH = 1\n",
    "                if TCP_flags & ACK:TCP_ACK = 1\n",
    "                if TCP_flags & URG:TCP_URG = 1\n",
    "                if TCP_flags & ECE:TCP_ECE = 1\n",
    "                if TCP_flags & CWR:TCP_CWR = 1   \n",
    "                #print(TCP_flags)\n",
    "                #if \"Flag\" in str(TCP_flags):\n",
    "                    #TCP_flags=str(TCP_flags)\n",
    "                    #temp=TCP_flags.find(\"(\")\n",
    "                    #TCP_flags=int(TCP_flags[6:temp-1])\n",
    "                    \n",
    "\n",
    "\n",
    "\n",
    "            else:\n",
    "                TCP_sport=0\n",
    "                TCP_dport=0\n",
    "                TCP_seq=0\n",
    "                TCP_ack=0\n",
    "                TCP_dataofs=0\n",
    "                TCP_reserved=0\n",
    "                TCP_flags=0\n",
    "                TCP_window=0\n",
    "                TCP_chksum=0\n",
    "                TCP_urgptr=0\n",
    "                TCP_options=0\n",
    "                TCP_options=0\n",
    "                TCP_FIN = 0\n",
    "                TCP_SYN = 0\n",
    "                TCP_RST = 0\n",
    "                TCP_PSH = 0\n",
    "                TCP_ACK = 0\n",
    "                TCP_URG = 0\n",
    "                TCP_ECE = 0\n",
    "                TCP_CWR = 0\n",
    "\n",
    "\n",
    "            if j.haslayer(UDP):\n",
    "                UDP_sport=j[UDP].sport\n",
    "                UDP_dport=j[UDP].dport\n",
    "                UDP_len=j[UDP].len\n",
    "                UDP_chksum=j[UDP].chksum\n",
    "            else:\n",
    "                UDP_sport=0\n",
    "                UDP_dport=0\n",
    "                UDP_len=0\n",
    "                UDP_chksum=0\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "            if j.haslayer(DHCP):\n",
    "                DHCP_options=str(j[DHCP].options)\n",
    "                DHCP_options=DHCP_options.replace(\",\",\"-\")\n",
    "                if \"message\" in DHCP_options:\n",
    "                    x = DHCP_options.find(\")\")\n",
    "                    DHCP_options=int(DHCP_options[x-1])\n",
    "                    \n",
    "            else:\n",
    "                DHCP_options=0            \n",
    "\n",
    "\n",
    "            if j.haslayer(BOOTP):\n",
    "                BOOTP_op=j[BOOTP].op\n",
    "                BOOTP_htype=j[BOOTP].htype\n",
    "                BOOTP_hlen=j[BOOTP].hlen\n",
    "                BOOTP_hops=j[BOOTP].hops\n",
    "                BOOTP_xid=j[BOOTP].xid\n",
    "                BOOTP_secs=j[BOOTP].secs\n",
    "                BOOTP_flags=j[BOOTP].flags\n",
    "                #if \"Flag\" in str(BOOTP_flags):BOOTP_flags=str(BOOTP_flags)temp=BOOTP_flags.find(\"(\") BOOTP_flags=int(BOOTP_flags[6:temp-1])\n",
    "                BOOTP_ciaddr=j[BOOTP].ciaddr\n",
    "                BOOTP_yiaddr=j[BOOTP].yiaddr\n",
    "                BOOTP_siaddr=j[BOOTP].siaddr\n",
    "                BOOTP_giaddr=j[BOOTP].giaddr\n",
    "                BOOTP_chaddr=j[BOOTP].chaddr\n",
    "                BOOTP_sname=str(j[BOOTP].sname)\n",
    "                if BOOTP_sname!=\"0\":\n",
    "                    BOOTP_sname=1\n",
    "                else:\n",
    "                    BOOTP_sname=0\n",
    "                BOOTP_file=str(j[BOOTP].file)\n",
    "                if BOOTP_file!=\"0\":\n",
    "                    BOOTP_file=1\n",
    "                else:\n",
    "                    BOOTP_file=0\n",
    "                \n",
    "                BOOTP_options=str(j[BOOTP].options)\n",
    "                BOOTP_options=BOOTP_options.replace(\",\",\"-\")\n",
    "                if BOOTP_options!=\"0\":\n",
    "                    BOOTP_options=1\n",
    "                else:\n",
    "                    BOOTP_options=0\n",
    "            else:\n",
    "                BOOTP_op=0\n",
    "                BOOTP_htype=0\n",
    "                BOOTP_hlen=0\n",
    "                BOOTP_hops=0\n",
    "                BOOTP_xid=0\n",
    "                BOOTP_secs=0\n",
    "                BOOTP_flags=0\n",
    "                BOOTP_ciaddr=0\n",
    "                BOOTP_yiaddr=0\n",
    "                BOOTP_siaddr=0\n",
    "                BOOTP_giaddr=0\n",
    "                BOOTP_chaddr=0\n",
    "                BOOTP_sname=0\n",
    "                BOOTP_file=0\n",
    "                BOOTP_options=0\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "            if j.haslayer(DNS):\n",
    "                DNS_length=j[DNS].length\n",
    "                DNS_id=j[DNS].id\n",
    "                DNS_qr=j[DNS].qr\n",
    "                DNS_opcode=j[DNS].opcode\n",
    "                DNS_aa=j[DNS].aa\n",
    "                DNS_tc=j[DNS].tc\n",
    "                DNS_rd=j[DNS].rd\n",
    "                DNS_ra=j[DNS].ra\n",
    "                DNS_z=j[DNS].z\n",
    "                DNS_ad=j[DNS].ad\n",
    "                DNS_cd=j[DNS].cd\n",
    "                DNS_rcode=j[DNS].rcode\n",
    "                DNS_qdcount=j[DNS].qdcount\n",
    "                DNS_ancount=j[DNS].ancount\n",
    "                DNS_nscount=j[DNS].nscount\n",
    "                DNS_arcount=j[DNS].arcount\n",
    "                DNS_qd=str(j[DNS].qd).replace(\",\",\"-\")\n",
    "                if DNS_qd!=\"0\":\n",
    "                    DNS_qd=1\n",
    "                else:\n",
    "                    DNS_qd=0\n",
    "                DNS_an=str(j[DNS].an).replace(\",\",\"-\")\n",
    "                if DNS_an!=\"0\":\n",
    "                    DNS_an=1\n",
    "                else:\n",
    "                    DNS_an=0\n",
    "                DNS_ns=str(j[DNS].ns).replace(\",\",\"-\")\n",
    "                if DNS_ns!=\"0\":\n",
    "                    DNS_ns=1\n",
    "                else:\n",
    "                    DNS_ns=0\n",
    "                DNS_ar=str(j[DNS].ar).replace(\",\",\"-\")\n",
    "                if DNS_ar!=\"0\":\n",
    "                    DNS_ar=1\n",
    "                else:\n",
    "                    DNS_ar=0\n",
    "            else:\n",
    "                DNS_length=0\n",
    "                DNS_id=0\n",
    "                DNS_qr=0\n",
    "                DNS_opcode=0\n",
    "                DNS_aa=0\n",
    "                DNS_tc=0\n",
    "                DNS_rd=0\n",
    "                DNS_ra=0\n",
    "                DNS_z=0\n",
    "                DNS_ad=0\n",
    "                DNS_cd=0\n",
    "                DNS_rcode=0\n",
    "                DNS_qdcount=0\n",
    "                DNS_ancount=0\n",
    "                DNS_nscount=0\n",
    "                DNS_arcount=0\n",
    "                DNS_qd=0\n",
    "                DNS_an=0\n",
    "                DNS_ns=0\n",
    "                DNS_ar=0\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "            pdata=[]\n",
    "            if \"TCP\" in j:            \n",
    "                pdata = (j[TCP].payload)\n",
    "            if \"Raw\" in j:\n",
    "                pdata = (j[Raw].load)\n",
    "            elif \"UDP\" in j:            \n",
    "                pdata = (j[UDP].payload)\n",
    "            elif \"ICMP\" in j:            \n",
    "                pdata = (j[ICMP].payload)\n",
    "            pdata=list(memoryview(bytes(pdata)))            \n",
    "    \n",
    "            if pdata!=[]:\n",
    "                entropy=shannon(pdata)        \n",
    "            else:\n",
    "                entropy=0\n",
    "            payload_bytes=len(pdata)\n",
    "\n",
    "            sport_class=port_class(TCP_sport+UDP_sport)\n",
    "            dport_class=port_class(TCP_dport+UDP_dport)\n",
    "            sport23=port_1023(TCP_sport+UDP_sport)\n",
    "            dport23=port_1023(TCP_dport+UDP_dport)\n",
    "            sport_bare=TCP_sport+UDP_sport\n",
    "            dport_bare=TCP_dport+UDP_dport#port_class(TCP_dport+UDP_dport)\n",
    "            \n",
    "            try:\n",
    "                label=MAC_list[j.src]\n",
    "            except:\n",
    "                label=\"\"\n",
    "            Mac=j.src             \n",
    "            \n",
    "            \n",
    "            \n",
    "            \n",
    "            line=[pck_size,\n",
    "            Ether_type,\n",
    "            LLC_dsap,\n",
    "            LLC_ssap,\n",
    "            LLC_ctrl,\n",
    "            EAPOL_version,\n",
    "            EAPOL_type,\n",
    "            EAPOL_len,\n",
    "            IP_version,\n",
    "            IP_ihl,\n",
    "            IP_tos,\n",
    "            IP_len,\n",
    "            IP_flags,\n",
    "            IP_Z,\n",
    "            IP_MF,\n",
    "            IP_id,\n",
    "            IP_chksum,\n",
    "            IP_DF  ,\n",
    "            IP_frag,\n",
    "            IP_ttl,\n",
    "            IP_proto,\n",
    "            IP_options,\n",
    "            IP_add_count,\n",
    "            ICMP_type,\n",
    "            ICMP_code,\n",
    "            ICMP_chksum,\n",
    "            ICMP_id,\n",
    "            ICMP_seq,\n",
    "            ICMP_ts_ori,\n",
    "            ICMP_ts_rx,\n",
    "            ICMP_ts_tx,\n",
    "            ICMP_ptr,\n",
    "            ICMP_reserved,\n",
    "            ICMP_length,\n",
    "            #ICMP_addr_mask,\n",
    "            ICMP_nexthopmtu,\n",
    "            ICMP_unused,\n",
    "            TCP_seq,\n",
    "            TCP_ack,\n",
    "            TCP_dataofs,\n",
    "            TCP_reserved,\n",
    "            TCP_flags,\n",
    "            TCP_FIN,\n",
    "            TCP_SYN,\n",
    "            TCP_RST,\n",
    "            TCP_PSH,\n",
    "            TCP_ACK,\n",
    "            TCP_URG,\n",
    "            TCP_ECE,\n",
    "            TCP_CWR   ,\n",
    "            TCP_window,\n",
    "            TCP_chksum,\n",
    "            TCP_urgptr,\n",
    "            TCP_options,\n",
    "            UDP_len,\n",
    "            UDP_chksum,\n",
    "            DHCP_options,\n",
    "            BOOTP_op,\n",
    "            BOOTP_htype,\n",
    "            BOOTP_hlen,\n",
    "            BOOTP_hops,\n",
    "            BOOTP_xid,\n",
    "            BOOTP_secs,\n",
    "            BOOTP_flags,\n",
    "            BOOTP_sname,\n",
    "            BOOTP_file,\n",
    "            BOOTP_options,\n",
    "            DNS_length,\n",
    "            DNS_id,\n",
    "            DNS_qr,\n",
    "            DNS_opcode,\n",
    "            DNS_aa,\n",
    "            DNS_tc,\n",
    "            DNS_rd,\n",
    "            DNS_ra,\n",
    "            DNS_z,\n",
    "            DNS_ad,\n",
    "            DNS_cd,\n",
    "            DNS_rcode,\n",
    "            DNS_qdcount,\n",
    "            DNS_ancount,\n",
    "            DNS_nscount,\n",
    "            DNS_arcount,\n",
    "            sport_class,\n",
    "            dport_class,\n",
    "            sport23,\n",
    "            dport23,\n",
    "            sport_bare,\n",
    "            dport_bare,\n",
    "            TCP_sport,\n",
    "            TCP_dport,\n",
    "            UDP_sport,\n",
    "            UDP_dport, \n",
    "            payload_bytes,\n",
    "            entropy,\n",
    "            Mac,\n",
    "            label]\n",
    "\n",
    "            #print(line)\n",
    "            line=str(line).replace(\"[\",\"\")\n",
    "            line=str(line).replace(\"]\",\"\")\n",
    "            #line=str(line).replace(\"\\',\",\"-\")\n",
    "            line=str(line).replace(\", \",\",\")\n",
    "            line=str(line).replace(\"\\'\",\"\")\n",
    "            line=str(line).replace(\"None\",\"0\")\n",
    "            if label!=\"\":\n",
    "                ths.write(str(line)+\"\\n\")  \n",
    "            #kk=line.split(\",\")\n",
    "            #print(len(kk))\n",
    "            #if len(kk)==112:\n",
    "            #ths.write(line+\"\\n\")\n",
    "            \n",
    "            #else:print(line)\n",
    "    print(\"  - \",numero+1,\"/\",len(files_add))    \n",
    "    ths.close()          \n",
    "    "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "   1  /  18\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "c:\\users\\kahraman\\appdata\\local\\programs\\python\\python36\\lib\\site-packages\\IPython\\core\\interactiveshell.py:2728: DtypeWarning: Columns (62) have mixed types.Specify dtype option on import or set low_memory=False.\n",
      "  interactivity=interactivity, compiler=compiler, result=result)\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "   2  /  18\n",
      "   3  /  18\n",
      "   4  /  18\n",
      "   5  /  18\n",
      "   6  /  18\n",
      "   7  /  18\n",
      "   8  /  18\n",
      "   9  /  18\n",
      "   10  /  18\n",
      "   11  /  18\n",
      "   12  /  18\n",
      "   13  /  18\n",
      "   14  /  18\n",
      "   15  /  18\n",
      "   16  /  18\n",
      "   17  /  18\n",
      "   18  /  18\n"
     ]
    }
   ],
   "source": [
    "for ii,i in enumerate(files_add):\n",
    "    filename=i[:-4]+\".csv\"\n",
    "    ths = open(\"Protocol.csv\", \"w\")\n",
    "    ths.write(\"Protocol\\n\")\n",
    "    \n",
    "    command=\"tshark -r \"+i+\" -T fields -e _ws.col.Protocol -E header=n -E separator=, -E quote=d -E occurrence=f > temp.csv\"\n",
    "    os.system(command)\n",
    "\n",
    "    with open(\"temp.csv\", \"r\") as file:\n",
    "        while True:\n",
    "            line=file.readline()\n",
    "            if line==\"\":break\n",
    "            if  \"ARP\" not in line:# this line eliminates the headers of CSV files and incomplete streams .\n",
    "                ths.write(str(line))\n",
    "            else:\n",
    "                continue                       \n",
    "    ths.close()  \n",
    "    print(\"   {}  /  {}\".format(ii+1,len(files_add)))    \n",
    "    os.remove(\"temp.csv\")\n",
    "    df1=pd.read_csv(filename)\n",
    "    df2=pd.read_csv(\"Protocol.csv\")\n",
    "    df1[\"Protocol\"]=df2[\"Protocol\"]        \n",
    "    label=df1[\"Label\"]\n",
    "    del df1[\"Label\"]\n",
    "    df1[\"Label\"]=label\n",
    "    df1.to_csv(filename,index=None)\n",
    "os.remove(\"Protocol.csv\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "________________"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "['./UNSW_PCAP/shared\\\\16-10-07.pcap2-NestDropcam@..csv',\n",
       " './UNSW_PCAP/shared\\\\unknownmaybecam..csv']"
      ]
     },
     "execution_count": 22,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "name_list=find_the_way('./UNSW_PCAP/shared','.csv')\n",
    "name_list"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "c:\\users\\kahraman\\appdata\\local\\programs\\python\\python36\\lib\\site-packages\\IPython\\core\\interactiveshell.py:2728: DtypeWarning: Columns (62) have mixed types.Specify dtype option on import or set low_memory=False.\n",
      "  interactivity=interactivity, compiler=compiler, result=result)\n"
     ]
    }
   ],
   "source": [
    "from sklearn.model_selection import train_test_split\n",
    "for name in name_list:    \n",
    "    df=pd.read_csv(name)#,header=None) \n",
    "    X =df[df.columns[0:-1]]\n",
    "    df[df.columns[-1]] = df[df.columns[-1]].astype('category')\n",
    "    y=df[df.columns[-1]]\n",
    "\n",
    "    # setting up testing and training sets\n",
    "    X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.20, random_state=27,stratify=y)\n",
    "\n",
    "    # concatenate our training data back together\n",
    "    train = pd.concat([X_train, y_train], axis=1)\n",
    "\n",
    "\n",
    "    file=name[0:-5]+\"_\"+\"_TRAIN.csv\"\n",
    "    train.to_csv(file,index=False)\n",
    "\n",
    "\n",
    "    test= pd.concat([X_test, y_test], axis=1)\n",
    "\n",
    "    file=name[0:-5]+\"_\"+\"_TEST.csv\"\n",
    "    test.to_csv(file,index=False)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [],
   "source": [
    "shared_train=find_the_way('./UNSW_PCAP/shared','TRAIN.csv')\n",
    "shared_test=find_the_way('./UNSW_PCAP/shared','TEST.csv')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "['./UNSW_PCAP/shared\\\\16-10-07.pcap2-NestDropcam@__TRAIN.csv',\n",
       " './UNSW_PCAP/shared\\\\unknownmaybecam__TRAIN.csv']"
      ]
     },
     "execution_count": 25,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "shared_train"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [],
   "source": [
    "IP_flags = {'0': 1, '<Flag 0 ()>': 2, '<Flag 2 (DF)>': 3, '<Flag 1 (MF)>': 4}\n",
    "TCP_flags = {'0': 1, '<Flag 2 (S)>': 2, '<Flag 18 (SA)>': 3, '<Flag 16 (A)>': 4, '<Flag 24 (PA)>': 5, '<Flag 25 (FPA)>': 6, '<Flag 17 (FA)>': 7, '<Flag 4 (R)>': 8, '<Flag 20 (RA)>': 9, '<Flag 194 (SEC)>': 10, '<Flag 1 (F)>': 11, '<Flag 152 (PAC)>': 12, '<Flag 144 (AC)>': 13,'<Flag 82 (SAE)>':14,'<Flag 49 (FAU)>':15}\n",
    "BOOTP_flags = {'0': 1, '<Flag 0 ()>': 2, '<Flag 32768 (B)>': 3, 0: 1}\n",
    "Protocol = {'EAPOL': 1, 'DHCP': 2, 'DNS': 3, 'TCP': 4, 'HTTP': 5, 'ICMP': 6, 'MDNS': 7, 'IGMPv3': 8, 'SSDP': 9, 'NTP': 10, 'HTTP/XML': 11, 'UDP': 12, 'SSLv2': 13, 'TLSv1': 14, 'ADwin Config': 15, 'TLSv1.2': 16, 'ICMPv6': 17, 'HTTP/JSON': 18, 'XID': 19, 'TFTP': 20, 'NXP 802.15.4 SNIFFER': 21, 'IGMPv2': 22, 'A21': 23, 'STUN': 24, 'Gearman': 25, '? KNXnet/IP': 26, 'UDPENCAP': 27, 'ESP': 28, 'SSL': 29, 'NBNS': 30, 'SIP': 31, 'BROWSER': 32, 'SABP': 33, 'ISAKMP': 34, 'CLASSIC-STUN': 35, 'Omni-Path': 36, 'XMPP/XML': 37, 'ULP': 38, 'TFP over TCP': 39, 'AX4000': 40, 'MIH': 41, 'DHCPv6': 42, 'TDLS': 43, 'RTMP': 44, 'TCPCL': 45, 'IPA': 46, 'GQUIC': 47, '0x86dd': 48, 'DB-LSP-DISC': 49, 'SSLv3': 50, 'LLMNR': 51, 'FB_ZERO': 52, 'OCSP': 53, 'IPv4': 54, 'STP': 55, 'SSH': 56, 'TLSv1.1': 57, 'KINK': 58, 'MANOLITO': 59, 'PKTC': 60, 'TELNET': 61, 'RTSP': 62, 'HCrt': 63, 'MPTCP': 64, 'S101': 65, 'IRC': 66, 'AJP13': 67, 'PMPROXY': 68, 'PNIO': 69, 'AMS': 70, 'ECATF': 71, 'LLC': 72, 'TZSP': 73,'RSIP':74,'SSHv2':75\n",
    ",'DIAMETER':76\n",
    ",'BFD Control':77\n",
    ",'ASAP':78\n",
    ",'DISTCC':79 \n",
    ",'DISTCC ':79       \n",
    ",'LISP':80\n",
    ",'WOW':81\n",
    ",'DTLSv1.0':82\n",
    ",'SNMP':83\n",
    ",'SMB2':84\n",
    ",'SMB':85\n",
    ",'NBSS':86\n",
    ",'UDT':87,'HiQnet':88\n",
    ",'POWERLINK/UDP':89\n",
    ",'RTP':90\n",
    ",'WebSocket':91\n",
    ",'NAT-PMP':92\n",
    ",'RTCP':93,'Syslog':94\n",
    ",'Portmap':95\n",
    ",'OpenVPN':96\n",
    ",'BJNP':97\n",
    ",'RIPv1':98\n",
    ",'MAC-Telnet':99\n",
    ",'ECHO':100\n",
    ",'ASF':101\n",
    ",'DAYTIME':102\n",
    ",'SRVLOC':103\n",
    ",'KRB4':104\n",
    ",'CAPWAP-Control':105\n",
    ",'XDMCP':106\n",
    ",'Chargen':107\n",
    ",'RADIUS':108\n",
    ",'L2TP':109\n",
    ",'DCERPC':110\n",
    ",'KPASSWD':111\n",
    ",'H264':112\n",
    ",'FTP':113\n",
    ",'FTP-DATA':114\n",
    ",'ENIP':115\n",
    ",'RIPv2':116\n",
    ",'ICP':117,\n",
    "\"BACnet-APDU\":118,\n",
    "\"IAX2\":119,\n",
    "\"RX\":120,\n",
    "\"HTTP2\":121,\n",
    "\"SIP/SDP\":122,\n",
    "\"TIME\":123,\n",
    "\"Elasticsearch\":124,\n",
    "\"RSL\":125,\n",
    "\"TPCP\":126,\n",
    " \"IPv6\":  127 }\n",
    "Folder= {'Aria': 'Aria', 'D-LinkCam': 'D-LinkCam', 'D-LinkDayCam': 'D-LinkDayCam', 'D-LinkDoorSensor': 'D-LinkDoorSensor', 'D-LinkHomeHub': 'D-LinkHomeHub', 'D-LinkSensor': 'D-LinkSensor', 'D-LinkSiren': 'D-LinkSiren', 'D-LinkSwitch': 'D-LinkSwitch', 'D-LinkWaterSensor': 'D-LinkWaterSensor', 'EdimaxCam1': 'EdimaxCam', 'EdimaxCam2': 'EdimaxCam', 'EdimaxPlug1101W': 'EdimaxPlug1101W', 'EdimaxPlug2101W': 'EdimaxPlug2101W', 'EdnetCam1': 'EdnetCam', 'EdnetCam2': 'EdnetCam', 'EdnetGateway': 'EdnetGateway', 'HomeMaticPlug': 'HomeMaticPlug', 'HueBridge': 'HueBridge', 'HueSwitch': 'HueSwitch', 'iKettle2': 'iKettle2', 'Lightify': 'Lightify', 'MAXGateway': 'MAXGateway', 'SmarterCoffee': 'SmarterCoffee', 'TP-LinkPlugHS100': 'TP-LinkPlugHS100', 'TP-LinkPlugHS110': 'TP-LinkPlugHS110', 'WeMoInsightSwitch': 'WeMoInsightSwitch', 'WeMoInsightSwitch2': 'WeMoInsightSwitch', 'WeMoLink': 'WeMoLink', 'WeMoSwitch': 'WeMoSwitch', 'WeMoSwitch2': 'WeMoSwitch', 'Withings': 'Withings'}\n",
    "\n",
    "label= {'Android Phone 1':'Non-IoT', 'Android Phone 2': 'Non-IoT',\n",
    "'Samsung Galaxy Tab':'Non-IoT',\n",
    "\"Laptop\":'Non-IoT',\n",
    "\"IPhone\":'Non-IoT',\n",
    "\"MacBook\":'Non-IoT',                   \n",
    "\"MacBook/Iphone\":'Non-IoT',\n",
    "\"Samsung Galaxy Tab\":'Non-IoT',\n",
    "\"MacBook-Iphone\":'Non-IoT' }\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "['./UNSW_PCAP/shared\\\\16-10-07.pcap2-NestDropcam@..csv',\n",
       " './UNSW_PCAP/shared\\\\unknownmaybecam..csv']"
      ]
     },
     "execution_count": 27,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "\n",
    "name_list"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "c:\\users\\kahraman\\appdata\\local\\programs\\python\\python36\\lib\\site-packages\\IPython\\core\\interactiveshell.py:2728: DtypeWarning: Columns (62) have mixed types.Specify dtype option on import or set low_memory=False.\n",
      "  interactivity=interactivity, compiler=compiler, result=result)\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "./UNSW_PCAP/TRAIN\\16-10-01-SmartThings@..csv (11781, 97)\n",
      "./UNSW_PCAP/TRAIN\\16-10-14_00003_20161014041654-PIX-STARPhoto-frame@..csv (10633, 97)\n",
      "./UNSW_PCAP/TRAIN\\BlipcareBloodPressuremeter..csv (90, 97)\n",
      "./UNSW_PCAP/TRAIN\\HelloBarbie..csv (150, 97)\n",
      "./UNSW_PCAP/TRAIN\\IPhone..csv (5972, 97)\n",
      "./UNSW_PCAP/TRAIN\\LightBulbsLiFXSmartBulb..csv (9412, 97)\n",
      "./UNSW_PCAP/shared\\16-10-07.pcap2-NestDropcam@__TRAIN.csv (38141, 97)\n",
      "./UNSW_PCAP/shared\\unknownmaybecam__TRAIN.csv (272, 97)\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "c:\\users\\kahraman\\appdata\\local\\programs\\python\\python36\\lib\\site-packages\\IPython\\core\\interactiveshell.py:2728: DtypeWarning: Columns (0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,95) have mixed types.Specify dtype option on import or set low_memory=False.\n",
      "  interactivity=interactivity, compiler=compiler, result=result)\n"
     ]
    }
   ],
   "source": [
    "name_list=find_the_way('./UNSW_PCAP/TRAIN','.csv')\n",
    "name_list=name_list+shared_train\n",
    "name={\"UNSW_train_IoTDevID.csv\":8000}\n",
    "\n",
    "\n",
    "df=pd.read_csv(name_list[0])\n",
    "col_names=list(df.columns)\n",
    "\n",
    "for i in name:\n",
    "    \n",
    "    empty = pd.DataFrame(columns=col_names)\n",
    "    empty.to_csv(i, mode=\"a\", index=False)#,header=False)\n",
    "\n",
    "    for iii in name_list:\n",
    "\n",
    "        df=pd.read_csv(iii)\n",
    "        print(iii,df.shape)\n",
    "        if len(df)>name[i]:\n",
    "            df=df.sample(n=name[i], random_state=0)\n",
    "        df.to_csv(i, mode=\"a\", index=False,header=False)\n",
    "\n",
    "    df=pd.read_csv(i)\n",
    "    df=df.replace({\"IP_flags\": IP_flags})\n",
    "    df=df.replace({\"TCP_flags\": TCP_flags})\n",
    "    df=df.replace({\"BOOTP_flags\": BOOTP_flags})\n",
    "    df=df.replace({\"Protocol\": Protocol})\n",
    "    df=df.replace({\"Label\": label})\n",
    "    df.to_csv(i,index=None)\n",
    "\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "./UNSW_PCAP/TEST\\16-09-23-PIX-STARPhoto-frame@..csv (4090, 97)\n",
      "./UNSW_PCAP/TEST\\16-09-23-TP-LinkDayNightCloudcamera@..csv (5585, 97)\n",
      "./UNSW_PCAP/TEST\\16-09-23-TribySpeaker@..csv (3505, 97)\n",
      "./UNSW_PCAP/TEST\\16-09-29-iHome@..csv (3151, 97)\n",
      "./UNSW_PCAP/TEST\\16-09-29-LightBulbsLiFXSmartBulb@..csv (4958, 97)\n",
      "./UNSW_PCAP/TEST\\16-10-04.pcap10-BlipcareBloodPressuremeter@..csv (29, 97)\n",
      "./UNSW_PCAP/TEST\\HelloBarbie..csv (14, 97)\n",
      "./UNSW_PCAP/TEST\\IPhone..csv (1323, 97)\n",
      "./UNSW_PCAP/TEST\\NESTProtectsmokealarm..csv (1479, 97)\n",
      "./UNSW_PCAP/TEST\\WithingsSmartscale..csv (1536, 97)\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "c:\\users\\kahraman\\appdata\\local\\programs\\python\\python36\\lib\\site-packages\\IPython\\core\\interactiveshell.py:2728: DtypeWarning: Columns (62) have mixed types.Specify dtype option on import or set low_memory=False.\n",
      "  interactivity=interactivity, compiler=compiler, result=result)\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "./UNSW_PCAP/shared\\16-10-07.pcap2-NestDropcam@__TEST.csv (9536, 97)\n",
      "./UNSW_PCAP/shared\\unknownmaybecam__TEST.csv (68, 97)\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "c:\\users\\kahraman\\appdata\\local\\programs\\python\\python36\\lib\\site-packages\\IPython\\core\\interactiveshell.py:2728: DtypeWarning: Columns (0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96) have mixed types.Specify dtype option on import or set low_memory=False.\n",
      "  interactivity=interactivity, compiler=compiler, result=result)\n"
     ]
    }
   ],
   "source": [
    "name_list=find_the_way('./UNSW_PCAP/TEST','.csv')\n",
    "name_list=name_list+shared_test\n",
    "name={\"UNSW_test_IoTDevID.csv\":2000}\n",
    "\n",
    "\n",
    "df=pd.read_csv(name_list[0])\n",
    "col_names=list(df.columns)\n",
    "\n",
    "for i in name:\n",
    "    \n",
    "    empty = pd.DataFrame(columns=col_names)\n",
    "    empty.to_csv(i, mode=\"a\", index=False)#,header=False)\n",
    "\n",
    "    for iii in name_list:\n",
    "\n",
    "        df=pd.read_csv(iii)\n",
    "        print(iii,df.shape)\n",
    "        if len(df)>name[i]:\n",
    "            df=df.sample(n=name[i], random_state=0)\n",
    "        df.to_csv(i, mode=\"a\", index=False,header=False)\n",
    "\n",
    "    df=pd.read_csv(i)\n",
    "    df=df.replace({\"IP_flags\": IP_flags})\n",
    "    df=df.replace({\"TCP_flags\": TCP_flags})\n",
    "    df=df.replace({\"BOOTP_flags\": BOOTP_flags})\n",
    "    df=df.replace({\"Protocol\": Protocol})\n",
    "    df=df.replace({\"Label\": label})\n",
    "    df.to_csv(i,index=None)\n",
    "\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Delete unnecessary CSV files"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "metadata": {},
   "outputs": [],
   "source": [
    "name_list=find_the_way('./UNSW_PCAP/','.csv')\n",
    "for i in name_list:\n",
    "    os.remove(i)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "colab": {
   "collapsed_sections": [],
   "name": "(105) feature exracto_colab.ipynb",
   "provenance": []
  },
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.8"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 1
}