Decision_Tree_Classifier.ipynb

{
  "cells": [
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "view-in-github",
        "colab_type": "text"
      },
      "source": [
        "<a href=\"https://colab.research.google.com/github/Sourabhsahu33/ML-Algorithms/blob/main/Decision_Tree_Classifier.ipynb\" target=\"_parent\"><img src=\"https://colab.research.google.com/assets/colab-badge.svg\" alt=\"Open In Colab\"/></a>"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 2,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "9hIeCksbLQ1C",
        "outputId": "a1b668f4-7486-48a1-e77b-2faeb2cffa70"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "\n",
            " Given Malware Behaviour Dataset:\n",
            "\n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "0      Malware         Blocked              Yes               No\n",
            "1     Phishing         Allowed               No              Yes\n",
            "2         DDoS         Blocked               No               No\n",
            "3   Ransomware         Blocked              Yes               No\n",
            "4    Intrusion         Blocked               No               No\n",
            "5      Malware         Blocked              Yes              Yes\n",
            "6     Phishing         Allowed               No               No\n",
            "7         DDoS         Blocked               No               No\n",
            "8   Ransomware         Blocked              Yes               No\n",
            "9    Intrusion         Blocked               No               No\n",
            "10     Malware         Blocked              Yes              Yes\n",
            "11    Phishing         Allowed               No              Yes\n",
            "12        DDoS         Blocked               No               No\n",
            "13  Ransomware         Blocked              Yes              Yes\n",
            "14   Intrusion         Blocked               No               No\n",
            "15    Phishing         Allowed               No               No\n"
          ]
        }
      ],
      "source": [
        "import pandas as pd\n",
        "\n",
        "df = pd.read_csv(\"Tree_Data.csv\")\n",
        "print(\"\\n Given Malware Behaviour Dataset:\\n\\n\", df)"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "7ysOnK02LQ1F"
      },
      "source": [
        "# Attribute Prediction"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 3,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "FWhpKYVGLQ1H",
        "outputId": "8293bc93-d3c6-4f2d-f662-3ec9cc80c9c8"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "Target Attribute is   ➡  Data Exfiltrated\n",
            "Predicting Attributes ➡  ['Attack Type', 'Firewall Status', 'Malware Detected']\n"
          ]
        }
      ],
      "source": [
        "t = df.keys()[-1]\n",
        "print('Target Attribute is   ➡ ', t)\n",
        "\n",
        "# Get the attribute names from input dataset\n",
        "attribute_names = list(df.keys())\n",
        "\n",
        "#Remove the target attribute from the attribute names list\n",
        "attribute_names.remove(t)\n",
        "\n",
        "print('Predicting Attributes ➡ ', attribute_names)"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "zdsJnjV7LQ1I"
      },
      "source": [
        "# Entropy of the Training Data Set"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 4,
      "metadata": {
        "id": "CvMHUzpdLQ1J"
      },
      "outputs": [],
      "source": [
        "#Function to calculate the entropy of probaility of observations\n",
        "# -p*log2*p\n",
        "\n",
        "import math\n",
        "def entropy(probs):\n",
        "    return sum( [-prob*math.log(prob, 2) for prob in probs])\n",
        "\n",
        "#Function to calulate the entropy of the given Datasets/List with respect to target attributes\n",
        "def entropy_of_list(ls,value):\n",
        "    from collections import Counter\n",
        "\n",
        "    # Total intances associated with respective attribute\n",
        "    total_instances = len(ls)  # = 14\n",
        "    print(\"---------------------------------------------------------\")\n",
        "    print(\"\\nTotal no of instances/records associated with '{0}' is ➡ {1}\".format(value,total_instances))\n",
        "    # Counter calculates the propotion of class\n",
        "    cnt = Counter(x for x in ls)\n",
        "    print('\\nTarget attribute class count(Yes/No)=',dict(cnt))\n",
        "\n",
        "    # x means no of YES/NO\n",
        "    probs = [x / total_instances for x in cnt.values()]\n",
        "    print(\"\\nClasses➡\", max(cnt), min(cnt))\n",
        "    print(\"\\nProbabilities of Class 'p'='{0}' ➡ {1}\".format(max(cnt),max(probs)))\n",
        "    print(\"Probabilities of Class 'n'='{0}'  ➡ {1}\".format(min(cnt),min(probs)))\n",
        "\n",
        "    # Call Entropy\n",
        "    return entropy(probs)"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "pODbK5zcLQ1J"
      },
      "source": [
        "# Information Gain of Attributes"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 5,
      "metadata": {
        "id": "oh25BRdkLQ1K"
      },
      "outputs": [],
      "source": [
        "def information_gain(df, split_attribute, target_attribute,battr):\n",
        "    print(\"\\n\\n----- Information Gain Calculation of\",split_attribute,\"----- \")\n",
        "\n",
        "    # group the data based on attribute values\n",
        "    df_split = df.groupby(split_attribute)\n",
        "    glist=[]\n",
        "    for gname,group in df_split:\n",
        "        print('Grouped Attribute Values \\n',group)\n",
        "        print(\"---------------------------------------------------------\")\n",
        "        glist.append(gname)\n",
        "\n",
        "    glist.reverse()\n",
        "    nobs = len(df.index) * 1.0\n",
        "    df_agg1=df_split.agg({target_attribute:lambda x:entropy_of_list(x, glist.pop())})\n",
        "    df_agg2=df_split.agg({target_attribute :lambda x:len(x)/nobs})\n",
        "\n",
        "    df_agg1.columns=['Entropy']\n",
        "    df_agg2.columns=['Proportion']\n",
        "\n",
        "    # Calculate Information Gain:\n",
        "    new_entropy = sum( df_agg1['Entropy'] * df_agg2['Proportion'])\n",
        "    if battr !='S':\n",
        "        old_entropy = entropy_of_list(df[target_attribute],'S-'+df.iloc[0][df.columns.get_loc(battr)])\n",
        "    else:\n",
        "        old_entropy = entropy_of_list(df[target_attribute],battr)\n",
        "    return old_entropy - new_entropy"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "HTq6Py-xLQ1K"
      },
      "source": [
        "# Using ID3 Algorithm"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 6,
      "metadata": {
        "id": "LKaPsKL2LQ1L"
      },
      "outputs": [],
      "source": [
        "def id3(df, target_attribute, attribute_names, default_class=None,default_attr='S'):\n",
        "\n",
        "    from collections import Counter\n",
        "    cnt = Counter(x for x in df[target_attribute])# class of YES /NO\n",
        "\n",
        "    ## First check: Is this split of the dataset homogeneous?\n",
        "    if len(cnt) == 1:\n",
        "        return next(iter(cnt))  # next input data set, or raises StopIteration when EOF is hit.\n",
        "\n",
        "    ## Second check: Is this split of the dataset empty? if yes, return a default value\n",
        "    elif df.empty or (not attribute_names):\n",
        "        return default_class  # Return None for Empty Data Set\n",
        "\n",
        "    ## Otherwise: This dataset is ready to be devied up!\n",
        "    else:\n",
        "        # Get Default Value for next recursive call of this function:\n",
        "        default_class = max(cnt.keys()) #No of YES and NO Class\n",
        "        # Compute the Information Gain of the attributes:\n",
        "        gainz=[]\n",
        "        for attr in attribute_names:\n",
        "            ig= information_gain(df, attr, target_attribute,default_attr)\n",
        "            gainz.append(ig)\n",
        "            print('\\nInformation gain of','“',attr,'”','is ➡', ig)\n",
        "            print(\"=========================================================\")\n",
        "\n",
        "        index_of_max = gainz.index(max(gainz))               # Index of Best Attribute\n",
        "        best_attr = attribute_names[index_of_max]            # Choose Best Attribute to split on\n",
        "        print(\"\\nList of Gain for arrtibutes:\",attribute_names,\"\\nare:\", gainz,\"respectively.\")\n",
        "        print(\"\\nAttribute with the maximum gain is ➡\", best_attr)\n",
        "        print(\"\\nHence, the Root node will be ➡\", best_attr)\n",
        "        print(\"=========================================================\")\n",
        "\n",
        "        # Create an empty tree, to be populated in a moment\n",
        "        tree = {best_attr:{}} # Initiate the tree with best attribute as a node\n",
        "        remaining_attribute_names =[i for i in attribute_names if i != best_attr]\n",
        "\n",
        "        # Split dataset-On each split, recursively call this algorithm.Populate the empty tree with subtrees, which\n",
        "        # are the result of the recursive call\n",
        "        for attr_val, data_subset in df.groupby(best_attr):\n",
        "            subtree = id3(data_subset,target_attribute, remaining_attribute_names,default_class,best_attr)\n",
        "            tree[best_attr][attr_val] = subtree\n",
        "        return tree\n"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "kvmNTEsuLQ1L"
      },
      "source": [
        "# Tree formation"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 7,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "XIPm10EhLQ1M",
        "outputId": "b2fbd47e-d8c5-4f0c-f406-c0cdafcdef7d"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "Entropy calculation for input dataset:\n",
            "\n",
            "0      No\n",
            "1     Yes\n",
            "2      No\n",
            "3      No\n",
            "4      No\n",
            "5     Yes\n",
            "6      No\n",
            "7      No\n",
            "8      No\n",
            "9      No\n",
            "10    Yes\n",
            "11    Yes\n",
            "12     No\n",
            "13    Yes\n",
            "14     No\n",
            "15     No\n",
            "Name: Data Exfiltrated, dtype: object\n",
            "\n",
            "Number of Instances of the Current Sub-Class is 16.0\n",
            "\n",
            "Classes➡ 'p'= Yes 'n'= No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6875\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3125\n",
            "\n",
            "Total Entropy(S) of Tree_Data Dataset➡ 0.8960382325345575\n",
            "=========================================================\n",
            "\n",
            "\n",
            "----- Information Gain Calculation of Attack Type ----- \n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "2         DDoS         Blocked               No               No\n",
            "7         DDoS         Blocked               No               No\n",
            "12        DDoS         Blocked               No               No\n",
            "---------------------------------------------------------\n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "4    Intrusion         Blocked               No               No\n",
            "9    Intrusion         Blocked               No               No\n",
            "14   Intrusion         Blocked               No               No\n",
            "---------------------------------------------------------\n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "0      Malware         Blocked              Yes               No\n",
            "5      Malware         Blocked              Yes              Yes\n",
            "10     Malware         Blocked              Yes              Yes\n",
            "---------------------------------------------------------\n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "1     Phishing         Allowed               No              Yes\n",
            "6     Phishing         Allowed               No               No\n",
            "11    Phishing         Allowed               No              Yes\n",
            "15    Phishing         Allowed               No               No\n",
            "---------------------------------------------------------\n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "3   Ransomware         Blocked              Yes               No\n",
            "8   Ransomware         Blocked              Yes               No\n",
            "13  Ransomware         Blocked              Yes              Yes\n",
            "---------------------------------------------------------\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'DDoS' is ➡ 3\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 3}\n",
            "\n",
            "Classes➡ No No\n",
            "\n",
            "Probabilities of Class 'p'='No' ➡ 1.0\n",
            "Probabilities of Class 'n'='No'  ➡ 1.0\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'Intrusion' is ➡ 3\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 3}\n",
            "\n",
            "Classes➡ No No\n",
            "\n",
            "Probabilities of Class 'p'='No' ➡ 1.0\n",
            "Probabilities of Class 'n'='No'  ➡ 1.0\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'Malware' is ➡ 3\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 1, 'Yes': 2}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6666666666666666\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3333333333333333\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'Phishing' is ➡ 4\n",
            "\n",
            "Target attribute class count(Yes/No)= {'Yes': 2, 'No': 2}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.5\n",
            "Probabilities of Class 'n'='No'  ➡ 0.5\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'Ransomware' is ➡ 3\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 2, 'Yes': 1}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6666666666666666\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3333333333333333\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'S' is ➡ 16\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 11, 'Yes': 5}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6875\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3125\n",
            "\n",
            "Information gain of “ Attack Type ” is ➡ 0.30167729476412397\n",
            "=========================================================\n",
            "\n",
            "\n",
            "----- Information Gain Calculation of Firewall Status ----- \n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "1     Phishing         Allowed               No              Yes\n",
            "6     Phishing         Allowed               No               No\n",
            "11    Phishing         Allowed               No              Yes\n",
            "15    Phishing         Allowed               No               No\n",
            "---------------------------------------------------------\n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "0      Malware         Blocked              Yes               No\n",
            "2         DDoS         Blocked               No               No\n",
            "3   Ransomware         Blocked              Yes               No\n",
            "4    Intrusion         Blocked               No               No\n",
            "5      Malware         Blocked              Yes              Yes\n",
            "7         DDoS         Blocked               No               No\n",
            "8   Ransomware         Blocked              Yes               No\n",
            "9    Intrusion         Blocked               No               No\n",
            "10     Malware         Blocked              Yes              Yes\n",
            "12        DDoS         Blocked               No               No\n",
            "13  Ransomware         Blocked              Yes              Yes\n",
            "14   Intrusion         Blocked               No               No\n",
            "---------------------------------------------------------\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'Allowed' is ➡ 4\n",
            "\n",
            "Target attribute class count(Yes/No)= {'Yes': 2, 'No': 2}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.5\n",
            "Probabilities of Class 'n'='No'  ➡ 0.5\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'Blocked' is ➡ 12\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 9, 'Yes': 3}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.75\n",
            "Probabilities of Class 'n'='No'  ➡ 0.25\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'S' is ➡ 16\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 11, 'Yes': 5}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6875\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3125\n",
            "\n",
            "Information gain of “ Firewall Status ” is ➡ 0.0375796391902079\n",
            "=========================================================\n",
            "\n",
            "\n",
            "----- Information Gain Calculation of Malware Detected ----- \n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "1     Phishing         Allowed               No              Yes\n",
            "2         DDoS         Blocked               No               No\n",
            "4    Intrusion         Blocked               No               No\n",
            "6     Phishing         Allowed               No               No\n",
            "7         DDoS         Blocked               No               No\n",
            "9    Intrusion         Blocked               No               No\n",
            "11    Phishing         Allowed               No              Yes\n",
            "12        DDoS         Blocked               No               No\n",
            "14   Intrusion         Blocked               No               No\n",
            "15    Phishing         Allowed               No               No\n",
            "---------------------------------------------------------\n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "0      Malware         Blocked              Yes               No\n",
            "3   Ransomware         Blocked              Yes               No\n",
            "5      Malware         Blocked              Yes              Yes\n",
            "8   Ransomware         Blocked              Yes               No\n",
            "10     Malware         Blocked              Yes              Yes\n",
            "13  Ransomware         Blocked              Yes              Yes\n",
            "---------------------------------------------------------\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'No' is ➡ 10\n",
            "\n",
            "Target attribute class count(Yes/No)= {'Yes': 2, 'No': 8}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.8\n",
            "Probabilities of Class 'n'='No'  ➡ 0.2\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'Yes' is ➡ 6\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 3, 'Yes': 3}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.5\n",
            "Probabilities of Class 'n'='No'  ➡ 0.5\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'S' is ➡ 16\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 11, 'Yes': 5}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6875\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3125\n",
            "\n",
            "Information gain of “ Malware Detected ” is ➡ 0.06983317322995608\n",
            "=========================================================\n",
            "\n",
            "List of Gain for arrtibutes: ['Attack Type', 'Firewall Status', 'Malware Detected'] \n",
            "are: [0.30167729476412397, 0.0375796391902079, 0.06983317322995608] respectively.\n",
            "\n",
            "Attribute with the maximum gain is ➡ Attack Type\n",
            "\n",
            "Hence, the Root node will be ➡ Attack Type\n",
            "=========================================================\n",
            "\n",
            "\n",
            "----- Information Gain Calculation of Firewall Status ----- \n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "0      Malware         Blocked              Yes               No\n",
            "5      Malware         Blocked              Yes              Yes\n",
            "10     Malware         Blocked              Yes              Yes\n",
            "---------------------------------------------------------\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'Blocked' is ➡ 3\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 1, 'Yes': 2}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6666666666666666\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3333333333333333\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'S-Malware' is ➡ 3\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 1, 'Yes': 2}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6666666666666666\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3333333333333333\n",
            "\n",
            "Information gain of “ Firewall Status ” is ➡ 0.0\n",
            "=========================================================\n",
            "\n",
            "\n",
            "----- Information Gain Calculation of Malware Detected ----- \n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "0      Malware         Blocked              Yes               No\n",
            "5      Malware         Blocked              Yes              Yes\n",
            "10     Malware         Blocked              Yes              Yes\n",
            "---------------------------------------------------------\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'Yes' is ➡ 3\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 1, 'Yes': 2}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6666666666666666\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3333333333333333\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'S-Malware' is ➡ 3\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 1, 'Yes': 2}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6666666666666666\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3333333333333333\n",
            "\n",
            "Information gain of “ Malware Detected ” is ➡ 0.0\n",
            "=========================================================\n",
            "\n",
            "List of Gain for arrtibutes: ['Firewall Status', 'Malware Detected'] \n",
            "are: [0.0, 0.0] respectively.\n",
            "\n",
            "Attribute with the maximum gain is ➡ Firewall Status\n",
            "\n",
            "Hence, the Root node will be ➡ Firewall Status\n",
            "=========================================================\n",
            "\n",
            "\n",
            "----- Information Gain Calculation of Malware Detected ----- \n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "0      Malware         Blocked              Yes               No\n",
            "5      Malware         Blocked              Yes              Yes\n",
            "10     Malware         Blocked              Yes              Yes\n",
            "---------------------------------------------------------\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'Yes' is ➡ 3\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 1, 'Yes': 2}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6666666666666666\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3333333333333333\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'S-Blocked' is ➡ 3\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 1, 'Yes': 2}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6666666666666666\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3333333333333333\n",
            "\n",
            "Information gain of “ Malware Detected ” is ➡ 0.0\n",
            "=========================================================\n",
            "\n",
            "List of Gain for arrtibutes: ['Malware Detected'] \n",
            "are: [0.0] respectively.\n",
            "\n",
            "Attribute with the maximum gain is ➡ Malware Detected\n",
            "\n",
            "Hence, the Root node will be ➡ Malware Detected\n",
            "=========================================================\n",
            "\n",
            "\n",
            "----- Information Gain Calculation of Firewall Status ----- \n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "1     Phishing         Allowed               No              Yes\n",
            "6     Phishing         Allowed               No               No\n",
            "11    Phishing         Allowed               No              Yes\n",
            "15    Phishing         Allowed               No               No\n",
            "---------------------------------------------------------\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'Allowed' is ➡ 4\n",
            "\n",
            "Target attribute class count(Yes/No)= {'Yes': 2, 'No': 2}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.5\n",
            "Probabilities of Class 'n'='No'  ➡ 0.5\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'S-Phishing' is ➡ 4\n",
            "\n",
            "Target attribute class count(Yes/No)= {'Yes': 2, 'No': 2}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.5\n",
            "Probabilities of Class 'n'='No'  ➡ 0.5\n",
            "\n",
            "Information gain of “ Firewall Status ” is ➡ 0.0\n",
            "=========================================================\n",
            "\n",
            "\n",
            "----- Information Gain Calculation of Malware Detected ----- \n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "1     Phishing         Allowed               No              Yes\n",
            "6     Phishing         Allowed               No               No\n",
            "11    Phishing         Allowed               No              Yes\n",
            "15    Phishing         Allowed               No               No\n",
            "---------------------------------------------------------\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'No' is ➡ 4\n",
            "\n",
            "Target attribute class count(Yes/No)= {'Yes': 2, 'No': 2}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.5\n",
            "Probabilities of Class 'n'='No'  ➡ 0.5\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'S-Phishing' is ➡ 4\n",
            "\n",
            "Target attribute class count(Yes/No)= {'Yes': 2, 'No': 2}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.5\n",
            "Probabilities of Class 'n'='No'  ➡ 0.5\n",
            "\n",
            "Information gain of “ Malware Detected ” is ➡ 0.0\n",
            "=========================================================\n",
            "\n",
            "List of Gain for arrtibutes: ['Firewall Status', 'Malware Detected'] \n",
            "are: [0.0, 0.0] respectively.\n",
            "\n",
            "Attribute with the maximum gain is ➡ Firewall Status\n",
            "\n",
            "Hence, the Root node will be ➡ Firewall Status\n",
            "=========================================================\n",
            "\n",
            "\n",
            "----- Information Gain Calculation of Malware Detected ----- \n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "1     Phishing         Allowed               No              Yes\n",
            "6     Phishing         Allowed               No               No\n",
            "11    Phishing         Allowed               No              Yes\n",
            "15    Phishing         Allowed               No               No\n",
            "---------------------------------------------------------\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'No' is ➡ 4\n",
            "\n",
            "Target attribute class count(Yes/No)= {'Yes': 2, 'No': 2}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.5\n",
            "Probabilities of Class 'n'='No'  ➡ 0.5\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'S-Allowed' is ➡ 4\n",
            "\n",
            "Target attribute class count(Yes/No)= {'Yes': 2, 'No': 2}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.5\n",
            "Probabilities of Class 'n'='No'  ➡ 0.5\n",
            "\n",
            "Information gain of “ Malware Detected ” is ➡ 0.0\n",
            "=========================================================\n",
            "\n",
            "List of Gain for arrtibutes: ['Malware Detected'] \n",
            "are: [0.0] respectively.\n",
            "\n",
            "Attribute with the maximum gain is ➡ Malware Detected\n",
            "\n",
            "Hence, the Root node will be ➡ Malware Detected\n",
            "=========================================================\n",
            "\n",
            "\n",
            "----- Information Gain Calculation of Firewall Status ----- \n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "3   Ransomware         Blocked              Yes               No\n",
            "8   Ransomware         Blocked              Yes               No\n",
            "13  Ransomware         Blocked              Yes              Yes\n",
            "---------------------------------------------------------\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'Blocked' is ➡ 3\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 2, 'Yes': 1}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6666666666666666\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3333333333333333\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'S-Ransomware' is ➡ 3\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 2, 'Yes': 1}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6666666666666666\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3333333333333333\n",
            "\n",
            "Information gain of “ Firewall Status ” is ➡ 0.0\n",
            "=========================================================\n",
            "\n",
            "\n",
            "----- Information Gain Calculation of Malware Detected ----- \n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "3   Ransomware         Blocked              Yes               No\n",
            "8   Ransomware         Blocked              Yes               No\n",
            "13  Ransomware         Blocked              Yes              Yes\n",
            "---------------------------------------------------------\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'Yes' is ➡ 3\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 2, 'Yes': 1}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6666666666666666\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3333333333333333\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'S-Ransomware' is ➡ 3\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 2, 'Yes': 1}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6666666666666666\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3333333333333333\n",
            "\n",
            "Information gain of “ Malware Detected ” is ➡ 0.0\n",
            "=========================================================\n",
            "\n",
            "List of Gain for arrtibutes: ['Firewall Status', 'Malware Detected'] \n",
            "are: [0.0, 0.0] respectively.\n",
            "\n",
            "Attribute with the maximum gain is ➡ Firewall Status\n",
            "\n",
            "Hence, the Root node will be ➡ Firewall Status\n",
            "=========================================================\n",
            "\n",
            "\n",
            "----- Information Gain Calculation of Malware Detected ----- \n",
            "Grouped Attribute Values \n",
            "    Attack Type Firewall Status Malware Detected Data Exfiltrated\n",
            "3   Ransomware         Blocked              Yes               No\n",
            "8   Ransomware         Blocked              Yes               No\n",
            "13  Ransomware         Blocked              Yes              Yes\n",
            "---------------------------------------------------------\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'Yes' is ➡ 3\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 2, 'Yes': 1}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6666666666666666\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3333333333333333\n",
            "---------------------------------------------------------\n",
            "\n",
            "Total no of instances/records associated with 'S-Blocked' is ➡ 3\n",
            "\n",
            "Target attribute class count(Yes/No)= {'No': 2, 'Yes': 1}\n",
            "\n",
            "Classes➡ Yes No\n",
            "\n",
            "Probabilities of Class 'p'='Yes' ➡ 0.6666666666666666\n",
            "Probabilities of Class 'n'='No'  ➡ 0.3333333333333333\n",
            "\n",
            "Information gain of “ Malware Detected ” is ➡ 0.0\n",
            "=========================================================\n",
            "\n",
            "List of Gain for arrtibutes: ['Malware Detected'] \n",
            "are: [0.0] respectively.\n",
            "\n",
            "Attribute with the maximum gain is ➡ Malware Detected\n",
            "\n",
            "Hence, the Root node will be ➡ Malware Detected\n",
            "=========================================================\n",
            "\n",
            "The Resultant Decision Tree is: ⤵\n",
            "\n",
            "{'Attack Type': {'DDoS': 'No',\n",
            "                 'Intrusion': 'No',\n",
            "                 'Malware': {'Firewall Status': {'Blocked': {'Malware Detected': {'Yes': 'Yes'}}}},\n",
            "                 'Phishing': {'Firewall Status': {'Allowed': {'Malware Detected': {'No': 'Yes'}}}},\n",
            "                 'Ransomware': {'Firewall Status': {'Blocked': {'Malware Detected': {'Yes': 'Yes'}}}}}}\n",
            "\n",
            "Best Attribute ➡ Attack Type\n",
            "Tree Keys      ➡ dict_keys(['DDoS', 'Intrusion', 'Malware', 'Phishing', 'Ransomware'])\n"
          ]
        }
      ],
      "source": [
        "#Function to calulate the entropy of the given Dataset with respect to target attributes\n",
        "def entropy_dataset(a_list):\n",
        "    from collections import Counter\n",
        "\n",
        "    # Counter calculates the propotion of class\n",
        "    cnt = Counter(x for x in a_list)\n",
        "    num_instances = len(a_list)*1.0    # = 14\n",
        "    print(\"\\nNumber of Instances of the Current Sub-Class is {0}\".format(num_instances ))\n",
        "\n",
        "    # x means no of YES/NO\n",
        "    probs = [x / num_instances for x in cnt.values()]\n",
        "    print(\"\\nClasses➡\", \"'p'=\",max(cnt), \"'n'=\",min(cnt))\n",
        "    print(\"\\nProbabilities of Class 'p'='{0}' ➡ {1}\".format(max(cnt),max(probs)))\n",
        "    print(\"Probabilities of Class 'n'='{0}'  ➡ {1}\".format(min(cnt),min(probs)))\n",
        "\n",
        "    # Call Entropy\n",
        "    return entropy(probs)\n",
        "\n",
        "# The initial entropy of the YES/NO attribute for our dataset.\n",
        "print(\"Entropy calculation for input dataset:\\n\")\n",
        "print(df['Data Exfiltrated'])\n",
        "\n",
        "total_entropy = entropy_dataset(df['Data Exfiltrated'])\n",
        "print(\"\\nTotal Entropy(S) of Tree_Data Dataset➡\", total_entropy)\n",
        "print(\"=========================================================\")\n",
        "####################################################\n",
        "\n",
        "from pprint import pprint\n",
        "tree = id3(df,t,attribute_names)\n",
        "print(\"\\nThe Resultant Decision Tree is: ⤵\\n\")\n",
        "pprint(tree)\n",
        "\n",
        "attribute = next(iter(tree))\n",
        "print(\"\\nBest Attribute ➡\",attribute)\n",
        "print(\"Tree Keys      ➡\",tree[attribute].keys())"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "U0LwtPM_LQ1M",
        "outputId": "e1739a0e-f101-4e6b-cc50-8fb361974259"
      },
      "outputs": [
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "   Attack Type Firewall Status Malware Detected Data Exfiltrated Predicted\n",
            "0      Malware         Blocked              Yes               No       Yes\n",
            "1     Phishing         Allowed               No              Yes       Yes\n",
            "2         DDoS         Blocked               No               No        No\n",
            "3   Ransomware         Blocked              Yes               No       Yes\n",
            "4    Intrusion         Blocked               No               No        No\n",
            "5      Malware         Blocked              Yes              Yes       Yes\n",
            "6     Phishing         Allowed               No               No       Yes\n",
            "7         DDoS         Blocked               No               No        No\n",
            "8   Ransomware         Blocked              Yes               No       Yes\n",
            "9    Intrusion         Blocked               No               No        No\n",
            "10     Malware         Blocked              Yes              Yes       Yes\n",
            "11    Phishing         Allowed               No              Yes       Yes\n",
            "12        DDoS         Blocked               No               No        No\n",
            "13  Ransomware         Blocked              Yes              Yes       Yes\n",
            "14   Intrusion         Blocked               No               No        No\n",
            "15    Phishing         Allowed               No               No       Yes\n"
          ]
        }
      ],
      "source": [
        "def classify(instance, tree,default=None):  # Instance of Play Tennis with Predicted\n",
        "    attribute = next(iter(tree))            # Outlook/Humidity/Wind\n",
        "    if instance[attribute] in tree[attribute].keys(): # Value of the attributs in  set of Tree keys\n",
        "        result = tree[attribute][instance[attribute]]\n",
        "        if isinstance(result, dict):                  # this is a tree, delve deeper\n",
        "            return classify(instance, result)\n",
        "        else:\n",
        "            return result # this is a label\n",
        "    else:\n",
        "        return default\n",
        "\n",
        "df_new=pd.read_csv('Dataset/Tree_Data.csv')\n",
        "df_new['Predicted'] = df_new.apply(classify, axis=1, args=(tree,'?'))\n",
        "print(df_new)"
      ]
    }
  ],
  "metadata": {
    "kernelspec": {
      "display_name": "Python 3",
      "language": "python",
      "name": "python3"
    },
    "language_info": {
      "codemirror_mode": {
        "name": "ipython",
        "version": 3
      },
      "file_extension": ".py",
      "mimetype": "text/x-python",
      "name": "python",
      "nbconvert_exporter": "python",
      "pygments_lexer": "ipython3",
      "version": "3.11.1"
    },
    "orig_nbformat": 4,
    "colab": {
      "provenance": [],
      "include_colab_link": true
    }
  },
  "nbformat": 4,
  "nbformat_minor": 0
}