ids_svm_slidingwindow/featurecombiner_function.m at master · CybersecurityXLab/ids_svm_slidingwindow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
%returns anywhere from 1 to 7 randomly selected time windows for each feature

function data = featurecombiner_function();


    allfeaturesfilename = '.\minmax_feature_sets\AllFeatures.mat';
    alllabelsfilename = '.\minmax_feature_sets\AllLabels.mat';
    allFeatures = load(allfeaturesfilename);
    allLabels = load(alllabelsfilename);

    allinds = ~strcmp(allLabels.AllLabels.HLClass, 'asdfasdf');%converts from cell so that it can be used. String value is just one that will not appear in the file

    numWindows = 7;
    numFeatures = 10;

    CVPSFeature = allFeatures.AllFeatures.CVPacketSize(allinds, 1:numWindows);
    TMPSFeature = allFeatures.AllFeatures.ThirdMomentPacketSize(allinds, 1:numWindows);
    CVPIFeature =allFeatures.AllFeatures.ThirdMomentPacketInterarrival(allinds, 1:numWindows);
    TMPIFeature = allFeatures.AllFeatures.ThirdMomentPacketInterarrival(allinds, 1:numWindows);
    CorJSFeature = allFeatures.AllFeatures.CorJavaScriptCount(allinds, 1:numWindows);
    ExeFeature = allFeatures.AllFeatures.HTTPorFTPandExeCodeCount(allinds, 1:numWindows);
    HTTPMalformedFeature = allFeatures.AllFeatures.HTTPandMalformedCount(allinds, 1:numWindows);
    FTPandCFeature = allFeatures.AllFeatures.FTPandCcodeCount(allinds, 1:numWindows);
    SynFeature = allFeatures.AllFeatures.SYNCount(allinds, 1:numWindows);
    ECHOFeature = allFeatures.AllFeatures.ECHOCount(allinds, 1:numWindows);

    combinedFeatures = [CVPSFeature,TMPSFeature,CVPIFeature,TMPIFeature,CorJSFeature,ExeFeature,HTTPMalformedFeature,FTPandCFeature,SynFeature,ECHOFeature];
    [row,col] = size(combinedFeatures);


    data = [];%reinitialize this to empty so the variable is cleared in a previously used workspace
    currentCol = 1;%says what column to work on on the temporary data table created
    for x = 1:numFeatures
        tempTimeWindowList = getRandTimeWindows(numWindows,numFeatures);
        %disp(tempTimeWindowList);
        [tempRowNum, tempColNum] = size(tempTimeWindowList);
        %disp(tempColNum);
        for j = 1:tempColNum
            data(:,currentCol) = combinedFeatures(:,((x*7)-7)+tempTimeWindowList(j));%gets the particular time window from current feature
            currentCol = currentCol + 1;
        end
    end

    %disp('-----------------------------------------------------------------------------');
    %save randFeatureWindowcombo.mat data

    function returnList = getRandTimeWindows(numWindows,numFeatures)
        %randStart = randi(numWindows);%random number of features to start with for gradient descent
        randWindowCountNum = randi(numWindows);%decides the total number of random time windows per feature
        randWindowIndex = randi(numWindows);%decides the actual specific time numbers to use. If randWindowNumb is 7, this variable is irrelevant.

        %list to show whether or not the randWindowNum has already been used
        indecesUsedList = false(7,1);
        if randWindowCountNum == 7
            indecesUsedList = true(7,1);
        else
            for i = 1:randWindowCountNum
                indecesUsedList(randWindowIndex) = true;

                %logic to check if the newly generated random number index for the time windows has already been used
                breakLoop = false;
                while(~breakLoop)
                    randWindowIndex = randi(numWindows);
                    if(indecesUsedList(randWindowIndex) == false)
                        breakLoop = true;
                    end

                end
            end
        end
        %return a list of only the indeces with a value of true
        returnList = [];
        for i = 1:7
            if(indecesUsedList(i) == true)
                returnList(end+1)=i;
            end
        end
    end
end