Initial commit: code, paper, small artifacts

Mixed_CFM/data.py

@@ -0,0 +1,155 @@
+from __future__ import annotations
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Optional
+import numpy as np
+import pandas as pd
+import sys as _sys
+from pathlib import Path as _Path
+_sys.path.insert(0, str(_Path(__file__).resolve().parents[1]))
+from common.data_contract import PACKET_FEATURE_NAMES, PACKET_CONTINUOUS_CHANNEL_IDX, PACKET_BINARY_CHANNEL_IDX, fit_packet_stats as _fit_packet_stats, zscore as _zscore
+import importlib.util as _ilu
+_UDATA_NAME = 'unified_cfm_data'
+if _UDATA_NAME not in _sys.modules:
+    _udata_spec = _ilu.spec_from_file_location(_UDATA_NAME, _Path(__file__).resolve().parents[1] / 'Unified_CFM' / 'data.py')
+    _udata = _ilu.module_from_spec(_udata_spec)
+    _sys.modules[_UDATA_NAME] = _udata
+    _udata_spec.loader.exec_module(_udata)
+else:
+    _udata = _sys.modules[_UDATA_NAME]
+DEFAULT_FLOW_META_COLUMNS = _udata.DEFAULT_FLOW_META_COLUMNS
+_read_aligned_flow_features = _udata._read_aligned_flow_features
+_preprocess_flow = _udata._preprocess_flow
+
+@dataclass
+class MixedData:
+    train_cont: np.ndarray
+    val_cont: np.ndarray
+    attack_cont: np.ndarray
+    train_disc: np.ndarray
+    val_disc: np.ndarray
+    attack_disc: np.ndarray
+    train_flow: np.ndarray
+    val_flow: np.ndarray
+    attack_flow: np.ndarray
+    train_len: np.ndarray
+    val_len: np.ndarray
+    attack_len: np.ndarray
+    attack_labels: np.ndarray
+    cont_mean: np.ndarray
+    cont_std: np.ndarray
+    flow_mean: np.ndarray
+    flow_std: np.ndarray
+    flow_feature_names: tuple[str, ...]
+    packet_feature_names: tuple[str, ...] = PACKET_FEATURE_NAMES
+
+    @property
+    def T(self) -> int:
+        return int(self.train_cont.shape[1])
+
+    @property
+    def n_cont(self) -> int:
+        return int(self.train_cont.shape[2])
+
+    @property
+    def n_disc(self) -> int:
+        return int(self.train_disc.shape[2])
+
+    @property
+    def flow_dim(self) -> int:
+        return int(self.train_flow.shape[1])
+
+def _zscore_cont(train_x: np.ndarray, val_x: np.ndarray, attack_x: np.ndarray, train_l: np.ndarray, val_l: np.ndarray, attack_l: np.ndarray) -> tuple[np.ndarray, np.ndarray, np.ndarray, np.ndarray, np.ndarray]:
+    (mean, std) = _fit_packet_stats(train_x, train_l)
+
+    def prep(x: np.ndarray, l: np.ndarray) -> np.ndarray:
+        z = _zscore(x, mean, std)
+        T = x.shape[1]
+        m = np.arange(T)[None, :] < l[:, None]
+        return (z * m[:, :, None]).astype(np.float32)
+    return (prep(train_x, train_l), prep(val_x, val_l), prep(attack_x, attack_l), mean, std)
+
+def load_mixed_data(*, packets_npz: Path | None=None, source_store: Path | None=None, flows_parquet: Path, flow_features_path: Path, flow_feature_columns: Optional[list[str]]=None, flow_features_align: str='auto', T: int=64, split_seed: int=42, train_ratio: float=0.8, benign_label: str='normal', min_len: int=2, attack_cap: int | None=None, val_cap: int | None=None) -> MixedData:
+    if (packets_npz is None) == (source_store is None):
+        raise ValueError('pass exactly one of packets_npz or source_store')
+    flows_parquet = Path(flows_parquet)
+    print(f'[data] flows={flows_parquet}  packets={(packets_npz if packets_npz else source_store)}')
+    flow_cols = ['flow_id', 'label', 'src_ip', 'src_port', 'dst_ip', 'dst_port', 'protocol']
+    flows = pd.read_parquet(flows_parquet, columns=flow_cols)
+    labels_full = flows['label'].to_numpy().astype(str)
+    flow_id = flows['flow_id'].to_numpy()
+    tokens_full: np.ndarray | None = None
+    store = None
+    if packets_npz is not None:
+        pz = np.load(Path(packets_npz))
+        tokens_full = pz['packet_tokens'].astype(np.float32)
+        lens_full = pz['packet_lengths'].astype(np.int32)
+        if T > tokens_full.shape[1]:
+            raise ValueError(f'requested T={T} > stored {tokens_full.shape[1]}')
+        tokens_full = tokens_full[:, :T].copy()
+        lens_full = np.minimum(lens_full, T).astype(np.int32)
+        if 'flow_id' in pz.files and (not np.array_equal(pz['flow_id'], flow_id)):
+            raise ValueError('packets_npz / flows_parquet not row-aligned')
+    else:
+        from common.packet_store import PacketShardStore
+        store = PacketShardStore.open(Path(source_store))
+        store_id = store.read_flows(columns=['flow_id'])['flow_id'].to_numpy()
+        if not np.array_equal(store_id, flow_id):
+            raise ValueError('source_store / flows_parquet not row-aligned')
+        lens_full = np.minimum(store.manifest['packet_length'].to_numpy(dtype=np.int32), T)
+    (flow_features, flow_names) = _read_aligned_flow_features(Path(flow_features_path), flows, feature_columns=flow_feature_columns, align=flow_features_align)
+    keep = lens_full >= min_len
+    labels = labels_full[keep]
+    flow_features = flow_features[keep]
+    lens = lens_full[keep]
+    global_idx = np.flatnonzero(keep).astype(np.int64)
+    materialized = tokens_full[keep] if tokens_full is not None else None
+    print(f'[data] kept {keep.sum():,} of {len(keep):,} (min_len={min_len})')
+    benign = np.where(labels == benign_label)[0]
+    attack = np.where(labels != benign_label)[0]
+    rng = np.random.default_rng(split_seed)
+    rng.shuffle(benign)
+    n_train = int(len(benign) * train_ratio)
+    train_local = benign[:n_train]
+    val_local = benign[n_train:]
+    if val_cap is not None and len(val_local) > val_cap:
+        val_local = np.sort(rng.choice(val_local, size=val_cap, replace=False))
+    if attack_cap is not None and len(attack) > attack_cap:
+        attack = np.sort(rng.choice(attack, size=attack_cap, replace=False))
+    print(f'[data] train={len(train_local):,} val={len(val_local):,} attack={len(attack):,}')
+
+    def _materialize(idx_local: np.ndarray) -> np.ndarray:
+        if materialized is not None:
+            return materialized[idx_local].astype(np.float32, copy=False)
+        assert store is not None
+        g = global_idx[idx_local]
+        (tok, _) = store.read_packets(g.astype(np.int64), T=T)
+        return tok.astype(np.float32, copy=False)
+    tr_p = _materialize(train_local)
+    va_p = _materialize(val_local)
+    at_p = _materialize(attack)
+    tr_l = lens[train_local]
+    va_l = lens[val_local]
+    at_l = lens[attack]
+    tr_f = flow_features[train_local]
+    va_f = flow_features[val_local]
+    at_f = flow_features[attack]
+    cont_idx = list(PACKET_CONTINUOUS_CHANNEL_IDX)
+    disc_idx = list(PACKET_BINARY_CHANNEL_IDX)
+    tr_cont = tr_p[..., cont_idx]
+    va_cont = va_p[..., cont_idx]
+    at_cont = at_p[..., cont_idx]
+    tr_disc = tr_p[..., disc_idx].astype(np.int8)
+    va_disc = va_p[..., disc_idx].astype(np.int8)
+    at_disc = at_p[..., disc_idx].astype(np.int8)
+    (tr_cont, va_cont, at_cont, c_mean, c_std) = _zscore_cont(tr_cont, va_cont, at_cont, tr_l, va_l, at_l)
+    (tr_flow, va_flow, at_flow, f_mean, f_std) = _preprocess_flow(tr_f, va_f, at_f)
+    return MixedData(train_cont=tr_cont, val_cont=va_cont, attack_cont=at_cont, train_disc=tr_disc, val_disc=va_disc, attack_disc=at_disc, train_flow=tr_flow, val_flow=va_flow, attack_flow=at_flow, train_len=tr_l, val_len=va_l, attack_len=at_l, attack_labels=labels[attack], cont_mean=c_mean, cont_std=c_std, flow_mean=f_mean, flow_std=f_std, flow_feature_names=tuple(flow_names))
+
+def subsample_train(data: MixedData, n: int, seed: int) -> tuple[np.ndarray, np.ndarray, np.ndarray, np.ndarray]:
+    if n <= 0 or n >= len(data.train_cont):
+        return (data.train_flow, data.train_cont, data.train_disc, data.train_len)
+    rng = np.random.default_rng(seed)
+    idx = rng.choice(len(data.train_cont), n, replace=False)
+    idx.sort()
+    return (data.train_flow[idx], data.train_cont[idx], data.train_disc[idx], data.train_len[idx])