conference_notebooks/KDD_2019/cyber/Cybersecurity_KDD.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# RAPIDS and Cybersecurity : A Network Use Case\n",
    "\n",
    "### KDD 2019 Hands-On Tutorial\n",
    "### Authors\n",
    " - Rachel Allen, PhD (NVIDIA) [rachela@nvidia.com]\n",
    " - Haekyu Park (Georgia Tech, NVIDIA)\n",
    " - Bartley Richardson, PhD (NVIDIA) [brichardson@nvidia.com]\n",
    "\n",
    "### Table of Contents\n",
    "* Introduction\n",
    "* Data Importing and Formatting\n",
    "* Data Exploration\n",
    "    * Dataset Summary\n",
    "    * Dataset Size and Data Types\n",
    "    * Summary Statistics\n",
    "    * Value Counts\n",
    "    * Aggregate Statistics\n",
    "    * Visualizing Data Distributions\n",
    "* Graph Representation \n",
    "    * Degree\n",
    "    * PageRank\n",
    "    * Personalized PageRank\n",
    "    * Graph Visualization\n",
    "    \n",
    "### Development Notes\n",
    " - Developed using: RAPIDS v0.9.0\n",
    " - Last tested using: RAPIDS v0.9.0 on August 20, 2019"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "import cudf\n",
    "import pandas as pd\n",
    "import dask_cudf\n",
    "import cugraph\n",
    "\n",
    "# for visualization\n",
    "import matplotlib.pyplot as plt\n",
    "import seaborn as sns\n",
    "import numpy as np"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Introduction"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Today, organizations collect vast amounts of network traffic and network metadata. As the volume of data collected and velocity at which it's collected continue to increase, security analysts and forensic investigators require fast triage, processing, modeling, and visualization capabilities. Using the [RAPIDS](https://rapids.ai) suite of open-source software, we demonstrate how to:\n",
    "\n",
    "1. Triage and perform data exploration,\n",
    "2. Model network data as a graph,\n",
    "3. Perform graph analytics on the graph representation of the cyber network data, and\n",
    "4. Prepare the results in a way that is suitable for visualization."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Data Import and Formatting"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "For this tutorial, we will used the [IDS 2018 dataset](https://www.unb.ca/cic/datasets/ids-2018.html) from the [Canadian Institute for Cybersecurity](https://www.unb.ca/cic/). The data is stored as raw PCAP files in AWS, and we'll need flow-level data for this use case. To make things eaiser, we've already created bidirectional flow using the [CIC FlowMeter tool](https://github.com/ISCX/CICFlowMeter). You can download it and get started immediately using the cell below. If you wish to store the data in a different location other than the default, change the value of `BASE_DIRECTORY`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      ">> Downloading data\n",
      "--2019-09-27 17:59:46--  https://rapidsai-data.s3.us-east-2.amazonaws.com/cyber/kdd2019/Friday-02-03-2018-biflows.tar.gz\n",
      "Resolving rapidsai-data.s3.us-east-2.amazonaws.com (rapidsai-data.s3.us-east-2.amazonaws.com)... 52.219.96.88\n",
      "Connecting to rapidsai-data.s3.us-east-2.amazonaws.com (rapidsai-data.s3.us-east-2.amazonaws.com)|52.219.96.88|:443... connected.\n",
      "HTTP request sent, awaiting response... 200 OK\n",
      "Length: 1080075865 (1.0G) [application/x-gzip]\n",
      "Saving to: ‘../../../../data/cic_ids2018/Friday-02-03-2018-biflows.tar.gz’\n",
      "\n",
      "../../../../data/ci 100%[===================>]   1.01G  21.4MB/s    in 49s     \n",
      "\n",
      "2019-09-27 18:00:35 (21.1 MB/s) - ‘../../../../data/cic_ids2018/Friday-02-03-2018-biflows.tar.gz’ saved [1080075865/1080075865]\n",
      "\n",
      ">> Extracting Friday-02-03-2018-biflows.tar.gz to ../../../../data/cic_ids2018/Friday-02-03-2018-biflows/\n"
     ]
    }
   ],
   "source": [
    "BASE_DIRECTORY = \"../../../../data/\"\n",
    "DOWNLOAD_DIRECTORY = BASE_DIRECTORY + \"cic_ids2018/\"\n",
    "DOWNLOAD_FILE = \"Friday-02-03-2018-biflows.tar.gz\"\n",
    "DIR_AND_FILE = DOWNLOAD_DIRECTORY + DOWNLOAD_FILE\n",
    "DATA_DIRECTORY = DOWNLOAD_DIRECTORY + DOWNLOAD_FILE.split('.')[0] + \"/\"\n",
    "\n",
    "!mkdir -p $DOWNLOAD_DIRECTORY\n",
    "!if [ ! -f $DIR_AND_FILE ]; then echo \">> Downloading data\" && wget -O $DIR_AND_FILE https://rapidsai-data.s3.us-east-2.amazonaws.com/cyber/kdd2019/Friday-02-03-2018-biflows.tar.gz; else echo \">> Data already downloaded\"; fi\n",
    "!if [ ! -d $DATA_DIRECTORY ]; then echo \">> Extracting $DOWNLOAD_FILE to $DATA_DIRECTORY\" && tar -xzf $DIR_AND_FILE -C $DOWNLOAD_DIRECTORY; else echo \">> Data already extracted to $DATA_DIRECTORY\"; fi"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "If you would prefer to create your own biflow data, [follow the directions at the bottom of this page to download the data](https://www.unb.ca/cic/datasets/ids-2018.html) to your machine. You'll then need to build and use the CIC FlowMeter tool to create biflow data."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Load in `conn` (connection) logs into a GDF (GPU Data Frame) using Dask-cuDF. Then we compute the GDF to convert to a cuDF data frame. Dask-cuDF is appropriate if your data doesn't fit in memory on a single GPU, you want to distribute your workflow across multiple GPUs, or (as is the case here) [you want to analyze data spread across many files at once](https://rapidsai.github.io/projects/cudf/en/latest/10min.html#When-to-use-cuDF-and-Dask-cuDF)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [],
   "source": [
    "# specify the location of the data\n",
    "DATA_LOCATION = DATA_DIRECTORY + \"*.csv\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CPU times: user 615 ms, sys: 166 ms, total: 781 ms\n",
      "Wall time: 819 ms\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "dask_gdf = dask_cudf.read_csv(DATA_LOCATION, \n",
    "                              sep=',',\n",
    "                              dtype=[\"str\",\"str\",\"int32\",\"str\",\"int32\",\"int32\",\"str\",\"int32\",\"int32\",\"int32\",\n",
    "                                     \"float32\",\"float32\",\"float32\",\"float32\",\"float32\",\"float32\",\"float32\",\n",
    "                                     \"float32\",\"float32\",\"float32\",\"str\",\"str\",\"float32\",\"float32\",\"float32\",\n",
    "                                     \"float32\",\"float32\",\"float32\",\"float32\",\"float32\",\"float32\",\"float32\",\n",
    "                                     \"float32\",\"float32\",\"float32\",\"float32\",\"int32\",\"int32\",\"int32\",\"int32\",\n",
    "                                     \"int32\",\"int32\",\"float32\",\"float32\",\"float32\",\"float32\",\"float32\",\"float32\",\n",
    "                                     \"float32\",\"int32\",\"int32\",\"int32\",\"int32\",\"int32\",\"int32\",\"int32\",\"int32\",\n",
    "                                     \"float32\",\"float32\",\"float32\",\"float32\",\"int32\",\"int32\",\"int32\",\"int32\",\n",
    "                                     \"int32\",\"int32\",\"int32\",\"int32\",\"int32\",\"int32\",\"int32\",\"int32\",\"int32\",\n",
    "                                     \"int32\",\"float32\",\"float32\",\"float32\",\"float32\",\"float32\",\"float32\",\"float32\",\n",
    "                                     \"float32\",\"str\"])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CPU times: user 24.2 s, sys: 1.93 s, total: 26.1 s\n",
      "Wall time: 26.4 s\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "gdf = dask_gdf.compute()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We'll inspect the head of the new cuDF as a sanity check."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Flow ID</th>\n",
       "      <th>Src IP</th>\n",
       "      <th>Src Port</th>\n",
       "      <th>Dst IP</th>\n",
       "      <th>Dst Port</th>\n",
       "      <th>Protocol</th>\n",
       "      <th>Timestamp</th>\n",
       "      <th>Flow Duration</th>\n",
       "      <th>Tot Fwd Pkts</th>\n",
       "      <th>Tot Bwd Pkts</th>\n",
       "      <th>...</th>\n",
       "      <th>Fwd Seg Size Min</th>\n",
       "      <th>Active Mean</th>\n",
       "      <th>Active Std</th>\n",
       "      <th>Active Max</th>\n",
       "      <th>Active Min</th>\n",
       "      <th>Idle Mean</th>\n",
       "      <th>Idle Std</th>\n",
       "      <th>Idle Max</th>\n",
       "      <th>Idle Min</th>\n",
       "      <th>Label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>8.0.6.4-8.6.0.1-0-0-0</td>\n",
       "      <td>8.6.0.1</td>\n",
       "      <td>0</td>\n",
       "      <td>8.0.6.4</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>02/03/2018 12:50:13 PM</td>\n",
       "      <td>112640178</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>56320092.0</td>\n",
       "      <td>159.806137</td>\n",
       "      <td>56320200.0</td>\n",
       "      <td>56319976.0</td>\n",
       "      <td>No Label</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>8.0.6.4-8.6.0.1-0-0-0</td>\n",
       "      <td>8.6.0.1</td>\n",
       "      <td>0</td>\n",
       "      <td>8.0.6.4</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>02/03/2018 12:53:02 PM</td>\n",
       "      <td>112642593</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>56321296.0</td>\n",
       "      <td>120.915260</td>\n",
       "      <td>56321384.0</td>\n",
       "      <td>56321212.0</td>\n",
       "      <td>No Label</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>8.0.6.4-8.6.0.1-0-0-0</td>\n",
       "      <td>8.6.0.1</td>\n",
       "      <td>0</td>\n",
       "      <td>8.0.6.4</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>02/03/2018 12:55:51 PM</td>\n",
       "      <td>112640127</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>56320068.0</td>\n",
       "      <td>251.022903</td>\n",
       "      <td>56320240.0</td>\n",
       "      <td>56319884.0</td>\n",
       "      <td>No Label</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>8.0.6.4-8.6.0.1-0-0-0</td>\n",
       "      <td>8.6.0.1</td>\n",
       "      <td>0</td>\n",
       "      <td>8.0.6.4</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>02/03/2018 12:58:40 PM</td>\n",
       "      <td>112641715</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>56320852.0</td>\n",
       "      <td>67.175140</td>\n",
       "      <td>56320904.0</td>\n",
       "      <td>56320812.0</td>\n",
       "      <td>No Label</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>8.0.6.4-8.6.0.1-0-0-0</td>\n",
       "      <td>8.6.0.1</td>\n",
       "      <td>0</td>\n",
       "      <td>8.0.6.4</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>02/03/2018 01:01:29 PM</td>\n",
       "      <td>112642245</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>56321120.0</td>\n",
       "      <td>3.535534</td>\n",
       "      <td>56321124.0</td>\n",
       "      <td>56321120.0</td>\n",
       "      <td>No Label</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 84 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                 Flow ID   Src IP  Src Port   Dst IP  Dst Port  Protocol  \\\n",
       "0  8.0.6.4-8.6.0.1-0-0-0  8.6.0.1         0  8.0.6.4         0         0   \n",
       "1  8.0.6.4-8.6.0.1-0-0-0  8.6.0.1         0  8.0.6.4         0         0   \n",
       "2  8.0.6.4-8.6.0.1-0-0-0  8.6.0.1         0  8.0.6.4         0         0   \n",
       "3  8.0.6.4-8.6.0.1-0-0-0  8.6.0.1         0  8.0.6.4         0         0   \n",
       "4  8.0.6.4-8.6.0.1-0-0-0  8.6.0.1         0  8.0.6.4         0         0   \n",
       "\n",
       "                Timestamp  Flow Duration  Tot Fwd Pkts  Tot Bwd Pkts  ...  \\\n",
       "0  02/03/2018 12:50:13 PM      112640178             2             1  ...   \n",
       "1  02/03/2018 12:53:02 PM      112642593             2             1  ...   \n",
       "2  02/03/2018 12:55:51 PM      112640127             2             1  ...   \n",
       "3  02/03/2018 12:58:40 PM      112641715             2             1  ...   \n",
       "4  02/03/2018 01:01:29 PM      112642245             2             1  ...   \n",
       "\n",
       "   Fwd Seg Size Min  Active Mean  Active Std  Active Max  Active Min  \\\n",
       "0                 0          0.0         0.0         0.0         0.0   \n",
       "1                 0          0.0         0.0         0.0         0.0   \n",
       "2                 0          0.0         0.0         0.0         0.0   \n",
       "3                 0          0.0         0.0         0.0         0.0   \n",
       "4                 0          0.0         0.0         0.0         0.0   \n",
       "\n",
       "    Idle Mean    Idle Std    Idle Max    Idle Min     Label  \n",
       "0  56320092.0  159.806137  56320200.0  56319976.0  No Label  \n",
       "1  56321296.0  120.915260  56321384.0  56321212.0  No Label  \n",
       "2  56320068.0  251.022903  56320240.0  56319884.0  No Label  \n",
       "3  56320852.0   67.175140  56320904.0  56320812.0  No Label  \n",
       "4  56321120.0    3.535534  56321124.0  56321120.0  No Label  \n",
       "\n",
       "[5 rows x 84 columns]"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "gdf.head().to_pandas()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The timestamp is in string format, so we'll convert to epoch time."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CPU times: user 945 ms, sys: 189 ms, total: 1.13 s\n",
      "Wall time: 1.14 s\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "gdf['datetime'] = gdf['Timestamp'].str.timestamp2int(format='%d/%m/%Y %I:%M:%S %p')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "IP addresses in the dataset are also formatted as strings, in a format like: ```192.168.0.1``` We use one of the built-in IPv4 primitive functions `ip2int()` to convert IPv4 addresses to their integer (int64) representations."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {
    "raw_mimetype": "text/x-python"
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CPU times: user 1.66 s, sys: 257 ms, total: 1.92 s\n",
      "Wall time: 1.91 s\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "gdf['src_ip'] = gdf['Src IP'].str.ip2int()\n",
    "gdf['dst_ip'] = gdf['Dst IP'].str.ip2int()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Data Exploration"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Dataset Summary"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "There's 89 features for each flow! You can find descriptions of all of them here: https://www.unb.ca/cic/datasets/ids-2018.html. Or look at the table below with some of the ones we'll be using highlighted below.\n",
    "\n",
    "\n",
    "|Field | Description|\n",
    "|---|---|\n",
    "|Src IP | Source IP\n",
    "|Src Port | Source Port\n",
    "|Dst IP| Destination IP\n",
    "|Dst Port| Destination Port\n",
    "|Tot Fwd Pkts| Total Forward Packets\n",
    "|Tot Bwd Pkts| Total Backward Packets\n",
    "|Fwd Header Len| Forward Header Length\n",
    "|Bwd Header Len| Backward Header Lenght\n",
    "|Fwd Pkts/s| Foward Packets per second\n",
    "|Bwd Pkts/s | Backward Packets per second"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Data Exploration"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Dataset Size and Data Types"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We first get a sense of how large the dataset is, and what some column names and their associated data types are."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(8217202, 87)\n"
     ]
    }
   ],
   "source": [
    "print(gdf.shape)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Flow ID               object\n",
      "Src IP                object\n",
      "Src Port               int32\n",
      "Dst IP                object\n",
      "Dst Port               int32\n",
      "Protocol               int32\n",
      "Timestamp             object\n",
      "Flow Duration          int32\n",
      "Tot Fwd Pkts           int32\n",
      "Tot Bwd Pkts           int32\n",
      "TotLen Fwd Pkts      float32\n",
      "TotLen Bwd Pkts      float32\n",
      "Fwd Pkt Len Max      float32\n",
      "Fwd Pkt Len Min      float32\n",
      "Fwd Pkt Len Mean     float32\n",
      "Fwd Pkt Len Std      float32\n",
      "Bwd Pkt Len Max      float32\n",
      "Bwd Pkt Len Min      float32\n",
      "Bwd Pkt Len Mean     float32\n",
      "Bwd Pkt Len Std      float32\n",
      "Flow Byts/s           object\n",
      "Flow Pkts/s           object\n",
      "Flow IAT Mean        float32\n",
      "Flow IAT Std         float32\n",
      "Flow IAT Max         float32\n",
      "Flow IAT Min         float32\n",
      "Fwd IAT Tot          float32\n",
      "Fwd IAT Mean         float32\n",
      "Fwd IAT Std          float32\n",
      "Fwd IAT Max          float32\n",
      "                      ...   \n",
      "Down/Up Ratio        float32\n",
      "Pkt Size Avg         float32\n",
      "Fwd Seg Size Avg     float32\n",
      "Bwd Seg Size Avg     float32\n",
      "Fwd Byts/b Avg         int32\n",
      "Fwd Pkts/b Avg         int32\n",
      "Fwd Blk Rate Avg       int32\n",
      "Bwd Byts/b Avg         int32\n",
      "Bwd Pkts/b Avg         int32\n",
      "Bwd Blk Rate Avg       int32\n",
      "Subflow Fwd Pkts       int32\n",
      "Subflow Fwd Byts       int32\n",
      "Subflow Bwd Pkts       int32\n",
      "Subflow Bwd Byts       int32\n",
      "Init Fwd Win Byts      int32\n",
      "Init Bwd Win Byts      int32\n",
      "Fwd Act Data Pkts      int32\n",
      "Fwd Seg Size Min       int32\n",
      "Active Mean          float32\n",
      "Active Std           float32\n",
      "Active Max           float32\n",
      "Active Min           float32\n",
      "Idle Mean            float32\n",
      "Idle Std             float32\n",
      "Idle Max             float32\n",
      "Idle Min             float32\n",
      "Label                 object\n",
      "datetime               int64\n",
      "src_ip                 int64\n",
      "dst_ip                 int64\n",
      "Length: 87, dtype: object\n"
     ]
    }
   ],
   "source": [
    "print(gdf.dtypes)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Summary Statistics on Numeric Fields"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Often it's useful to generate summary statistics on numeric fields. This is easy with the `describe()` function. Here, the output includes the minimum, maximum, mean, median, standard deviation, and various quantiles for selected fields in the dataset."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "       Flow Duration  Tot Fwd Pkts  Tot Bwd Pkts  Fwd Header Len  \\\n",
      "count   8.217202e+06  8.217202e+06  8.217202e+06    8.217202e+06   \n",
      "mean    1.601290e+07  5.229578e+00  7.693485e+00    1.013261e+02   \n",
      "std     3.450459e+07  5.748743e+01  1.530253e+02    1.768820e+03   \n",
      "min     0.000000e+00  0.000000e+00  1.000000e+00    0.000000e+00   \n",
      "25%     6.480000e+02  1.000000e+00  2.000000e+00    0.000000e+00   \n",
      "50%     2.041365e+05  2.000000e+00  2.000000e+00    2.000000e+01   \n",
      "75%     4.082616e+06  7.000000e+00  8.000000e+00    1.400000e+02   \n",
      "max     1.200000e+08  4.315800e+04  1.220150e+05    2.275004e+06   \n",
      "\n",
      "       Bwd Header Len    Fwd Pkts/s    Bwd Pkts/s  \n",
      "count    8.217202e+06  8.217202e+06  8.217202e+06  \n",
      "mean     1.597771e+02  1.196901e+04  1.589824e+04  \n",
      "std      3.028208e+03  1.072087e+05  1.082609e+05  \n",
      "min      0.000000e+00  0.000000e+00  0.000000e+00  \n",
      "25%      2.000000e+01  0.000000e+00  1.973443e+00  \n",
      "50%      4.000000e+01  2.093290e+00  1.242776e+01  \n",
      "75%      1.840000e+02  9.494061e+00  2.564103e+03  \n",
      "max      2.440324e+06  4.000000e+06  3.000000e+06  \n"
     ]
    }
   ],
   "source": [
    "print(gdf[['Flow Duration','Tot Fwd Pkts','Tot Bwd Pkts', 'Fwd Header Len', 'Bwd Header Len', 'Fwd Pkts/s', \n",
    "           'Bwd Pkts/s']].describe())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Value Counts of Fields"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Ports are interesting. They help us determine what applications are being used by referring back to [IANA service mappings](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml). For example, port 53 (UDP protocol) is commonly associated with DNS, while ports 80, 443, and 8080 (TCP protocol) are associated with HTTP and HTTPS. For TCP and UDP, ports are interpreted as you would imagine. However, network data often includes [ICMP](https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol) traffic, which has no traditional notion of ports. In these cases, values for ports are interpreted as the [ICMP type](https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#Control_messages).\n",
    "\n",
    "Let's investigate some of the destination ports and their value counts in the dataset."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "53       2093020\n",
      "3389     1909699\n",
      "443      1040455\n",
      "80        759641\n",
      "445       462400\n",
      "8080      281728\n",
      "0         142358\n",
      "5355       16314\n",
      "3128       15323\n",
      "123         9034\n",
      "139         8095\n",
      "67          7338\n",
      "22          4310\n",
      "137         4104\n",
      "23          2854\n",
      "138         1817\n",
      "1900        1245\n",
      "135         1216\n",
      "500         1140\n",
      "18183        727\n",
      "7112         619\n",
      "36496        532\n",
      "30303        268\n",
      "49705        256\n",
      "49707        256\n",
      "50467        252\n",
      "50214        247\n",
      "50392        247\n",
      "50611        246\n",
      "50085        245\n",
      "          ...   \n",
      "999            1\n",
      "1013           1\n",
      "1023           1\n",
      "1029           1\n",
      "5756           1\n",
      "7390           1\n",
      "12142          1\n",
      "13786          1\n",
      "14097          1\n",
      "17815          1\n",
      "21269          1\n",
      "22795          1\n",
      "24779          1\n",
      "25748          1\n",
      "28734          1\n",
      "30109          1\n",
      "30917          1\n",
      "30970          1\n",
      "31292          1\n",
      "36502          1\n",
      "36782          1\n",
      "37211          1\n",
      "37325          1\n",
      "37572          1\n",
      "38018          1\n",
      "44327          1\n",
      "45703          1\n",
      "46057          1\n",
      "47001          1\n",
      "47670          1\n",
      "Name: Dst Port, Length: 64601, dtype: int32\n"
     ]
    }
   ],
   "source": [
    "# returns values from largest to smallest count\n",
    "print(gdf['Dst Port'].value_counts())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "If we sort by the port, we can see that port 0 is represented quite frquently. This typically corresponds with ICMP traffic, meaning an echo reply (used to ping assets on the network)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "0         142358\n",
      "3              1\n",
      "5              2\n",
      "10             3\n",
      "12             1\n",
      "15             2\n",
      "21           223\n",
      "22          4310\n",
      "23          2854\n",
      "25            56\n",
      "26             1\n",
      "53       2093020\n",
      "67          7338\n",
      "68            48\n",
      "70             1\n",
      "79             2\n",
      "80        759641\n",
      "81            36\n",
      "82             2\n",
      "83             2\n",
      "84             1\n",
      "85             3\n",
      "88             3\n",
      "89             1\n",
      "90             3\n",
      "91             2\n",
      "101            1\n",
      "102            2\n",
      "110           13\n",
      "111            8\n",
      "          ...   \n",
      "65506         10\n",
      "65507         14\n",
      "65508         11\n",
      "65509         16\n",
      "65510         11\n",
      "65511         13\n",
      "65512         11\n",
      "65513          6\n",
      "65514         16\n",
      "65515         11\n",
      "65516         15\n",
      "65517         11\n",
      "65518         12\n",
      "65519         20\n",
      "65520         13\n",
      "65521         13\n",
      "65522          9\n",
      "65523          6\n",
      "65524          7\n",
      "65525         13\n",
      "65526         14\n",
      "65527         16\n",
      "65528         14\n",
      "65529          8\n",
      "65530         10\n",
      "65531          8\n",
      "65532         14\n",
      "65533          8\n",
      "65534         10\n",
      "65535          2\n",
      "Name: Dst Port, Length: 64601, dtype: int32\n"
     ]
    }
   ],
   "source": [
    "# sort by port number\n",
    "print(gdf['Dst Port'].value_counts().sort_index())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Aggregate Statistics"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Another common way to investigate a new dataset is to calculate aggregate statistics on various fields (and groupings of fields) in the data. Below, we apply a `groupby()` then a `sum()` to calculate total forward-direction (outbound) packets for each source IP address."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "                Tot Fwd Pkts\n",
      "Src IP                      \n",
      "0.0.0.0                  702\n",
      "1.0.150.69                87\n",
      "1.0.196.220               10\n",
      "1.1.165.90               186\n",
      "1.1.174.152               44\n",
      "1.1.237.80                22\n",
      "1.1.254.189               95\n",
      "1.10.133.107              60\n",
      "1.10.140.140              12\n",
      "1.10.247.85               26\n",
      "1.10.252.155              37\n",
      "1.10.252.249              17\n",
      "1.10.252.38              161\n",
      "1.160.205.143             13\n",
      "1.160.208.123             19\n",
      "1.160.213.194             42\n",
      "1.161.175.33              12\n",
      "1.161.211.20             101\n",
      "1.161.215.210            142\n",
      "1.161.244.226            283\n",
      "1.161.47.126              12\n",
      "1.161.56.36               54\n",
      "1.161.60.101             225\n",
      "1.162.172.25              72\n",
      "1.162.21.171              23\n",
      "1.162.32.117             756\n",
      "1.162.36.120               0\n",
      "1.162.7.175                1\n",
      "1.163.114.156             44\n",
      "1.163.169.158             12\n",
      "...                      ...\n",
      "98.114.52.121            210\n",
      "98.126.38.138             20\n",
      "98.126.38.141             23\n",
      "98.126.6.234              10\n",
      "98.136.103.23              1\n",
      "98.136.241.156             2\n",
      "98.137.159.48              0\n",
      "98.138.49.44               1\n",
      "98.138.49.92              23\n",
      "98.139.180.180             5\n",
      "98.139.199.204             2\n",
      "98.139.199.205             3\n",
      "98.139.21.169              3\n",
      "98.139.225.35           1094\n",
      "98.139.225.43              2\n",
      "98.139.28.141            119\n",
      "98.159.210.45             49\n",
      "98.173.53.124            119\n",
      "98.18.19.223              12\n",
      "98.199.237.70             30\n",
      "98.228.65.24            1036\n",
      "98.23.116.10             282\n",
      "98.29.109.242             24\n",
      "98.6.254.218              10\n",
      "98.64.36.12                0\n",
      "99.158.245.186             2\n",
      "99.178.244.230            27\n",
      "99.46.42.37                1\n",
      "99.47.33.152               2\n",
      "99.60.19.158              91\n",
      "\n",
      "[32674 rows x 1 columns]\n"
     ]
    }
   ],
   "source": [
    "print(gdf[['Src IP','Tot Fwd Pkts']].groupby('Src IP').sum())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <font color=\"green\">Code Me</font>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Use [cuDF functionality](https://docs.rapids.ai/api/cudf/stable/) to perform exploratory data analysis on additional fields."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [],
   "source": [
    "# your code here"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Visualizing Data Distribution"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "A big challenge for cyber security is to distinguish normal network traffic from malicious traffic. We can plot a feature's distribution to try to decide where a cut-offs for \"normal\" traffic could be.  \n",
    "\n",
    "Let's start with something easy, ports (specifically destination ports, for the reasons above). "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [],
   "source": [
    "plotdf = cudf.DataFrame()\n",
    "plotdf['Dst Port'] = gdf['Dst Port'].value_counts().head(30).sort_index().index\n",
    "plotdf['Freq'] = gdf['Dst Port'].value_counts().head(30).sort_index()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAABKwAAAFNCAYAAAAth/fJAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADh0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uMy4xLjEsIGh0dHA6Ly9tYXRwbG90bGliLm9yZy8QZhcZAAAgAElEQVR4nOzde7hdVX3v//dHAogXJISgGEBiBVvktFhSpL9Wa6Vc6qkFK2ioFWyxqD+vqD1Cb1SRVrSalmPFg5IKHuUiaqWtiqlY7YVbEBRQgQgoEYRgAuINDXzPH3MsWHuz187eIXvviXm/nmc9e64xxxjzO9caa62sb8YcK1WFJEmSJEmS1BePmOsAJEmSJEmSpGEmrCRJkiRJktQrJqwkSZIkSZLUKyasJEmSJEmS1CsmrCRJkiRJktQrJqwkSZIkSZLUKyasJEmSHgaSPDJJJdl5rmMZpU8xJtk6yfeTPHGG+r8wyYtmom9JkmTCSpKk3mpftge3+5L8aOj+izfxsf4uyeok30tyY5I/Gbf/V5JcmeSHSS5NstckfZ3dkhYHjit/Xytf+hBjvTjJH0yy/+fbcYYfv0sfyjHnwobO86H2leTgJKs2Rf/TjOPHSe5uY+2yJG9KsuUm6vv+c6yqe6rqMVV1yybo++1JPjBcVlXPqapzHmrfExzr7CT3tHG7Nslnkuy+kX3N+nMsSdKmYsJKkqSeal+2H1NVjwG+BTxvqOzDm/hw7wP2qKptgd8AjknyXIAk2wCfBE4D5gMfBT6RZN4k/V0HHDW4k2Rr4FDgpk0c9yj3Dj9+VbXvRJU2cA6aGS+rqscCTwSOB15KN770gBPb635X4G7g/dPtwLEtSXq4M2ElSdLDVJJtkvxDklvb7Kh3DmaqDGZWJHlLm6VxQ5LDR/VVVV+vqh8OFd0HPKVtHwD8uKreW1X3AO8CHgv8+iThfRz4rSSPbfefB1wEfHco/i1afN9KcluS5YP6SR7dZpqsTXJnkkuSzE/yLuBXgA+0GSjvmuZj9op2Kdc/JFkHHNfKX57k2na8f02yaKjN/0xyfYvj3cMzecbPvGmzu9YP3d8+yZlJvpPk5iQnJHnEUCyfS3JK6/sbSX6r7Zv0PJM8s/X3iKGyFye5eDqPx1DbLZK8J8maJHcl+XKSp7Z926SbgXdzO4//3RKQg7Z/1p6/1cCUZ4RV1fer6t+AQ4D9h859iyR/0cbsHUk+nGS7tm/K4yLjLk9s7f4uyQXpZnj9V5InDZ3HqXlgluGlSfZr5YcCbwCOytBsvXHjYLKx/PNJ1if5w9b/moybwTjZYwScDew19Fxs6DX/F0luA04FPgE8OQ/MNFyQ5NeSXNHO8ztJ/maqz5kkSbPJhJUkSQ9fbwF+EfgfwD7As4H/NbR/N2Ar4AnAMcAZSRaP6qwlU34AfJPu3wiDy52eBnx5UK+q7gOubuWj/AC4ADis3T8SOHNcnZcDLwSeCewO7Ai8u+17GTAPWATsALwa+ElVvRG4jG6WzmPa/el6FnBl6/dd6S5RfD1dUu3xwBXA/wVI8gTgXOCNwEJgDbBkGsf6MHAX8GRgX7pZZi8ZF8tKYAHwHuADABs6z6r6D+AndLPhBv4A+NA0Yhv2O3Rj6OfoZtH9PrCu7VsG7Ew3zp4K7MEDib5Dgf+/xfHzwG9P98BV9Q268fXMVvQnwIF0CdGdgZ+2GOChj4vfp5vVtT1wK91raOCido4L6GZ8fTTJllX1T3Tj8oxJZutNNpYBtqAbN08BnguclOTJG3hoSLItcATdmISpvea3BHYBXgs8H7hhaKbhd+nG2V+32ZS7A/+0oTgkSZoLJqwkSXr4ejFwQlXdUVW3AW9jbDJkPfCWqvpJm8nybzyQQHqQqnoL8Bi6mSofprsUiVZ217jqd9HNsprMmcCRSXZoff7rBPG/s6q+WVXfA/4MeHGS0CUpFgI/V1Xrq+qyqvrBBo43bIs2A2dwe/XQvhuq6v1VdW9V/Ygu2fC2qrquqn5KlxT49SSPB34XuKyqzm/73gGsnUoAbfbOs4A3VNUPq+pW4BRgeA2va6vqzKq6FzgDeNJgNtEUnEmb0dRi/Q0eSDJO10+BbemSTlVV11TV7ekuK/sj4HVVdWdV3QW8fegcXgi8v83Q+z5jE0DTcQtdEgm65+O4qrqlqn7c+nzRJhoX51bVl9pz+RFg78GO9jysa/v+mi5xtcGkUjPZWB44oap+XFWXAV+nSzyN8mdJ7gSupUt2vWzoOJO95u+hu5zwJ21sT+SnwB5JFlTV3VV1yRTPUZKkWWXCSpKkh6H2RfgJdLOhBr5JN/NkYE37wj+8f9JfTKvOynb3z9vf79MlM4ZtywMJrVEupPvCfxzw8ar6ybj9T5wg/m3oEhenA18AzmuXPv11ki02cLxh91bVdkO39wztu3lc3ScB7xskt+hmUa2nm93zxOH6LbH07SnG8CTgkcCaob7/nm4W18B3hrYHl2Q+Zor9nwn8XpJH0s3CWVFVd4you55u5s2wLemSFwCfpnvM/w9wW5L3JnkM3flvCVwzdA7/RDeDCMY9Pox9PqdjEbC2jetdgE8NHe8Kun+zLuChj4vxj/f9j3WS49NdFnoX3eyyR9LN4pqKycYydONx+LkZc+wJnNTG7U5V9fyq+uYUX/PfaQm3yRxFlyy7rl1SedAG6kuSNCdMWEmS9DBUVUX35ftJQ8W7MjaZskNLZgzvn+ovps2juzwM4BrglwY70q2btFcrnyzG+4Cz6Nb/GX85IC2W8fH/CFjbfuHtL6vq5+lmKR3OA7N6aornMDK0cfdvBl46LsG1TVVdTnfZ2C6Diu3chxMEPwAeNXT/CeP6/T4wf6jfbavqlzcyzrE7q24EvkJ3KeNLmPxywG/RXS42bDEt+dESle+uqqfTJTN+CXgd3fmvp5vRNDiHx1XVgtbHmMeH7jmclnZp3C8C/9HG9beB54x7Ph7ZZhXNyLhIcgDwGrpL6LajSzT9CBjMkNpQ3yPH8sbGNN4UX/Pj43xQ3FX1tap6EV3S8RTg40m22lRxSpK0qZiwkiTp4ess4IS2kPKOdJch/d+h/VsCf5FkqyTPoVs8/WPjO0mydZKjkzwuySOS/H90l2V9rlVZAWyTbpHwrYFj6RI1/zmFGP8W+K0Rlx2dBbwpya5tgeq3AR+pqkryW0n2bAmi79ElTe5t7W5j6pdqTcX7gD/PA4uMz0/ygrbvfOBXkvxOW9z6T3hg1gx0a2H9ZpJFSeYDbx7saAmli4F3JHlse2x3TzLZYvXDpnKeZwJ/0er98yT1zgH+OMkvp/MLdAmas9s575dkSbsE8Ad062Pd22brLAf+PskOre0uLcED3fpeL0uyR5uR9ZdTPLfBAurPoZux9e/tslXono+3J9ml1dsxyfPa9kyNi8fSzTZbQ7fu21vpZlgN3AYsHneJ37CRY3kj4xllQ6/58W4DdmzPDQBJjmyXA95Ld2lv0f3IgiRJvWLCSpKkh6+/BL5KN9PpSuC/6NZYGriJ7gv9d+iSDn9YVTeM6GspcCPdF9jlwDuq6jSAthbOIcArgDtb3UOrav2Ivu7XZsVcOGL3qXS/JvjfwDfoZqO8oe1bRLfw9d10C7x/ii45At0C3EcmWZfkHTxEVXUW3ULUH0/yPbrH8oC271a68/07umTG4+kWSR/4V+Bf6J6Hi3nwAtZH0M3Y+Xo7v3MYe0ngZKZynh+lW8j73Op+wXHUOX6SLgkzWAT+fLrL/85oVbYDPkj3/N5AN/PqlLbv9XQziFa2tp9px6SqPgGcBvxHO8cLpnBeH0hyN924fGeL6XlD+99Bt97aha3efwODWWkzNS7+Gfgi3Ti8AbiD7vkeOJtuJt3aJP89QfvJxvKmtKHX/Hhfpnuuv9kusdyeboH9a9tj+zfAC6fyWpYkabZl0//HjyRJmmtJDgbeU1VPmetYftYkuZjusZ1sZstsxfIIusv9llbVVGa8SZIkPSw4w0qSJOnh6wjgeyarJEnSz5p5cx2AJEmSpq/N9NoN+P05DkWSJGmT85JASZIkSZIk9YqXBEqSJEmSJKlXTFhJkiRJkiSpV1zDagp22GGH2m233eY6DEmSJEmSpJ8Zl19++R1VtXCifSaspmC33XZj5cqVcx2GJEmSJEnSz4wk3xy1z0sCJUmSJEmS1CsmrCRJkiRJktQrJqwkSZIkSZLUKyasJEmSJEmS1CsmrCRJkiRJktQrJqwkSZIkSZLUKyasJEmSJEmS1CsmrCRJkiRJktQrJqwkSZIkSZLUKyasJEmSJEmS1CsmrCRJkiRJktQr8+Y6AEmwbMV1s3asYw/YY9aOJUmSJEnSxnCGlSRJkiRJknrFhJUkSZIkSZJ6xYSVJEmSJEmSesWElSRJkiRJknrFhJUkSZIkSZJ6xYSVJEmSJEmSesWElSRJkiRJknplxhJWSXZJ8vkkX0tyTZLXtfLtk6xIcn37O3+ozfFJViW5NslBQ+X7JLmq7TslSVr51knOaeWXJNltqM1R7RjXJzlqqHxxq3t9a7vVTD0GkiRJkiRJmr6ZnGG1HnhjVf0CsB/wqiR7AscBn6uq3YHPtfu0fUuBpwEHA+9NskXr61TgGGD3dju4lR8NrKuqpwDLgJNbX9sDJwDPAPYFThhKjJ0MLGvHX9f6kCRJkiRJUk/MWMKqqm6tqi+17buBrwGLgEOAM1q1M4BD2/YhwNlVdU9V3QisAvZNshOwbVVdVFUFnDmuzaCv84D92+yrg4AVVbW2qtYBK4CD277ntLrjjy9JkiRJkqQemJU1rNqlek8HLgEeX1W3QpfUAnZs1RYBNw81W93KFrXt8eVj2lTVeuAuYMEkfS0A7mx1x/c1PuZjkqxMsnLNmjXTO2FJkiRJkiRttBlPWCV5DPAx4PVV9b3Jqk5QVpOUb0ybyfoaW1h1WlUtqaolCxcunKiKJEmSJEmSZsCMJqySbEmXrPpwVX28Fd/WLvOj/b29la8GdhlqvjNwSyvfeYLyMW2SzAMeB6ydpK87gO1a3fF9SZIkSZIkqQdm8lcCA5wOfK2q3j2063xg8Kt9RwGfHCpf2n75bzHd4uqXtssG706yX+vzyHFtBn0dBlzY1rm6ADgwyfy22PqBwAVt3+db3fHHlyRJkiRJUg/M23CVjfZrwEuAq5Jc2cr+FHg7cG6So4FvAYcDVNU1Sc4Fvkr3C4Ovqqp7W7tXAh8EtgE+3W7QJcQ+lGQV3cyqpa2vtUlOBC5r9d5aVWvb9puBs5O8Dbii9SFJkiRJkqSeSDfpSJNZsmRJrVy5cq7D0M+wZSuum7VjHXvAHrN2LEmSJEmSRklyeVUtmWjfrPxKoCRJkiRJkjRVJqwkSZIkSZLUKyasJEmSJEmS1CsmrCRJkiRJktQrJqwkSZIkSZLUKyasJEmSJEmS1Cvz5joASZIk/WxbtuK6WT3esQfsMavHkyRJm54zrCRJkiRJktQrJqwkSZIkSZLUKyasJEmSJEmS1CsmrCRJkiRJktQrJqwkSZIkSZLUKyasJEmSJEmS1CsmrCRJkiRJktQrJqwkSZIkSZLUKyasJEmSJEmS1CsmrCRJkiRJktQrJqwkSZIkSZLUKyasJEmSJEmS1CsmrCRJkiRJktQrJqwkSZIkSZLUKyasJEmSJEmS1CszlrBKsjzJ7UmuHio7J8mV7XZTkitb+W5JfjS0731DbfZJclWSVUlOSZJWvnXrb1WSS5LsNtTmqCTXt9tRQ+WLW93rW9utZur8JUmSJEmStHFmcobVB4GDhwuq6kVVtXdV7Q18DPj40O5vDPZV1SuGyk8FjgF2b7dBn0cD66rqKcAy4GSAJNsDJwDPAPYFTkgyv7U5GVhWVbsD61ofkiRJkiRJ6pEZS1hV1ReBtRPta7OkXgicNVkfSXYCtq2qi6qqgDOBQ9vuQ4Az2vZ5wP6t34OAFVW1tqrWASuAg9u+57S6tLaDviRJkiRJktQTc7WG1TOB26rq+qGyxUmuSPKFJM9sZYuA1UN1Vreywb6bAapqPXAXsGC4fFybBcCdre74vh4kyTFJViZZuWbNmo05R0mSJEmSJG2EuUpYHcHY2VW3ArtW1dOBNwAfSbItkAnaVvs7at90yydUVadV1ZKqWrJw4cJR1SRJkiRJkrSJzXrCKsk84PeAcwZlVXVPVX23bV8OfAPYg24W1M5DzXcGbmnbq4Fdhvp8HN0liPeXj2tzB7Bdqzu+L0mSJEmSJPXEXMyw+i3g61V1/6V+SRYm2aJtP5lucfUbqupW4O4k+7U1qI4EPtmanQ8MfgHwMODCts7VBcCBSea3xdYPBC5o+z7f6tLaDvqSJEmSJElST8xYwirJWcBFwFOTrE4y+EW+pTx4sfVnAV9J8mW6RdFfUVWDBdtfCXwAWEU38+rTrfx0YEGSVXSXER4H0NqdCFzWbm8d6uvNwBtamwWtD0mSJEmSJPXIvA1X2ThVdcSI8pdOUPYx4GMj6q8E9pqg/MfA4SPaLAeWT1B+A7DvZHFLkiRJkiRpbs3VouuSJEmSJEnShExYSZIkSZIkqVdMWEmSJEmSJKlXTFhJkiRJkiSpV0xYSZIkSZIkqVdMWEmSJEmSJKlXTFhJkiRJkiSpV0xYSZIkSZIkqVdMWEmSJEmSJKlXTFhJkiRJkiSpV0xYSZIkSZIkqVdMWEmSJEmSJKlXTFhJkiRJkiSpV0xYSZIkSZIkqVdMWEmSJEmSJKlXTFhJkiRJkiSpV0xYSZIkSZIkqVdMWEmSJEmSJKlXTFhJkiRJkiSpV0xYSZIkSZIkqVdMWEmSJEmSJKlXZixhlWR5ktuTXD1U9ldJvp3kynZ77tC+45OsSnJtkoOGyvdJclXbd0qStPKtk5zTyi9JsttQm6OSXN9uRw2VL251r29tt5qp85ckSZIkSdLGmckZVh8EDp6gfFlV7d1unwJIsiewFHhaa/PeJFu0+qcCxwC7t9ugz6OBdVX1FGAZcHLra3vgBOAZwL7ACUnmtzYnt+PvDqxrfUiSJEmSJKlHZixhVVVfBNZOsfohwNlVdU9V3QisAvZNshOwbVVdVFUFnAkcOtTmjLZ9HrB/m311ELCiqtZW1TpgBXBw2/ecVpfWdtCXJEmSJEmSemIu1rB6dZKvtEsGBzOfFgE3D9VZ3coWte3x5WPaVNV64C5gwSR9LQDubHXH9yVJkiRJkqSemO2E1anAzwF7A7cC72rlmaBuTVK+MW0m6+tBkhyTZGWSlWvWrBlVTZIkSZIkSZvYrCasquq2qrq3qu4D3k+3xhR0s512Gaq6M3BLK995gvIxbZLMAx5HdwniqL7uALZrdcf3NVGsp1XVkqpasnDhwumeqiRJkiRJkjbSrCas2ppUA88HBr8geD6wtP3y32K6xdUvrapbgbuT7NfWoDoS+ORQm8EvAB4GXNjWuboAODDJ/HbJ4YHABW3f51tdWttBX5IkSZIkSeqJeRuusnGSnAU8G9ghyWq6X+57dpK96S7Fuwl4OUBVXZPkXOCrwHrgVVV1b+vqlXS/OLgN8Ol2Azgd+FCSVXQzq5a2vtYmORG4rNV7a1UNFn9/M3B2krcBV7Q+JEmSJEmS1CMzlrCqqiMmKB6ZIKqqk4CTJihfCew1QfmPgcNH9LUcWD5B+Q08cBmiJEmSJEmSemgufiVQkiRJkiRJGsmElSRJkiRJknrFhJUkSZIkSZJ6xYSVJEmSJEmSesWElSRJkiRJknrFhJUkSZIkSZJ6xYSVJEmSJEmSesWElSRJkiRJknrFhJUkSZIkSZJ6xYSVJEmSJEmSesWElSRJkiRJknrFhJUkSZIkSZJ6xYSVJEmSJEmSesWElSRJkiRJknrFhJUkSZIkSZJ6xYSVJEmSJEmSesWElSRJkiRJknrFhJUkSZIkSZJ6xYSVJEmSJEmSesWElSRJkiRJknrFhJUkSZIkSZJ6ZYMJqyTbz0YgkiRJkiRJEkxthtUlST6a5LlJMtWOkyxPcnuSq4fK3pnk60m+kuQTSbZr5bsl+VGSK9vtfUNt9klyVZJVSU4ZxJBk6yTntPJLkuw21OaoJNe321FD5Ytb3etb262mej6SJEmSJEmaHVNJWO0BnAa8BFiV5K+T7DGFdh8EDh5XtgLYq6p+EbgOOH5o3zeqau92e8VQ+anAMcDu7Tbo82hgXVU9BVgGnAz3zwg7AXgGsC9wQpL5rc3JwLKq2h1Y1/qQJEmSJElSj2wwYVWdFVV1BPAy4Cjg0iRfSPKrk7T7IrB2XNlnq2p9u3sxsPNkx06yE7BtVV1UVQWcCRzadh8CnNG2zwP2b7OvDgJWVNXaqlpHlyQ7uO17TqtLazvoS5IkSZIkST0xlTWsFiR5XZKVwJuA1wA7AG8EPvIQjv1HwKeH7i9OckVLhD2zlS0CVg/VWd3KBvtuBmhJsLuABcPl49osAO4cSpgN9yVJkiRJkqSemDeFOhcBHwIOrarh5NHK4bWmpiPJnwHrgQ+3oluBXavqu0n2Af4pydOAidbMqkE3I/ZNt3xUjMfQXYrIrrvuOqqaJEmSJEmSNrGprGH11Ko6cVyyCoCqOnm6B2yLoP8O8OJ2mR9VdU9VfbdtXw58g27trNWMvWxwZ+CWtr0a2KX1OQ94HN0liPeXj2tzB7Bdqzu+rwepqtOqaklVLVm4cOF0T1OSJEmSJEkbaSoJq88Ofs0PIMn8JBdszMGSHAy8GfjdqvrhUPnCJFu07SfTLa5+Q1XdCtydZL+2BtWRwCdbs/Pp1tMCOAy4sCXALgAObHHOBw4ELmj7Pt/q0toO+pIkSZIkSVJPTOWSwIVVdefgTlWtS7LjhholOQt4NrBDktV0v9x3PLA1sKLLP3Fx+0XAZwFvTbIeuBd4RVUNFmx/Jd0vDm5Dt+bVYN2r04EPJVlFN7NqaYtvbZITgctavbcO9fVm4OwkbwOuaH1IkiRJkiSpR6aSsLo3ya5V9S2AJE9ikrWfBtqvCo43YYKoqj4GfGzEvpXAXhOU/xg4fESb5cDyCcpvAPYdHbUkSZIkSZLm2lQSVn8G/GeSL7T7z6ItRi5JkiRJkiRtahtMWFXVZ5L8MrAf3S/tHVtVd8x4ZJIkSZIkSdosTWWGFXTrTq1t9fdMQlV9cebCkiRJkiRJ0uZqgwmrJCcDLwKuAe5rxQWYsJIkSZIkSdImN5UZVocCT62qe2Y6GEmSJEmSJOkRU6hzA7DlTAciSZIkSZIkwdRmWP0QuDLJ54D7Z1lV1WtnLCpJkiRJkiRttqaSsDq/3SRJkiRJkqQZt8GEVVWdkWQbYNequnYWYpIkSZIkSdJmbINrWCV5HnAl8Jl2f+8kzriSJEmSJEnSjJjKout/BewL3AlQVVcCi2cwJkmSJEmSJG3GppKwWl9Vd40rq5kIRpIkSZIkSZrKoutXJ/l9YIskuwOvBf57ZsOSJEmSJEnS5moqM6xeAzwNuAc4C/ge8PqZDEqSJEmSJEmbr6n8SuAPgT9rN0mSJEmSJGlGbTBhleTzTLBmVVU9Z0YikiRJkiRJ0mZtKmtYvWlo+5HAC4D1MxOOJEmSJEmSNndTuSTw8nFF/5XkCzMUjyRJkiRJkjZzU7kkcPuhu48A9gGeMGMRSZIkSZIkabM2lUsCL6dbwyp0lwLeCBw9k0FJkiRJkiRp8zWVSwIXz0YgkiRJkiRJEkztksDfm2x/VX1804UjSZKmY9mK62btWMcesMesHUuSJEmbt0dMoc7RwOnAi9vtA8AfAM8DfmdUoyTLk9ye5Oqhsu2TrEhyffs7f2jf8UlWJbk2yUFD5fskuartOyVJWvnWSc5p5Zck2W2ozVHtGNcnOWqofHGre31ru9UUzl+SJEmSJEmzaCoJqwL2rKoXVNULgKcBVNUfVtUfTdLug8DB48qOAz5XVbsDn2v3SbInsLT1fTDw3iRbtDanAscAu7fboM+jgXVV9RRgGXBy62t74ATgGcC+wAlDibGTgWXt+OtwLS5JkiRJkqTemUrCarequnXo/m3ABq8JqKovAmvHFR8CnNG2zwAOHSo/u6ruqaobgVXAvkl2AratqouqqoAzx7UZ9HUesH+bfXUQsKKq1lbVOmAFcHDb95xWd/zxJUmSJEmS1BNT+ZXAf09yAXAW3WyrpcDnN/J4jx8kv6rq1iQ7tvJFwMVD9Va3sp+27fHlgzY3t77WJ7kLWDBcPq7NAuDOqlo/QV+SJEmSJEnqian8SuCrkzwfeFYrOq2qPrGJ48hEh56kfGPaTNbXgwNKjqG7FJFdd911VDVJkiRJkiRtYlO5JBDgS8C/VtWxwAVJHruRx7utXeZH+3t7K18N7DJUb2fglla+8wTlY9okmQc8ju4SxFF93QFs1+qO7+tBquq0qlpSVUsWLlw4zdOUJEmSJEnSxtpgwirJH9Ot+/R/WtEi4J828njnA4Nf7TsK+ORQ+dL2y3+L6RZXv7RdPnh3kv3aGlRHjmsz6Osw4MK2ztUFwIFJ5rfF1g8ELmj7Pt/qjj++JEmSJEmSemIqa1i9iu7X9i4BqKrrh9aeGinJWcCzgR2SrKb75b63A+cmORr4FnB46/OaJOcCXwXWA6+qqntbV6+k+8XBbYBPtxvA6cCHkqyim1m1tPW1NsmJwGWt3lurarD4+5uBs5O8Dbii9SFJkiRJkqQemUrC6p6q+kk3wen+y+9Grv00UFVHjNi1/4j6JwEnTVC+EthrgvIf0xJeE+xbDiyfoPwGuuSbJEmSJEmSemoqa1h9IcmfAtskOQD4KPDPMxuWJEmSJEmSNldTSVgdB6wBrgJeDnwK+POZDEqSJEmSJEmbr0kvCUyyBXBGVf0B8P7ZCUmSJEmSJEmbs0lnWLWFzxcm2WqW4pEkSZIkSdJmbiqLrt8E/FeS84EfDAqr6t0zFZQkSZIkSZI2XyNnWCX5UNt8EfAvre5jh26SJEmSJEnSJjfZDKt9kjwJ+Bbwv2cpHkmSJEmSJG3mJktYvQ/4DLAYWDlUHqCAJ89gXJIkSZIkSdpMjbwksKpOqapfAP6xqp48dFtcVSarJEmSJEmSNCMm/ZVAgKp65WwEIkmSJEmSJMEUElaSJEmSJEnSbDJhJUmSJEmSpF4xYSVJkiRJkqReMWElSZIkSZKkXjFhJdbRmSsAACAASURBVEmSJEmSpF4xYSVJkiRJkqReMWElSZIkSZKkXjFhJUmSJEmSpF4xYSVJkiRJkqReMWElSZIkSZKkXjFhJUmSJEmSpF4xYSVJkiRJkqRemfWEVZKnJrly6Pa9JK9P8ldJvj1U/tyhNscnWZXk2iQHDZXvk+Sqtu+UJGnlWyc5p5VfkmS3oTZHJbm+3Y6azXOXJEmSJEnShs16wqqqrq2qvatqb2Af4IfAJ9ruZYN9VfUpgCR7AkuBpwEHA+9NskWrfypwDLB7ux3cyo8G1lXVU4BlwMmtr+2BE4BnAPsCJySZP6MnLEmSJEmSpGmZ60sC9we+UVXfnKTOIcDZVXVPVd0IrAL2TbITsG1VXVRVBZwJHDrU5oy2fR6wf5t9dRCwoqrWVtU6YAUPJLkkSZIkSZLUA/Pm+PhLgbOG7r86yZHASuCNLam0CLh4qM7qVvbTtj2+nPb3ZoCqWp/kLmDBcPkEbST1xLIV183asY49YI9ZO5YkSZIkaWrmbIZVkq2A3wU+2opOBX4O2Bu4FXjXoOoEzWuS8o1tMz6+Y5KsTLJyzZo1E56DJEmSJEmSNr25vCTwt4EvVdVtAFV1W1XdW1X3Ae+nW2MKullQuwy12xm4pZXvPEH5mDZJ5gGPA9ZO0teDVNVpVbWkqpYsXLhwo09SkiRJkiRJ0zOXCasjGLocsK1JNfB84Oq2fT6wtP3y32K6xdUvrapbgbuT7NfWpzoS+ORQm8EvAB4GXNjWuboAODDJ/LbY+oGtTJIkSZIkST0xJ2tYJXkUcADw8qHidyTZm+4SvZsG+6rqmiTnAl8F1gOvqqp7W5tXAh8EtgE+3W4ApwMfSrKKbmbV0tbX2iQnApe1em+tqrUzcY6SJEmSJEnaOHOSsKqqH9Itgj5c9pJJ6p8EnDRB+UpgrwnKfwwcPqKv5cDyaYYsSZIkSZKkWTKXlwRKkiRJkiRJD2LCSpIkSZIkSb1iwkqSJEmSJEm9YsJKkiRJkiRJvWLCSpIkSZIkSb1iwkqSJEmSJEm9YsJKkiRJkiRJvWLCSpIkSZIkSb1iwkqSJEmSJEm9YsJKkiRJkiRJvWLCSpIkSZIkSb1iwkqSJEmSJEm9YsJKkiRJkiRJvWLCSpIkSZIkSb1iwkqSJEmSJEm9YsJKkiRJkiRJvWLCSpIkSZIkSb1iwkqSJEmSJEm9YsJKkiRJkiRJvWLCSpIkSZIkSb1iwkqSJEmSJEm9YsJKkiRJkiRJvTInCaskNyW5KsmVSVa2su2TrEhyffs7f6j+8UlWJbk2yUFD5fu0flYlOSVJWvnWSc5p5Zck2W2ozVHtGNcnOWr2zlqSJEmSJElTMZczrH6zqvauqiXt/nHA56pqd+Bz7T5J9gSWAk8DDgbem2SL1uZU4Bhg93Y7uJUfDayrqqcAy4CTW1/bAycAzwD2BU4YToxJkiRJkiRp7vXpksBDgDPa9hnAoUPlZ1fVPVV1I7AK2DfJTsC2VXVRVRVw5rg2g77OA/Zvs68OAlZU1dqqWges4IEklyRJkiRJknpgrhJWBXw2yeVJjmllj6+qWwHa3x1b+SLg5qG2q1vZorY9vnxMm6paD9wFLJikL0mSJEmSJPXEvDk67q9V1S1JdgRWJPn6JHUzQVlNUr6xbcYetEukHQOw6667ThKeJEmSJEmSNqU5mWFVVbe0v7cDn6BbT+q2dpkf7e/trfpqYJeh5jsDt7TynScoH9MmyTzgccDaSfqaKMbTqmpJVS1ZuHDhxp2oJEmSJEmSpm3WE1ZJHp3ksYNt4EDgauB8YPCrfUcBn2zb5wNL2y//LaZbXP3Sdtng3Un2a+tTHTmuzaCvw4AL2zpXFwAHJpnfFls/sJVJkiRJkiSpJ+biksDHA5/ockzMAz5SVZ9JchlwbpKjgW8BhwNU1TVJzgW+CqwHXlVV97a+Xgl8ENgG+HS7AZwOfCjJKrqZVUtbX2uTnAhc1uq9tarWzuTJSpIkSZIkaXpmPWFVVTcAvzRB+XeB/Ue0OQk4aYLylcBeE5T/mJbwmmDfcmD59KKWJEmSJEnSbJmrRdclSdLPkGUrrpu1Yx17wB6zdixJkiTNjTlZdF2SJEmSJEkaxYSVJEmSJEmSesWElSRJkiRJknrFhJUkSZIkSZJ6xYSVJEmSJEmSesWElSRJkiRJknrFhJUkSZIkSZJ6xYSVJEmSJEmSesWElSRJkiRJknrFhJUkSZIkSZJ6xYSVJEmSJEmSesWElSRJkiRJknrFhJUkSZIkSZJ6xYSVJEmSJEmSesWElSRJkiRJknrFhJUkSZIkSZJ6xYSVJEmSJEmSesWElSRJkiRJknrFhJUkSZIkSZJ6xYSVJEmSJEmSesWElSRJkiRJknpl3mwfMMkuwJnAE4D7gNOq6u+T/BXwx8CaVvVPq+pTrc3xwNHAvcBrq+qCVr4P8EFgG+BTwOuqqpJs3Y6xD/Bd4EVVdVNrcxTw5+0Yb6uqM2b0hCVJkqQeWrbiulk93rEH7DGrx5MkPbzNesIKWA+8saq+lOSxwOVJVrR9y6rqb4crJ9kTWAo8DXgi8G9J9qiqe4FTgWOAi+kSVgcDn6ZLbq2rqqckWQqcDLwoyfbACcASoNqxz6+qdTN8zpIkSZIkSZqiWb8ksKpuraovte27ga8BiyZpcghwdlXdU1U3AquAfZPsBGxbVRdVVdHNqDp0qM1g5tR5wP5JAhwErKiqtS1JtYIuySVJkiRJkqSemNM1rJLsBjwduKQVvTrJV5IsTzK/lS0Cbh5qtrqVLWrb48vHtKmq9cBdwIJJ+pIkSZIkSVJPzFnCKsljgI8Br6+q79Fd3vdzwN7ArcC7BlUnaF6TlG9sm/HxHZNkZZKVa9asmaiKJEmSJEmSZsCcJKySbEmXrPpwVX0coKpuq6p7q+o+4P3Avq36amCXoeY7A7e08p0nKB/TJsk84HHA2kn6epCqOq2qllTVkoULF27sqUqSJEmSJGmaZj1h1daSOh34WlW9e6h8p6FqzweubtvnA0uTbJ1kMbA7cGlV3QrcnWS/1ueRwCeH2hzVtg8DLmzrXF0AHJhkfrvk8MBWJkmSJEmSpJ6Yi18J/DXgJcBVSa5sZX8KHJFkb7pL9G4CXg5QVdckORf4Kt0vDL6q/UIgwCuBDwLb0P064Kdb+enAh5KsoptZtbT1tTbJicBlrd5bq2rtDJ2nJEmSJEmSNsKsJ6yq6j+ZeC2pT03S5iTgpAnKVwJ7TVD+Y+DwEX0tB5ZPNV5JkiRJkiTNrjn9lUBJkiRJkiRpPBNWkiRJkiRJ6hUTVpIkSZIkSeoVE1aSJEmSJEnqFRNWkiRJkiRJ6hUTVpIkSZIkSeoVE1aSJEmSJEnqFRNWkiRJkiRJ6pV5cx2AZteyFdfN2rGOPWCPWTuWJEmSJEn62eEMK0mSJEmSJPWKCStJkiRJkiT1igkrSZIkSZIk9YoJK0mSJEmSJPWKCStJkiRJkiT1igkrSZIkSZIk9YoJK0mSJEmSJPWKCStJkiRJkiT1igkrSZIkSZIk9YoJK0mSJEmSJPWKCStJkiRJkiT1igkrSZIkSZIk9YoJK0mSJEmSJPXKZpmwSnJwkmuTrEpy3FzHI0mSJEmSpAdsdgmrJFsA/wD8NrAncESSPec2KkmSJEmSJA3Mm+sA5sC+wKqqugEgydnAIcBX5zQqSZKkTWzZiutm7VjHHrDHrB1rY83m4wEPj8dEkqS+2hwTVouAm4furwaeMUexbLb68g/ovsTRFz4eY/l4jOXjMZaPhyRJkjRzUlVzHcOsSnI4cFBVvazdfwmwb1W9Zly9Y4Bj2t2nAtfOaqD9sgNwx1wHgXGMZxxjGcdYfYkD+hOLcYxlHGMZx1jGMZZxjGUcYxnHWMYxlnGMZRxj9SWOufSkqlo40Y7NcYbVamCXofs7A7eMr1RVpwGnzVZQfZZkZVUtMQ7jMA7j2Bh9icU4jMM4jMM4jMM4jMM4jMM4Hj42u0XXgcuA3ZMsTrIVsBQ4f45jkiRJkiRJUrPZzbCqqvVJXg1cAGwBLK+qa+Y4LEmSJEmSJDWbXcIKoKo+BXxqruN4GOnLpZHGMZZxjGUcY/UlDuhPLMYxlnGMZRxjGcdYxjGWcYxlHGMZx1jGMZZxjNWXOHpps1t0XZIkSZIkSf22Oa5hJUmSJEmSpB4zYaVJJTk4ybVJViU5bhaPu0uSzyf5WpJrkryulb8zydeTfCXJJ5JsN0dxnNhiuDLJZ5M8cSbjaMe8KclV7Zgr5zCO7ZKc156HryX51STntBiubHFeOQtxHNuek6uTnJXkkUm2T7IiyfXt7/wZOO7yJLcnuXqobMJxmWTfocfly0meP8NxTDgekuyW5EdDsbxvjuJ48VAMVya5L8necxDHlknOaK+nryU5flPEsBFxbJXkH1scX07y7E0Vx9Cxt0hyRZJ/GVf+piSVZId2f8bG6jTjmMmxOtF76Mj3jCTHp/vsuzbJQQ/huBONiV9KclGL55+TbLuh4ybZp9VfleSUJJlmHI9Mcml7fq9J8pZWfni7f1+SJUP1D0hyeTvm5UmeM7TviFb+lSSfGTx/DzGOab9ek7yotbkmyTum83i09lP+XJ1sbCb59/Z8DfbtOI0Ynpqx74vfS/L6SZ6XBen+XfL9JO8ZKn9Ukn9N91l0TZK3b8TjMeXP1Q08L9MaqyNeI3snuXjw3CTZd7Lzb/smHJdJXjH0PP9nkj1HxDFqbI56DEa+b456DKYSy6g42r7XtLH2oDGfZNf2uLxpqGzkayTJC5N8te37yCTPz5j374x4/8okn/GTPB4vTbJmqM3L5iiOZUP1r0ty54gYNsnnyCRjdUqPx3TiyOTv5ScluTnJ90cc57B0n9ET/oLdNOOY7PUy4ThN8oY2Rr+S5HNJnrQpnpe2f6LXy1ZJTmtj4OtJXtDKZ2p8/GIbw9e0do+c7HlJ8qwkX0qyPslhE8XwM6mqvHmb8Ea3KP03gCcDWwFfBvacpWPvBPxy234scB2wJ3AgMK+VnwycPEdxbDtU57XA+2bhMbkJ2GFc2VzEcQbwsra9FbDduP3vAv5yhmNYBNwIbNPunwu8FHgHcFwrO24mxgfwLOCXgauHyiYcl8Cjhsp3Am4f3J+hOCYcD8Buw/Vm4fHY4LgE/gdww1zEAfw+cPbQc3QTsNscxPEq4B/b9o7A5cAjNvHz8wbgI8C/DJXtQvfDI98cvKfM5FidZhwzOVZv4sHvoRO+Z9C9z38Z2BpYTPdZuMUmHBOXAb/Rtv8IOHFDxwUuBX4VCPBp4LenGUeAx7TtLYFLgP2AXwCeCvw7sGSo/tOBJ7btvYBvt+15bXwMnrN3AH+1CeKY1usVWAB8C1jY9p0B7L8JxsS030fHP3YPYYxuAXwHeNIkz8ujgV8HXgG8Z6j8UcBvtu2tgP+Yzhhhmp+ro56XjRmrTPwa+eygHfBc4N83cP4jx+W45/R3gc9Mc2yOegxGvm+OegymEsskcfwm8G/A1m3fjuPafQz4KPCmdn/kawTYHbgCmD9RX+P6HfP+zYj3r3FtxnzGT/J4vHT4edzAOJmxOMa1eQ3dj3JN9T1jWp8jTD5Wp/R4TDOOCd/L2/396Mbu9yc4xmOBLwIXM+L9bZpxTPh62cA4/U3gUW37lcA5DzWOUa+XVvYW4G1t+xHj+9zE42Me8BXgl4Zer4PP+wmfF7rPoV8EzgQOm8rr5mfh5gwrTWZfYFVV3VBVPwHOBg6ZjQNX1a1V9aW2fTfwNWBRVX22qta3ahcDO89RHN8bqvZooGYyjknim9U42v9ePQs4vR3/J1V159D+AC8EzprJOJp5wDZJ5tF9CN5CNz7PaPvPAA7d1Aetqi8Ca8eVTTguq+qHQ+WPZBM+PyPimPVx+RDiOIJNOE6mGUcBj25jZxvgJ8Bw3dmKY0/gc63O7cCdwIT/i7kxkuwM/E/gA+N2LQP+11AcMzpWpxPHHBj1nnEI3Zfxe6rqRmAV3WfitE00JugSEV9s2yuAF0x23CQ70X3Rvai6f7WeyTTf36oz+N/aLdutquprVXXtBPWvqKpb2t1rgEcm2Zrui17oXkMBtqV7/32ocUz39fpk4LqqWtPq/RsPPI4bbY4/3/cHvlFV35zkeflBVf0n8ONx5T+sqs+37Z8AX2L6/0aazufqhM/LxozVEa+RohtbAI9rsYw8fyYZl1N9TkeNzVGPwaj3zckeg6nEMkkcrwTeXlX3tHq333/yyaHADXSv1YHJXiN/DPxDVa0b39ewEe/fo96/ht3/Gb8p3r9mOY7p/vtkup8jD+k9dLpxTPJeTlVdXFW3jujvRLpky/jX2sbGMerfGSPHaVV9vqp+2Mqn+71v5HeCEa8X6BKff9OOfV9V3TFBv5tqfBwIfKWqvtyO992qurdtT/i8VNVNVfUV4L5pHP9hz4SVJrMIuHno/upWNquS7Eb3vwOXjNv1R3T/OzIncQymawIvBv5yFkIo4LNtOu8xQ3HNZhxPBtYA/5huWvYHkjx6aP8zgduq6vqZDKKqvg38Ld3/yNwK3FVVnwUeP3iDb3+nfFnGJjRmXCZ5RpJrgKuAVwx9WM+IScbD4vacfSHJM2cyhg3EMfAiZiGxOSKO84Af0I2dbwF/W1XjvyzNRhxfBg5JMi/JYmAfullHm8rf0SWE7v+HTZLfpfvf1S9PEONMjdVpxcHMjdWJ3kNHvWfM9Off1XSzKwAO54HnfdRxF7XthxRPuktqrqT7n+0VVTX+c3WUFwBXtC9eP6X74nwV3ZesPWn/ifFQ45jm63UV8PPpLtWbR/clYLqvn+l+rk42Nv+xXQbyF+1L6MZYyiZ4X0x3WfrzaAnxqdiIz9VRz8smGavA64F3tufhb4FJL93e0LhM8qok36D7Av7aUf2MGJsj/20x4n1z0sdgKrGMiGMP4JlJLmlj8Fda3UcDb6abHTJsstfIHsAeSf4r3aWXB494SB70/s3o969hw5/xGxoTL0h3ydd5SUa9hmcjDtJdcrYYuHBEHA/5c2QK76FTeTymE8ew+9/LR/QLQJKnA7tU1b9MVm+6cYx4vUz1vfxoRn/vm3Ico14veWCZmRPTXXb30SSPH1fn/7V37zF2lGUcx79PXSAFGgGBeOFSIBQCiOUirUC1KaByK1RDaAQpiImAJBYQEyipYIwSSBANYkQwGC5ybaEEIxHkZoUCXduypVyCVFgUlHpDmsjFxz+e99DpYWbOmd2Zswf4fZLNnp1zZubZmed9Z8477ztTZ35MAtzM7krr+1bBMt/31GAlZfJOuHp6JdzMNiW6bM7NXpUys3nAm8B1YxWHu89z921TDKf3IIwD3H1v4FDg62b26TGIY4Dotv8Td9+LOFnN3tus1l4zRSzGfx9FHDQ+SlylOr7p9XaSl5fuvsTddwc+CZxjaXx6Uwry4S/AdmmfnQlcb5l75vQwDiBOWIC17j6UO3PzcewHvEXkzg7AWWa24xjE8XPiBPYx4mT890T+jJqZHQH81d2XZqZtDMyjoGG7iVwdQRxN5mpuHVoUes60Oo9/X0kxLCWGXbzeYb21xOPub7n7ZOIq9X5mtkenecxsd2Ko89fS3xsQX7b2IsrQCjo0JnQbR5XymnqGnArcSAx/W0318lPluFqWm8e5+8eJizbTgC9XjAMz25D48n1z1XnbljNAHId/5O5/rDBf1eNqUT1aV9k5FTgj7Ycz6NAo2ikv3f3H7r4T8UX1vKLlVC0jBfVm6TboJpaCOAaAzYnhQmcDN6XG0QuAH2R6ZbWWUVZGBohhgdOJc7crre2+sHn1d1JUf7Xmaz/Gl22PO4ihpHsSPWt+0f7BHsXRMhu4pdXTJceojyMdcrXj9hhBHBFMW11e8rlxRA/oszots2oceeWlm7o81UX7AhfXEEdueSHKxDbA4rSsh4jG8qw682OAGN58XPo9y8wOKvn8+5YarKTMMOu3cG9DPV1Wu5Iq9FuB69x9QWb6HOAI4gSx8Qa0ojgyrqeGYQideOrO69FteyHvHJ7SiziGgeHMVflbiAas1knyF4gDTtMOBp5z97+lK1ULgP2Bly26fLe6fud2cW9Cp7x091VEA1/HL4g1eTsfUq+INen1UuI+CpN6HUdGLb0IRhHHl4j7hryRytNiahyK120c7v6mu5/h7pPd/ShgM6Cu3okHADPNbDUxnHsGcA3xxXJ5mr4NMGhmH87OWHOuVoqjyVwtqEOL6oxGj3/u/qS7f9bd9yHKwrMd1jvM+kMhRhWPx1Du+4CiXhXA28NwFgInuHsrxslpGc+muu4mov6tM46uyqu73+HuU9z9U8BTVCw/VY6rZbnp0TupdeuA63OW041DgUF3f3kE82ZdATzj7pdWnK/qcbVov9SVq3NSDBCNeJ22abd5eQNdDEdry82O5xZt9Wa326BjLG1xDAMLPDxC9DbaEpgCXJTq07nAuWZ2epq/qIwMA7en/fdcem/nttW/o/42s2tL6q+W9mN84fbwGAbV6u3zM6KncbvG4yiZZz01HUcKc7XL7VE1jqK6vMgEIo/vS9t8KrDIcm68XjWOzHzrnWeU1eVmdjBxkWumF/QMqxhHUXlZA6xN80PUO3u3raru/Ljf3V/xGPb4q5z1CWqwknKPAjub2Q7pyt9sYFEvVpyuGF0FrHL3SzLTP09ckZrp68Y0j0Uc2YP6TODJhuPYxMwmtF4T456Heh2Hu78EvGBmu6RJBwFPpNcHA0+6+3DuzPV6Hphq8VQkS3GsIvJzTvrMHOD2HsRSmJep7Ayk19sT91tY3WAcuflgZluZ2QfS6x2Jk9Kur7zXFUd6bxzRdf+GptbfRRzPEye8lsrTVBosOyX7ZeO0fszsEOBNd38iZxGVufs57r6Nu08k6u7fuvsX3X1rd5+Ypg8TD5V4qalcHUEcjeRqUR1KcZ2xCJhtZhtZDNfcmbhZby0sPUUulYfzgNYT53LX6zGM4FUzm5rqvBOoWL+lbdt6gul4Up1d8vnNgDuBc9x9ceatF4HdzGyr9PchRP07qjhGUl4z23Fz4DTeeZ+0sjgqHVeLctNiSG/rCV8bEBcuRtJ7dNQ9lM3su8T9nuaOYPaqx9Xc/VJHriZ/Bj6TXs+gc2NkYV627dPDi5ZVUkZyt0FRvVm2DbqJpSSO29K2wMwmETfXf8Xdp2Xq00uB77n7ZelzRWXkNuKG1qT8nURbXVtQfx9fUn/lHuM7bI+PZFY5k5y6pBdxpHl2IXqwPdQeQ3q/ruNIWa523B5V4yipy3O5+7/cfctMTj1MnN8+Nso4Cs8zivLUYmjiT9P6i+6zVimOovKSGg/vIHodwvrfcZrIj7uAPVOdO0DUd7WcA77neB/c+V0//ftDPJnlaeKqxbwervdAopvuCmBZ+jmMGOf8QmZao0/FK4njVqISWkFUbh9rOI4difvdLCduEDgvTe9pHGmdk4khTCuIE57WE2auJsaj9ypHLiBO4IaIHhsbEU/YuIc4AbwH2KKB9f6SGBryBvFF++SivCSGhaxM0waBoxuOIzcfiB4CK1P+DAJHjkUc6fPTgYd7tF+KtsemxJWzlcTJwdljFMdE4kriKqLr//YNlZXpZJ7Ol5m+mnVPKWosVyvG0UiuUlyHFtYZxBXdZ9M+qvREvi5y4hvEsfVp4ELAOq2X6L0ylN67LDtPl3HsSTwVbEVazvw0fVaK67/Ay8Bdafp5xBXwZZmfrdN7p6S8beX0h2qIo3J5Tdv2ifQzu6acqFSPEjfOXpo+vxL4IRWfKEnc4HwN8MHMtNz9kikzfwf+kz6zG9F7w9N+ae2vr1aMo+vjaof9UilXyS8jB6btupy4d+g+Zf9/WV6mfdKq3+4Fdq+Ym0XboLDeLNoG3cRSEseGwLVp2iAwI2fe81n/qWe5ZYQYrnZJmv44HcoPmfqb8vprOjnH+JLt8X3Wlat7gV3HIo7MtrtwBHVG5eMIxbnacXtUjYPyuvwiogz9L/0+P2d995HzlMARxFFWXory9G6i/mvFvaiO/VJSXrYnbuS/Is2zXcP5cXz67BBwUWZ67n4hhlIOp/25BlhZVl7eKz+tykJERERERERERKQvaEigiIiIiIiIiIj0FTVYiYiIiIiIiIhIX1GDlYiIiIiIiIiI9BU1WImIiIiIiIiISF9Rg5WIiIiIiIiIiPQVNViJiIiIjDEzO9/MvjmC+Sab2WFNxJSWf25TyxYREREpowYrERERkXevyUDtDVYWxgFqsBIREZExoQYrERERkTFgZvPM7CkzuxvYJTN9JzP7tZktNbMHzWzXNP0YMxsys+Vm9oCZbQh8BzjWzJaZ2bFtyz/RzG5Py3rKzL6dee/MtKwhM5ubpk00s1VmdjkwCFwFjE/Lvq75LSIiIiKyzsBYByAiIiLyfmNm+wCzgb2I87FBYGl6+wrgFHd/xsymAJcDM4D5wOfc/UUz28zdXzez+cC+7n56war2A/YA1gKPmtmdgAMnAVMAA5aY2f3AP4iGs5Pc/bQU5zHuPrnu/19ERESkEzVYiYiIiPTeNGChu68FMLNF6femwP7AzWbW+uxG6fdi4GozuwlY0OV6fuPua9KyFwAHEg1WC939tcz0acAi4E/u/vAo/zcRERGRUVODlYiIiMjY8Jxp44B/5vVqcvdTUo+rw4FlZtZNz6f2dTjRq6rIa10sU0RERKRxuoeViIiISO89AMwys/FmNgE4EsDd/w08Z2bHwNs3P/9Eer2Tuy9x9/nAK8C2wKvAhJL1HGJmW5jZeOBoopfWA8DRZraxmW0CzAIeLJj/DTPbYNT/rYiIiEhFarASERER6TF3HwRuBJYBt7J+g9FxwMlmthxYCRyVpl9sZo+b2RDR6LQcuBfYLe+m68nvgGta63H3x9K6rwYeAZYAV7r7HwpCvQJYoZuui4iISK+Ze15vdBERERF5NzOzEym/IbuIiIhI31IPKxERERERERER6SvqulqLHgAAAF1JREFUYSUiIiIiIiIiIn1FPaxERERERERERKSvqMFKRERERERERET6ihqsRERERERERESkr6jBSkRERERERERE+ooarEREREREREREpK+owUpERERERERERPrK/wEny8836jZczgAAAABJRU5ErkJggg==\n",
      "text/plain": [
       "<Figure size 1440x360 with 1 Axes>"
      ]
     },
     "metadata": {
      "needs_background": "light"
     },
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CPU times: user 270 ms, sys: 3.67 ms, total: 274 ms\n",
      "Wall time: 271 ms\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "ports = plotdf['Dst Port']\n",
    "y_pos = np.arange(len(ports))\n",
    "frequency = plotdf['Freq']\n",
    "\n",
    "plt.figure(figsize=(20,5))\n",
    "plt.bar(y_pos, frequency, align='center', alpha=0.5)\n",
    "plt.xticks(y_pos, ports)\n",
    "plt.ylabel('frequency')\n",
    "plt.xlabel('dest port')\n",
    "plt.title('Top 30 Most Frequently Used Destination Ports')\n",
    "\n",
    "plt.show()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Should we block traffic that uses abnormal ports? If only 0.00001% of traffic is malicious, we would have a very high-false positive rate and lots of unhappy users if we blocked the traffic using abnormal destination ports.\n",
    "\n",
    "Let's look at a continuous field instead of a categorical one, `Total Forward Packets`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "<matplotlib.axes._subplots.AxesSubplot at 0x7f6514a0ca20>"
      ]
     },
     "execution_count": 18,
     "metadata": {},
     "output_type": "execute_result"
    },
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAXoAAAEGCAYAAABrQF4qAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADh0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uMy4xLjEsIGh0dHA6Ly9tYXRwbG90bGliLm9yZy8QZhcZAAAYPUlEQVR4nO3dfXBV933n8fdHEuIhQLCDcByBA06YJGq2sVkVu3GTnYmbFNwHkpnMFLepu552Wc+Yxk7ryZCkD97Zmd0km3VbT11TGrMbNw/sTOxt1ay65MGxHW9sgrAxBssEgR9QeZCwY8AmIIn73T/Owb5crnSPxBWSfnxeM3d0z+/3O+d+75HuR+eee+/vKiIwM7N0NUx0AWZmNr4c9GZmiXPQm5klzkFvZpY4B72ZWeKaJrqAaubPnx+LFy+e6DLMzKaMbdu2HYmIlmp9kzLoFy9eTFdX10SXYWY2ZUh6cbg+n7oxM0ucg97MLHEOejOzxDnozcwS56A3M0ucg97MLHEOejOzxDnozcwS56A3M0vcpPxk7Pn65paXqrb/zjVXXOBKzMwmno/ozcwS56A3M0ucg97MLHEOejOzxDnozcwS56A3M0ucg97MLHGFgl7SCkm7JfVIWlel/72SHpd0StIdVfobJT0l6Tv1KNrMzIqrGfSSGoF7gJVAG3CjpLaKYa8Anwa+MsxmbgO6z6NOMzMboyJH9MuBnojYFxEDwCZgVfmAiOiLiK3AYOXKkhYCvw58tQ71mpnZKBUJ+lZgf9lyb95W1F8BnwVKIw2StEZSl6Su/v7+UWzezMxGUiToVaUtimxc0m8AfRGxrdbYiNgQEe0R0d7S0lJk82ZmVkCRoO8FFpUtLwQOFNz+dcBvSXqB7JTPRyR9fVQVmpnZeSkS9FuBpZKWSGoGVgMdRTYeEZ+LiIURsThf76GI+NSYqzUzs1GrOU1xRAxJWgtsBhqBjRGxS9Itef96SW8HuoC5QEnS7UBbRBwbx9rNzKyAQvPRR0Qn0FnRtr7s+iGyUzojbeNh4OFRV2hmZufFn4w1M0ucg97MLHEOejOzxDnozcwS56A3M0ucg97MLHEOejOzxDnozcwS56A3M0ucg97MLHEOejOzxDnozcwS56A3M0ucg97MLHEOejOzxDnozcwS56A3M0ucg97MLHEOejOzxBUKekkrJO2W1CNpXZX+90p6XNIpSXeUtS+S9ENJ3ZJ2SbqtnsWbmVltNb8cXFIjcA/wUaAX2CqpIyKeLRv2CvBp4OMVqw8BfxIRT0qaA2yT9L2Kdc3MbBwVOaJfDvRExL6IGAA2AavKB0REX0RsBQYr2g9GxJP59eNAN9Bal8rNzKyQIkHfCuwvW+5lDGEtaTFwNbBlmP41krokdfX3949282ZmNowiQa8qbTGaG5E0G3gAuD0ijlUbExEbIqI9ItpbWlpGs3kzMxtBkaDvBRaVLS8EDhS9AUnTyEL+GxHx4OjKMzOz81Uk6LcCSyUtkdQMrAY6imxckoD7gO6IuGvsZZqZ2VjVfNdNRAxJWgtsBhqBjRGxS9Itef96SW8HuoC5QEnS7UAb8IvA7wHPSNqeb/LzEdE5DvfFzMyqqBn0AHkwd1a0rS+7fojslE6lx6h+jt/MzC4QfzLWzCxxDnozs8Q56M3MEuegNzNLnIPezCxxDnozs8Q56M3MEuegNzNLnIPezCxxDnozs8Q56M3MEuegNzNLnIPezCxxDnozs8Q56M3MEuegNzNLnIPezCxxDnozs8Q56M3MElco6CWtkLRbUo+kdVX63yvpcUmnJN0xmnXNzGx81Qx6SY3APcBKoA24UVJbxbBXgE8DXxnDumZmNo6KHNEvB3oiYl9EDACbgFXlAyKiLyK2AoOjXdfMzMZXkaBvBfaXLffmbUUUXlfSGkldkrr6+/sLbt7MzGopEvSq0hYFt1943YjYEBHtEdHe0tJScPNmZlZLkaDvBRaVLS8EDhTc/vmsa2ZmdVAk6LcCSyUtkdQMrAY6Cm7/fNY1M7M6aKo1ICKGJK0FNgONwMaI2CXplrx/vaS3A13AXKAk6XagLSKOVVt3vO6MmZmdq2bQA0REJ9BZ0ba+7PohstMyhdY1M7MLx5+MNTNLnIPezCxxDnozs8Q56M3MEuegNzNLnIPezCxxDnozs8Q56M3MEuegNzNLnIPezCxxDnozs8Q56M3MEuegNzNLnIPezCxxDnozs8Q56M3MEuegNzNLnIPezCxxDnozs8QVCnpJKyTtltQjaV2Vfkm6O+/fIWlZWd9nJO2StFPStyTNqOcdMDOzkdUMekmNwD3ASqANuFFSW8WwlcDS/LIGuDdftxX4NNAeEe8HGoHVdavezMxqKnJEvxzoiYh9ETEAbAJWVYxZBdwfmSeAeZIuz/uagJmSmoBZwIE61W5mZgUUCfpWYH/Zcm/eVnNMRPwr8BXgJeAgcDQivlvtRiStkdQlqau/v79o/WZmVkORoFeVtigyRtIlZEf7S4B3AG+R9KlqNxIRGyKiPSLaW1paCpRlZmZFFAn6XmBR2fJCzj39MtyYXwWej4j+iBgEHgQ+OPZyzcxstIoE/VZgqaQlkprJXkztqBjTAdyUv/vmWrJTNAfJTtlcK2mWJAHXA911rN/MzGpoqjUgIoYkrQU2k71rZmNE7JJ0S96/HugEbgB6gBPAzXnfFknfBp4EhoCngA3jcUfMzKy6mkEPEBGdZGFe3ra+7HoAtw6z7l8Af3EeNZqZ2XnwJ2PNzBLnoDczS5yD3swscQ56M7PEOejNzBLnoDczS5yD3swscQ56M7PEOejNzBLnoDczS5yD3swscQ56M7PEOejNzBLnoDczS5yD3swscQ56M7PEOejNzBLnoDczS5yD3swscYWCXtIKSbsl9UhaV6Vfku7O+3dIWlbWN0/StyU9J6lb0i/X8w6YmdnIaga9pEbgHmAl0AbcKKmtYthKYGl+WQPcW9b318D/jYj3Ah8AuutQt5mZFVTkiH450BMR+yJiANgErKoYswq4PzJPAPMkXS5pLvBh4D6AiBiIiFfrWL+ZmdVQJOhbgf1ly715W5ExVwL9wP+Q9JSkr0p6S7UbkbRGUpekrv7+/sJ3wMzMRlYk6FWlLQqOaQKWAfdGxNXA68A55/gBImJDRLRHRHtLS0uBsszMrIgiQd8LLCpbXggcKDimF+iNiC15+7fJgt/MzC6QIkG/FVgqaYmkZmA10FExpgO4KX/3zbXA0Yg4GBGHgP2S3pOPux54tl7Fm5lZbU21BkTEkKS1wGagEdgYEbsk3ZL3rwc6gRuAHuAEcHPZJv4I+Eb+T2JfRZ+ZmY2zmkEPEBGdZGFe3ra+7HoAtw6z7nag/TxqNDOz8+BPxpqZJc5Bb2aWOAe9mVniHPRmZolz0JuZJc5Bb2aWOAe9mVniHPRmZolz0JuZJc5Bb2aWOAe9mVniHPRmZolz0JuZJc5Bb2aWOAe9mVniHPRmZolz0JuZJc5Bb2aWOAe9mVniCgW9pBWSdkvqkbSuSr8k3Z3375C0rKK/UdJTkr5Tr8LNzKyYmkEvqRG4B1gJtAE3SmqrGLYSWJpf1gD3VvTfBnSfd7VmZjZqRY7olwM9EbEvIgaATcCqijGrgPsj8wQwT9LlAJIWAr8OfLWOdZuZWUFFgr4V2F+23Ju3FR3zV8BngdJINyJpjaQuSV39/f0FyjIzsyKKBL2qtEWRMZJ+A+iLiG21biQiNkREe0S0t7S0FCjLzMyKKBL0vcCisuWFwIGCY64DfkvSC2SnfD4i6etjrtbMzEatSNBvBZZKWiKpGVgNdFSM6QBuyt99cy1wNCIORsTnImJhRCzO13soIj5VzztgZmYja6o1ICKGJK0FNgONwMaI2CXplrx/PdAJ3AD0ACeAm8evZDMzG42aQQ8QEZ1kYV7etr7segC31tjGw8DDo67QzMzOiz8Za2aWOAe9mVniHPRmZolz0JuZJc5Bb2aWOAe9mVniHPRmZolz0JuZJc5Bb2aWOAe9mVniHPRmZolz0JuZJc5Bb2aWOAe9mVniHPRmZolz0JuZJc5Bb2aWOAe9mVniHPRmZokrFPSSVkjaLalH0roq/ZJ0d96/Q9KyvH2RpB9K6pa0S9Jt9b4DZmY2sppBL6kRuAdYCbQBN0pqqxi2EliaX9YA9+btQ8CfRMT7gGuBW6usa2Zm46jIEf1yoCci9kXEALAJWFUxZhVwf2SeAOZJujwiDkbEkwARcRzoBlrrWL+ZmdVQJOhbgf1ly72cG9Y1x0haDFwNbKl2I5LWSOqS1NXf31+gLDMzK6JI0KtKW4xmjKTZwAPA7RFxrNqNRMSGiGiPiPaWlpYCZZmZWRFFgr4XWFS2vBA4UHSMpGlkIf+NiHhw7KWamdlYFAn6rcBSSUskNQOrgY6KMR3ATfm7b64FjkbEQUkC7gO6I+KuulZuZmaFNNUaEBFDktYCm4FGYGNE7JJ0S96/HugEbgB6gBPAzfnq1wG/BzwjaXve9vmI6Kzv3TAzs+HUDHqAPJg7K9rWl10P4NYq6z1G9fP3ZmZ2gfiTsWZmiXPQm5klzkFvZpY4B72ZWeIc9GZmiXPQm5klzkEP/HjvEf7ukb0TXYaZ2bi46IO+VAr+7B938uXNuxkYKk10OWZmdXfRB/0je/rZ2/86p0vBiy+/PtHlmJnV3UUf9Bsfe57mpmw37Ol7bYKrMTOrv4s66HcfOs6P9hzhP374SiTYc9hBb2bpuaiD/r7H9jFjWgN/8CtLaJ03k55+B72ZpeeiDfqTg6f5p+0H+MTVC5k3q5mlC2az5/DxiS7LzKzuLtqg3/bizzg1VOJjbZcBsPSyOew7kr0oa2aWkos26H+89wiNDeKXllwKwLtbZjMwVGL/KycmuDIzs/oqNB99in6892U+sPCtzJ7exDe3vMRLecDf99jzvO/yuQD8zjVXTGSJZmZ1cVEe0R8/OciO3qN88F3z32hbMGc6AH3HT01UWWZm4yLpoB86XeKxPf0cee3s8N76wiucLgUffNfb3mibMa2RuTOa6Dt28kKXaWY2rpIO+oee66Nz5yHu/sEeHvlpP4OnsykOHt/7Ms1NDSx75yVnjV8wZwb9r/mI3szSUijoJa2QtFtSj6R1Vfol6e68f4ekZUXXHS+9PzvBo3v6+Tetb+U9b5/D5l2H+O2/e5wjr53ix3tf5t9ecQkzpjWetU7LnOn0HTvFUKnEQ88d5u8f3ffGu3B6f3aCP/xaFxsfe57sK3LNzKaGmi/GSmoE7gE+CvQCWyV1RMSzZcNWAkvzyzXAvcA1Bdetm+/sOMCCOTM49vNBHniyl9nTm/j4Va3MbG7k6d5XefDJXj561yO8emKQ69+3gG9ueems9RfMnc7A6RJ/81APfcdP8f3uPn7w3GFuXH4Fd3bs4tjJIb7ffZhtL/2MO3/zF3jpldfZ2/86V1w6i7Z3zGV6UwOHjp7k6M8HuWzuDFpmT+d0BK+eGGSoVOKSWc3MmNbI6VLw2qkhGgRvaW6ioUGUSsGpoRJNjWJaY/b/NyIYKgVNDUIa+TvWB0+XOHT0JH3HT3JqsMRgKZg3cxrvfNss5s1qfmN7ESBRc3tmNrzTpaCh7HFUKgWDpRLNjQ1IIiJ7PA+VglnTGmloEANDJY7+fJAGwdyZ0yhF8NzB4+w8cJRLZjXz/ne8lUWXzhyXx2aRd90sB3oiYh+ApE3AKqA8rFcB90d2qPuEpHmSLgcWF1i3LoZOl/jj//U0A6ffnIHypl9+JzObs6P2Dyycx6Wzmrn/iRcJ4Mr5s8/ZxoI5MwA4dnKQG5dfwcBQiX9++gBP7HuFy+ZO57aPLOXZg8f4l2cO8n92HKxZU2ODznlffnNjw1k1SlnbqbKZM6c1igaJgdMlzjx5mN7UQFPD8H8APx88zXAfAWhuaqBUyv5pVJKgQUK8+Q9A5G2CIn9yZ7Za/kQn8tYzbSM9Byq/jcq/cZX11vr7H+6JVox468PVNPKNjeWxONITwbHUWG6kekdT62j24Wie2I70e63WX779IM79Oyrrq7rdsr9d6ew+Kdt2EJTizQOgUsQbj6EGlT0GpCzUEUEwMFSiFG8+diM46zE9vamBoVKc9dhvbmo4Z3bcBnHOY3bBnOls+fz1dQ/7IkHfCuwvW+4lO2qvNaa14LoASFoDrMkXX5O0u0Btw5kPHPnPIwz4wpdG3sAXK5ZfBH5yHgWNwnzgyIW5qbpz7RNjqtY+VeuGcar9RaDhT8e8+juH6ygS9NX+tVT+Lx9uTJF1s8aIDcCGAvXUJKkrItrrsa0LzbVPDNd+4U3VumHq1V4k6HuBRWXLC4EDBcc0F1jXzMzGUZF33WwFlkpaIqkZWA10VIzpAG7K331zLXA0Ig4WXNfMzMZRzSP6iBiStBbYDDQCGyNil6Rb8v71QCdwA9ADnABuHmndcbknZ6vLKaAJ4tonhmu/8KZq3TDFapffE25mlrakPxlrZmYOejOz5CUV9BM13cJYSXpB0jOStkvqytsulfQ9SXvyn5fU2s6FIGmjpD5JO8vahq1V0ufy38NuSb82MVW/UUu12u+U9K/5vt8u6YayvslU+yJJP5TULWmXpNvy9km/70eofdLve0kzJP1E0tN57f8pb5/0+72q7FNhU/9C9mLvXuBKsrd1Pg20TXRdNWp+AZhf0fZlYF1+fR3wpYmuM6/lw8AyYGetWoG2fP9PB5bkv5fGSVb7ncAdVcZOttovB5bl1+cAP81rnPT7foTaJ/2+J/sM0Oz8+jRgC3DtVNjv1S4pHdG/MVVDRAwAZ6ZbmGpWAV/Lr38N+PgE1vKGiHgUeKWiebhaVwGbIuJURDxP9m6s5Rek0CqGqX04k632gxHxZH79ONBN9onzSb/vR6h9OJOp9oiI1/LFafklmAL7vZqUgn64aRgmswC+K2lbPgUEwGWRfQaB/OeCCauutuFqnSq/i7X5bKsby56CT9raJS0GriY7upxS+76idpgC+15So6TtQB/wvYiYcvv9jJSCvvB0C5PIdRGxjGz2z1slfXiiC6qTqfC7uBd4F3AVcBD473n7pKxd0mzgAeD2iDg20tAqbRNaf5Xap8S+j4jTEXEV2Sf6l0t6/wjDJ1XtlVIK+iJTNUwqEXEg/9kH/G+yp3qH85k/yX/2TVyFNQ1X66T/XUTE4fyBXAL+njefZk+62iVNIwvKb0TEg3nzlNj31WqfSvseICJeBR4GVjBF9nullIJ+Sk23IOktkuacuQ58DNhJVvPv58N+H/iniamwkOFq7QBWS5ouaQnZ9xRcoMk/iznzYM19gmzfwySrXZKA+4DuiLirrGvS7/vhap8K+15Si6R5+fWZwK8CzzEF9ntVE/1qcD0vZNMw/JTsFe8vTHQ9NWq9kuxV+qeBXWfqBd4G/ADYk/+8dKJrzev6FtnT7EGyo5c/GKlW4Av572E3sHIS1v4PwDPADrIH6eWTtPZfITsFsAPYnl9umAr7foTaJ/2+B34ReCqvcSfw53n7pN/v1S6eAsHMLHEpnboxM7MqHPRmZolz0JuZJc5Bb2aWOAe9mVniHPQ2pUh6W9msh4cqZkFsrjL+UuXfhlalr0nS6bL1t0taVG1sjZq+LumcOYny9ufz7W6TdE3e/pikqyrGNmgKzLhqU5OD3qaUiHg5Iq6K7KPp64G/PLMc2WR2lS4FqgZ97njZ+ldFxP4Rxo7FZ/Ja/4zso//DaSCbDdGs7hz0lgxJn5W0M7/8Ud78ReA9+VH1Fwtu57uS2vLrz0j6fH79v0r69/nR999KelbSPwPzC2z2UeDdFbfTmB/135nXOSev835JcyT9Sz4f+k5Jnyy2F8zOVfPLwc2mAknLgd8lmzelEfiJpEfIjpLfnR9VVzMnn6EQsmmuP0kWyh+SdBA4SfYJT/KfXwU+STbn+PuBdwDPkj27GMlvkn0a9Iwm4JvAkxHxJUlNwB+eqVPSbwMvRMTKfPmtBXaDWVU+ordUfAh4ICJORDb3+T/yZkCPpPzUzZmj5h+RfVnJh8jmMrlE0iygNSL25n3fiohSRPSSTXg1nL/M/5HcDPyHsvb7yEN+mPV2ACskfVHSdRFxtMB9MavKQW+pqDZN7FhtIXtm8CGyo/unyUK6fJKqonOHfCb/J/KxiHi2rP3/AddLml5tpYjoBtrJ5kH6b2dOH5mNhYPeUvEo8AlJM/P5z1eRHZkfJ/sau8Ii4iRwmOzbg7bk27kj/3nmtlbn5+pbgX83hno3AN8HNklqioghyN4JlP9sBV6LiH8A7iL7KkSzMXHQWxIi4idks1RuBZ4A7o2IZyLiMNCVv6ha6MXY3I+AgxFxKr++kDeD/tvAS2SzGv4NWfCPpeYvk53f/5+SGshO5+yQdD/wAWBrftrns8B/GcttmAGevdLMLHU+ojczS5yD3swscQ56M7PEOejNzBLnoDczS5yD3swscQ56M7PE/X8ueWWaVl94dQAAAABJRU5ErkJggg==\n",
      "text/plain": [
       "<Figure size 432x288 with 1 Axes>"
      ]
     },
     "metadata": {
      "needs_background": "light"
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "# plot a histogram of a sample of our dataset with a kde kernal density estimate overlaid \n",
    "sns.distplot(gdf['Tot Fwd Pkts'].head(1000))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "It looks like our data has a long tail distribution. We can visualize it another way with a cummulative frequency histogram."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAX0AAAD4CAYAAAAAczaOAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADh0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uMy4xLjEsIGh0dHA6Ly9tYXRwbG90bGliLm9yZy8QZhcZAAATm0lEQVR4nO3df6zddX3H8eebltYWdMP+MNDWAaZMfkxduSLJ1mqcUqhmBaZbSabMGZpoZ6hmiyBGIdoEUDFuRpfO4tiy8WMpzhoCrpJZsgTo2g2kpXYtq64VpJeAjt5if/HeH9/v3T2399729p62557v5/lIbs65n/M95/v+5tu+7ue+z/d8bmQmkqQynNLpAiRJJ4+hL0kFMfQlqSCGviQVxNCXpIJM7HQBRzN9+vQ8++yzO12GJHWVjRs3vpCZMw4fH/ehf/bZZ7Nhw4ZOlyFJXSUifjrcuO0dSSqIoS9JBTH0Jakghr4kFcTQl6SCHDX0I+LOiNgdEZtaxl4fEWsjYlt9e0bLYzdGxPaI2BoRC1vGL46Ip+rH/jIi4vgfjiTpSEYz0/9b4PLDxm4AHs7MucDD9fdExAXAEuDC+jnfiIgJ9XO+CSwF5tZfh7+mJOkEO2roZ+YjwIuHDS8G7qrv3wVc2TJ+T2buy8wdwHbgkog4E3hdZj6a1VrOf9fyHElSi40b4TOfOTGvPdae/hsy8zmA+nZmPT4L2Nmy3a56bFZ9//DxYUXE0ojYEBEbent7x1iiJHWXZ56Ba66Bnh5YuRJ+9rPjv4/j/UbucH36PML4sDJzZWb2ZGbPjBlDPkUsSY2yezd84hPw5jfDmjXw2c9WPwBmjTg1HruxLsPwfEScmZnP1a2b3fX4LmBOy3azgWfr8dnDjEtSsV5+Ge64A778ZXjlFbjuOvjc5+DMM0/cPsca+muAa4Fb69vvtoz/Y0TcAZxF9Ybt+sw8FBEvR8SlwOPAh4G/aqtyDauvD9atg0OHOl2JpCPZvh1uvbWa5X/gA7BiBZx33onf71FDPyLuBt4FTI+IXcDnqcL+voj4KPA/wAcBMnNzRNwHPA0cBJZlZn/8fIzqSqApwIP1l46TAwdg1Sq4+WZ4/vlOVyNpNN75zqqd8453nLx9xnj/w+g9PT3pKpsjy4TVq6t3+rdtg/nz4aabYPr0Tlcm6UimTIHzz4cT9YmliNiYmT2Hj4/7pZU1sh/+ED79aVi/Hi66CL73PXjf+07cPyJJ3c/QH4NMeOGFzvXNd+6Ez38eHnwQZs+Gb38bPvQhmDDh6M+VVDZD/xg9/ng1u163rrN1nHEGfOlLsGxZ9WuiJI2GoT9KW7dWvfLVq2HmTPjiF2HatM7UMnkyXHllFfySdCwM/aN47jm45Rb41reqGfUtt8CnPgWnn97pyiTp2Bn6I/jlL+H22+GrX4WDB+HjH68+JTdz5tGfK0njlaE/jMcfh/e/v3qz9ppr4AtfgDe9qdNVSVL7DP3DbN4MV1xR9cu//32YN6/TFUnS8WPot9ixAy67DF7zGli7Fs49t9MVSdLxZejXfv5zeO97q0WPHnnEwJfUTIY+8ItfwMKF1ZU6Dz9cfbpVkpqo+NDfu7d603bLFnjgAbj00k5XJEknTtGhv39/taTpo4/CvfdW7R1JarJiQ//QIfjwh6v1a1aurMJfkprueP+5xK6xfHk1u7/11uqv1UhSCYoM/b174etfh498pFo8TZJKUWTo79lT3V58cWfrkKSTrcjQ7+urbk87rbN1SNLJVmTo98/0DX1JpSky9J3pSypV0aHvmviSSlNk6NvekVSqIkPf9o6kUhUd+rZ3JJWmyNC3vSOpVEWGvu0dSaUqNvRPPRUmTep0JZJ0chUZ+nv2OMuXVKYiQ7+vz9CXVKZiQ98rdySVqNjQd6YvqURFhr49fUmlKjL0be9IKlVboR8R10fEpojYHBHL67G3RsSjEfFURHwvIl7Xsv2NEbE9IrZGxMJ2ix8r2zuSSjXm0I+Ii4DrgEuAtwLvj4i5wLeAGzLzt4DvAH9Rb38BsAS4ELgc+EZETGiv/LGxvSOpVO3M9M8HHsvMvZl5EFgHXAX8JvBIvc1a4A/q+4uBezJzX2buALZT/cA46WzvSCpVO6G/CVgQEdMiYiqwCJhTj/9+vc0H6zGAWcDOlufvqseGiIilEbEhIjb09va2UeLwbO9IKtWYQz8ztwC3Uc3mHwKeBA4Cfwosi4iNwGuB/fVTYriXGeG1V2ZmT2b2zJgxY6wlDuvgQdi3z9CXVKa23sjNzFWZOS8zFwAvAtsy88eZeVlmXgzcDTxTb76LgVk/wGzg2Xb2PxYutiapZO1evTOzvn0jcDVwd8vYKcBngb+uN18DLImIyRFxDjAXWN/O/sfCtfQllWxim89fHRHTgAPAssx8qb6Mc1n9+P3AtwEyc3NE3Ac8TdUGWpaZh9rc/zFzLX1JJWsr9DNz/jBjXwO+NsL2K4AV7eyzXbZ3JJWsuE/k2t6RVLJiQ9+ZvqQSFRf69vQllay40Le9I6lkxYa+M31JJSou9G3vSCpZcaHfP9OfOrWzdUhSJxQZ+lOmwISOLOosSZ1VXOi7lr6kkhUX+q6lL6lkRYa+M31JpSou9G3vSCpZcaHvTF9SyYoMfXv6kkpVZOg705dUquJC356+pJIVF/q2dySVrKjQz7S9I6lsRYX+vn1w6JChL6lcRYW+a+lLKl2Roe9MX1Kpigp919KXVLqiQt/2jqTSFRn6zvQllaqo0Le9I6l0RYW+7R1JpSsy9J3pSyqVoS9JBSkq9Pt7+rZ3JJWqqNDv64NTToHJkztdiSR1RnGhf9ppENHpSiSpM4oKfdfSl1S6okLftfQlla6t0I+I6yNiU0Rsjojl9djbIuKxiHgiIjZExCUt298YEdsjYmtELGy3+GPlWvqSSjdxrE+MiIuA64BLgP3AQxHxAHA7cEtmPhgRi+rv3xURFwBLgAuBs4AfRMR5mXmo3YMYLds7kkrXzkz/fOCxzNybmQeBdcBVQAKvq7f5NeDZ+v5i4J7M3JeZO4DtVD8wThrbO5JK107obwIWRMS0iJgKLALmAMuBL0XETuDLwI319rOAnS3P31WPDRERS+vW0Ibe3t42ShzM9o6k0o059DNzC3AbsBZ4CHgSOAh8DPhkZs4BPgmsqp8y3IWSOcJrr8zMnszsmTFjxlhLHML2jqTStfVGbmauysx5mbkAeBHYBlwL3F9v8k8MtHB2Uf0m0G82A62fk8L2jqTStXv1zsz69o3A1cDdVEH+znqTd1P9IABYAyyJiMkRcQ4wF1jfzv6Ple0dSaUb89U7tdURMQ04ACzLzJci4jrgaxExEfgVsBQgMzdHxH3A01RtoGUn88qdV1+FvXsNfUllayv0M3P+MGP/Blw8wvYrgBXt7HOs9u6tbm3vSCpZMZ/IdVllSTL0JakoxYS+a+lLUkGh70xfkgx9SSpKMaFve0eSCgp9Z/qSZOhLUlGKCf3+9o6hL6lkxYS+M31JKiz0J02CU0/tdCWS1DlFhb6zfEmlKyb09+zxck1JKib0nelLkqEvSUUpJvRt70hSQaHvTF+SDH1JKkoxoW97R5IKCn1n+pJk6EtSUYoI/QMHYP9+2zuSVETou9iaJFUMfUkqiKEvSQUpIvT9+7iSVCki9J3pS1LF0JekghQR+rZ3JKlSROg705ekiqEvSQUpIvRt70hSpYjQ75/pT5nS2TokqdPaCv2IuD4iNkXE5ohYXo/dGxFP1F8/iYgnWra/MSK2R8TWiFjYbvGj1dcHU6fCKUX8iJOkkU0c6xMj4iLgOuASYD/wUEQ8kJl/1LLNV4Bf1vcvAJYAFwJnAT+IiPMy81Ab9Y+Ka+lLUqWdue/5wGOZuTczDwLrgKv6H4yIAP4QuLseWgzck5n7MnMHsJ3qB8YJ57LKklRpJ/Q3AQsiYlpETAUWAXNaHp8PPJ+Z2+rvZwE7Wx7fVY8NERFLI2JDRGzo7e1to8SKoS9JlTGHfmZuAW4D1gIPAU8CB1s2uYaBWT5ADPcyI7z2yszsycyeGTNmjLXE/9fXZ3tHkqDNN3Izc1VmzsvMBcCLwDaAiJgIXA3c27L5Lgb/JjAbeLad/Y/Wnj3O9CUJ2r96Z2Z9+0aqkO+f2b8H+HFm7mrZfA2wJCImR8Q5wFxgfTv7Hy3bO5JUGfPVO7XVETENOAAsy8yX6vElDG7tkJmbI+I+4GmqNtCyk3HlDtjekaR+bYV+Zs4fYfxPRhhfAaxoZ59jYXtHkipFfFzJ9o4kVRof+pmGviT1a3zo/+pX8Oqr9vQlCQoIfZdVlqQBhr4kFaTxoe9a+pI0oPGh70xfkgYY+pJUkGJC3/aOJBUQ+v09fWf6klRA6NvekaQBxYS+7R1JKiD0be9I0oDGh35fH0yYAJMmdboSSeq8IkL/9NMhhvtjjZJUmMaHvmvpS9KAxoe+yypL0gBDX5IK0vjQ37PHyzUlqV/jQ9+ZviQNMPQlqSBFhL7tHUmqND70vWRTkgY0PvRt70jSgEaH/qFD8MortnckqV+jQ3/v3urWmb4kVRod+q6lL0mDFRH6tnckqdLo0HctfUkarNGhb3tHkgYrIvRt70hSpdGhb3tHkgZrdOjb3pGkwdoK/Yi4PiI2RcTmiFjeMv6JiNhaj9/eMn5jRGyvH1vYzr5Hw/aOJA02caxPjIiLgOuAS4D9wEMR8QAwG1gMvCUz90XEzHr7C4AlwIXAWcAPIuK8zDzU5jGMyJm+JA3Wzkz/fOCxzNybmQeBdcBVwMeAWzNzH0Bm7q63Xwzck5n7MnMHsJ3qB8YJY09fkgZrJ/Q3AQsiYlpETAUWAXOA84D5EfF4RKyLiLfX288CdrY8f1c9NkRELI2IDRGxobe3d8wF9vXB5MkwYcKYX0KSGmXM7Z3M3BIRtwFrgT3Ak8DB+jXPAC4F3g7cFxHnAjHcy4zw2iuBlQA9PT3DbjMarqUvSYO19UZuZq7KzHmZuQB4EdhGNYO/PyvrgVeB6fX4nJanzwaebWf/R+Na+pI0WLtX7/S/SftG4GrgbuCfgXfX4+cBk4AXgDXAkoiYHBHnAHOB9e3s/2hcS1+SBhtze6e2OiKmAQeAZZn5UkTcCdwZEZuoruq5NjMT2BwR9wFPU7WBlp3IK3fA9o4kHa6t0M/M+cOM7Qf+eITtVwAr2tnnsbC9I0mDNf4TuYa+JA1ofOjb3pGkAY0Ofds7kjRYo0Pf9o4kDdb40Le9I0kDGhv6+/fDgQPO9CWpVWND3xU2JWmoxoe+7R1JGtD40HemL0kDGhv6rqUvSUM1NvSd6UvSUI0PfXv6kjSgsaFve0eShmps6NvekaShGh/6tnckaUBjQ9/2jiQN1djQ7+uDCJgypdOVSNL40ejQP+20KvglSZXGh74kaUBjQ98/oCJJQzU29F1LX5KGanToO9OXpMEaG/q2dyRpqMaGvu0dSRpqYqcLOFF+7/dg9uxOVyFJ40tjQ/+OOzpdgSSNP41t70iShjL0Jakghr4kFcTQl6SCGPqSVBBDX5IKYuhLUkEMfUkqSGRmp2s4oojoBX46xqdPB144juWcbN1eP3T/MXR7/dD9x9Dt9UNnjuE3MnPG4YPjPvTbEREbMrOn03WMVbfXD91/DN1eP3T/MXR7/TC+jsH2jiQVxNCXpII0PfRXdrqANnV7/dD9x9Dt9UP3H0O31w/j6Bga3dOXJA3W9Jm+JKmFoS9JBWlk6EfE5RGxNSK2R8QNna5ntCLiJxHxVEQ8EREb6rHXR8TaiNhW357R6Tr7RcSdEbE7Ija1jI1Yb0TcWJ+TrRGxsDNVDzbCMdwcET+rz8MTEbGo5bFxdQwRMSci/jUitkTE5oi4vh7vivNwhPq76Ry8JiLWR8ST9THcUo+Pz3OQmY36AiYAzwDnApOAJ4ELOl3XKGv/CTD9sLHbgRvq+zcAt3W6zpbaFgDzgE1Hqxe4oD4Xk4Fz6nM0YZwew83Anw+z7bg7BuBMYF59/7XAf9V1dsV5OEL93XQOAji9vn8q8Dhw6Xg9B02c6V8CbM/M/87M/cA9wOIO19SOxcBd9f27gCs7WMsgmfkI8OJhwyPVuxi4JzP3ZeYOYDvVueqoEY5hJOPuGDLzucz8j/r+y8AWYBZdch6OUP9IxlX9AFnZU397av2VjNNz0MTQnwXsbPl+F0f+RzSeJPAvEbExIpbWY2/IzOeg+g8CzOxYdaMzUr3ddl7+LCJ+VLd/+n8tH9fHEBFnA79NNdPsuvNwWP3QRecgIiZExBPAbmBtZo7bc9DE0I9hxrrlutTfycx5wBXAsohY0OmCjqNuOi/fBN4EvA14DvhKPT5ujyEiTgdWA8sz83+PtOkwYx0/hmHq76pzkJmHMvNtwGzgkoi46Aibd/QYmhj6u4A5Ld/PBp7tUC3HJDOfrW93A9+h+pXv+Yg4E6C+3d25CkdlpHq75rxk5vP1f+JXgb9h4FfvcXkMEXEqVWD+Q2beXw93zXkYrv5uOwf9MvMXwA+Byxmn56CJof/vwNyIOCciJgFLgDUdrumoIuK0iHht/33gMmATVe3X1ptdC3y3MxWO2kj1rgGWRMTkiDgHmAus70B9R9X/H7V2FdV5gHF4DBERwCpgS2be0fJQV5yHkervsnMwIyJ+vb4/BXgP8GPG6zno5LveJ+oLWER1FcAzwE2drmeUNZ9L9Y7+k8Dm/rqBacDDwLb69vWdrrWl5rupfvU+QDV7+eiR6gVuqs/JVuCKTtd/hGP4e+Ap4EdU/0HPHK/HAPwuVWvgR8AT9deibjkPR6i/m87BW4D/rGvdBHyuHh+X58BlGCSpIE1s70iSRmDoS1JBDH1JKoihL0kFMfQlqSCGviQVxNCXpIL8H+S7kO9PLd1hAAAAAElFTkSuQmCC\n",
      "text/plain": [
       "<Figure size 432x288 with 1 Axes>"
      ]
     },
     "metadata": {
      "needs_background": "light"
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "# evaluate the histogram\n",
    "values, base = np.histogram(gdf['Tot Fwd Pkts'].head(1000), bins=40)\n",
    "\n",
    "#evaluate the cumulative\n",
    "cumulative = np.cumsum(values)\n",
    "\n",
    "# plot the cumulative function\n",
    "plt.plot(base[:-1], cumulative, c='blue')\n",
    "plt.show()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "It looks like over 99.5% of our traffic has less than 25 total forward packets. Could we just flag all the traffic with greater than 25 forward packets as anaomolous? Is this a good idea? Why or why not?\n",
    "\n",
    "Let's plot another data field, `Flow Duration`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "<matplotlib.axes._subplots.AxesSubplot at 0x7f64a5f25400>"
      ]
     },
     "execution_count": 20,
     "metadata": {},
     "output_type": "execute_result"
    },
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAXQAAAERCAYAAABrWly6AAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADh0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uMy4xLjEsIGh0dHA6Ly9tYXRwbG90bGliLm9yZy8QZhcZAAAfQklEQVR4nO3dfXRc9X3n8fdnRpLlZ4MtwPEDNtQFQsAFvDwkJAttesCcbOmmkANpQ5fSeJOmbbJNdttm96Skuz1puz19SEhwnYQCbUOTbIDSxCSlDQQIGBDGNhgwMRhsgYOFn21Z0jx89497JY+FZI3MjDRz+bwOc5i59zd3vleSP/rpN7/7G0UEZmbW/HITXYCZmdWGA93MLCMc6GZmGeFANzPLCAe6mVlGONDNzDJiQgNd0i2Sdkh6pgbHulTSuopbr6RfrkWdZmbNQBM5D13S+4ADwO0R8a4aHvd4YDMwPyJ6anVcM7NGNqE99Ih4ENhVuU3SqZK+L+lJSQ9JOv0YDn0VcK/D3MzeThpxDH0V8DsRcR7wGeArx3CMa4A7alqVmVmDa5noAipJmga8G/i2pIHNk9J9HwT+eJinvRoRl1UcYy5wFvCD+lZrZtZYGirQSf5i2BMRPzd0R0TcCdxZxTE+BNwVEYVaF2dm1sgaasglIvYBWyRdDaDE0jEe5lo83GJmb0MTPW3xDuBR4DRJXZJuAH4VuEHSemAjcOUYjrcIWAD8qPbVmpk1tgmdtmhmZrXTUEMuZmZ27CbsTdE5c+bEokWLJurlzcya0pNPPvlGRHQMt2/CAn3RokV0dnZO1MubmTUlSa+MtM9DLmZmGeFANzPLiFEDXVK7pMclrZe0UdLnh2lziaS9FSsdfq4+5ZqZ2UiqGUPvA34+Ig5IagUelnRvRKwZ0u6hiPhA7Us0M7NqjBrokUxUP5A+bE1vnrxuZtZgqhpDl5SXtA7YAdwXEY8N0+yidFjmXklnjnCcFZI6JXV2d3e/hbLNzGyoqgI9IkrpglnzgfMlDf0wirXAyRGxFPgScPcIx1kVEcsiYllHx7DTKM3M7BiNaZZLROwBHgAuH7J9X0QcSO+vBlolzalVkWZmNrpqZrl0SJqV3p8MvB94fkibk5QuYC7p/PS4O2tfrpmZjaSaWS5zgdsk5UmC+lsR8V1JHwOIiJUkH/n2cUlF4BBwTYzDql/feGzrsNs/fMHCer+0mVnDqWaWywbgnGG2r6y4fxNwU21LMzOzsfCVomZmGeFANzPLCAe6mVlGONDNzDLCgW5mlhEOdDOzjHCgm5llhAPdzCwjHOhmZhnhQDczywgHuplZRjjQzcwywoFuZpYRDnQzs4xwoJuZZYQD3cwsIxzoZmYZ4UA3M8sIB7qZWUY40M3MMsKBbmaWEaMGuqR2SY9LWi9po6TPD9NGkr4oabOkDZLOrU+5ZmY2kpYq2vQBPx8RByS1Ag9Lujci1lS0WQ4sSW8XADen/zczs3Eyag89EgfSh63pLYY0uxK4PW27BpglaW5tSzUzs6OpagxdUl7SOmAHcF9EPDakyTxgW8XjrnTb0OOskNQpqbO7u/tYazYzs2FUFegRUYqInwPmA+dLeteQJhruacMcZ1VELIuIZR0dHWOv1szMRjSmWS4RsQd4ALh8yK4uYEHF4/nAa2+pMjMzG5NqZrl0SJqV3p8MvB94fkize4Dr0tkuFwJ7I2J7zas1M7MRVTPLZS5wm6Q8yS+Ab0XEdyV9DCAiVgKrgSuAzUAPcH2d6jUzsxGMGugRsQE4Z5jtKyvuB/CJ2pZmZmZj4StFzcwywoFuZpYRDnQzs4xwoJuZZYQD3cwsIxzoZmYZ4UA3M8sIB7qZWUY40M3MMsKBbmaWEQ50M7OMcKCbmWWEA93MLCMc6GZmGeFANzPLCAe6mVlGONDNzDLCgW5mlhEOdDOzjHCgm5llhAPdzCwjRg10SQsk3S/pOUkbJX1ymDaXSNoraV16+1x9yjUzs5G0VNGmCHw6ItZKmg48Kem+iHh2SLuHIuIDtS/RzMyqMWoPPSK2R8Ta9P5+4DlgXr0LMzOzsRnTGLqkRcA5wGPD7L5I0npJ90o6c4Tnr5DUKamzu7t7zMWamdnIqg50SdOA7wCfioh9Q3avBU6OiKXAl4C7hztGRKyKiGURsayjo+NYazYzs2FUFeiSWknC/B8j4s6h+yNiX0QcSO+vBlolzalppWZmdlTVzHIR8HXguYj4yxHanJS2Q9L56XF31rJQMzM7umpmubwH+AjwtKR16bbPAgsBImIlcBXwcUlF4BBwTUREHeo1M7MRjBroEfEwoFHa3ATcVKuizMxs7HylqJlZRjjQzcwywoFuZpYRDnQzs4xwoJuZZYQD3cwsIxzoZmYZ4UA3M8sIB7qZWUY40M3MMsKBbmaWEQ50M7OMcKCbmWWEA93MLCMc6GZmGeFANzPLCAe6mVlGONDNzDLCgW5mlhEOdDOzjHCgm5llxKiBLmmBpPslPSdpo6RPDtNGkr4oabOkDZLOrU+5ZmY2kpYq2hSBT0fEWknTgScl3RcRz1a0WQ4sSW8XADen/zczs3Eyag89IrZHxNr0/n7gOWDekGZXArdHYg0wS9LcmldrZmYjGtMYuqRFwDnAY0N2zQO2VTzu4s2hj6QVkjoldXZ3d4+tUjMzO6qqA13SNOA7wKciYt/Q3cM8Jd60IWJVRCyLiGUdHR1jq9TMzI6qqkCX1EoS5v8YEXcO06QLWFDxeD7w2lsvz8zMqlXNLBcBXweei4i/HKHZPcB16WyXC4G9EbG9hnWamdkoqpnl8h7gI8DTktal2z4LLASIiJXAauAKYDPQA1xf+1LNzOxoRg30iHiY4cfIK9sE8IlaFWVmZmPnK0XNzDLCgW5mlhEOdDOzjHCgm5llhAPdzCwjHOhmZhnhQDczywgHuplZRjjQzcwywoFuZlZnW3f28N++uY7+Yrmur+NANzOrszVbdnLXU6+ybXdPXV/HgW5mVmeFUtIz7y2U6vo6DnQzszorpEMtfR5yMTNrbsVy8gFu7qGbmTW5/pJ76GZmmVAoJj30PvfQzcyaW8E9dDOzbPAsFzOzjPAYuplZRriHbmaWEcXSwJuiE9xDl3SLpB2Snhlh/yWS9kpal94+V/syzcya18CQS2+xvj30lira3ArcBNx+lDYPRcQHalKRmVnGFBqlhx4RDwK76lqFmVmGDVz6X+8eeq3G0C+StF7SvZLOHKmRpBWSOiV1dnd31+ilzcwa2+A89InuoVdhLXByRCwFvgTcPVLDiFgVEcsiYllHR0cNXtrMrPEdHkNv8ECPiH0RcSC9vxpolTTnLVdmZpYRh3voDT7kIukkSUrvn58ec+dbPa6ZWVYMTFusdw991Fkuku4ALgHmSOoC/ghoBYiIlcBVwMclFYFDwDUREXWr2MysyYxXD33UQI+Ia0fZfxPJtEYzMxtG/zj10H2lqJlZnTXNGLqZmR3dQKD3u4duZtbcBi8scg/dzKy5DYyhe/lcM7MmVyy7h25mlgkDQy7uoZuZNbmB1RaL5aBYql+oO9DNzOooIugvlZncmgfq20t3oJuZ1VGxnPTOp7Un13HWcxzdgW5mVkcDc9Cnp4HuHrqZWZMqFJMe+vRJ7qGbmTW1QjplcZp76GZmzW1gyGWae+hmZs1tcMilvRVwD93MrGn1u4duZpYNA0MuMzyGbmbW3AbH0D0P3cysuR1+U9Rj6GZmTW1gHZfBaYvuoZuZNSdfKWpmlhGDgd4Is1wk3SJph6RnRtgvSV+UtFnSBknn1r5MM7Pm1J/OQ5/clienie+h3wpcfpT9y4El6W0FcPNbL8vMLBsGeuiTWnJMaslPbKBHxIPArqM0uRK4PRJrgFmS5taqQDOzZjYQ6C25HO2tuYaftjgP2FbxuCvdZmb2tldMZ7m0DvTQC439pqiG2RbDNpRWSOqU1Nnd3V2DlzYza2wDl/635pX00IuN3UPvAhZUPJ4PvDZcw4hYFRHLImJZR0dHDV7azKyxDQy5tOWbo4d+D3BdOtvlQmBvRGyvwXHNzJpeYbCHnqt7D71ltAaS7gAuAeZI6gL+CGgFiIiVwGrgCmAz0ANcX69izcyazcCVoq3j0EMfNdAj4tpR9gfwiZpVZGaWIf3Fw2Pok1pzHOgr1u21fKWomVkdFUplWnJCUlOMoZuZ2QiK5aA1n0TtpCaY5WJmZiPoL5ZpzSezu9vdQzcza16FUpm2lsM99D730M3MmlOhVB4ccnEP3cysiRVK4zeGPuq0RTMzG5tvPLZ18P7mHQc41F/iG49tpb0lT6EUlMpBPjfcqilvjXvoZmZ1VBnek1qTyK3XOLoD3cysjioDvT19c7Re4+gOdDOzOipFZQ89D1C3cXQHuplZHR3RQ291D93MrGkdMYbe4h66mVnTKpWDvNxDNzNresP20Ov0uaIOdDOzOioON4ZedA/dzKzplOPNPXQHuplZExpulouHXMzMmlBxmDF099DNzJpQqVx+06X/7qGbmTWhUjlokXvoZmZNz2PoZmYZEBGUA3JpoLflc0gT3EOXdLmkTZI2S/qDYfZfImmvpHXp7XO1L9XMrLmUIgBoSQNdEu0teYql+gT6qB9wISkPfBn4RaALeELSPRHx7JCmD0XEB+pQo5lZUyqVk0Cv/DCLZ//4MqTaf7gFVNdDPx/YHBEvRUQ/8E/AlXWpxswsQ4YL9HqFOVQX6POAbRWPu9JtQ10kab2keyWdOdyBJK2Q1Cmps7u7+xjKNTNrHsMFej1VE+jDVRJDHq8FTo6IpcCXgLuHO1BErIqIZRGxrKOjY2yVmpk1mcFAr2OvvFI1gd4FLKh4PB94rbJBROyLiAPp/dVAq6Q5NavSzKwJNWIP/QlgiaTFktqAa4B7KhtIOknpwJCk89Pj7qx1sWZmzaQ4zoE+6iyXiChK+m3gB0AeuCUiNkr6WLp/JXAV8HFJReAQcE1EDB2WMTN7WylHgwU6DA6jrB6ybWXF/ZuAm2pbmplZc2vEIRczMzsGDnQzs4wY7zF0B7qZWZ0M9NBbGmjaopmZHYOBQM+5h25m1tw8hm5mlhGlcZ626EA3M6uTwTH03PhErQPdzKxOPORiZpYRDvRjUCiV2d9bmOgyzMyO0IirLTa8Bzbt4K/+7QX66vTBq2Zmx8I99GOwbdchegtlnnlt30SXYmZvc33FEt/d8Br7DhV8peix2L6vF4C1W3dPcCVm9nb3xJbdPPLiTjZ07RlcbXGc8rz5A31/b4GDfUVmTm5lyxsH2X2wf6JLMrO3sQ2v7gGga88hSuUgn1NdP0e0UtMH+k/3Jr3z959xAgBPbXMv3cwmzoZtewF4dffhQB8vzR/o6XDL6SfNYPGcqazduocfPv86V698hP9519MTXJ2Zvd08/WoS6DsP9nOgrzhuM1wgC4G+t5cZ7S1MndTCuQuPY9fBfn7j1k6efnUv33h8Ky91H5joEs3sbeKNA328uucQS06YBsDWXT20uIdevZ/u6+Wkme0AnDVvJuctPI4/v+psHvjMpbTmc3z94S0TXKGZZdm2XT309BeBw73zCxYfD8Cug/3jttIiVPkRdI2qWC6zY18fS06YDkBbS45fOW8+xVLww+d3sHT+TL75xDZOnj2VqW15TpjRzrvmzWDuzMkTXLmZZcHug/1c/tcPsvysufzF1Ut5umsvEpzSMY3jp7ax62C/x9Cr9cb+fkoRgz30od7zM3MoloMHX+jmjie28dHbO/nkHesY+PzqiGDNSzvp9QVJZlaFiBjMD4B/WPMKB/tL3P3Uq/x0by8buvZwypyptLfmmTcr6Tg60I/itT2H+My313Oov8RP9x0CGDHQT5jezuknTefhzW/w7Gt7ueS0Dh5/eRcPvNANJN+Ma1at4dPfWn/EN+ntZMsbB/naQy9RKJUnuhR7m9rT009fsfE7VcVSmRtu6+T6W5+gUCrTWyhx26Ov8K55MyhHcOsjL7Ohay9L588CYP5xSaA33Bi6pMslbZK0WdIfDLNfkr6Y7t8g6dzal5rY+No+vrO2i098Yy2v7j5EXqJj2qQR2//CGSeyaPZUbrj4FL563TJOnj2FP//+Jn7y+n7+ZPVzzJ3Zzvee3s7f/PtPqq4hIrjv2dd5MP3FMJJiqcxTW3cf8RfA3p4Cj2/ZNXhJ8ETq2t3DtavW8H++9xz/9e+f9F8qNu6eeHkX7/3z+7nyph/Tvb9vwuo40Ffk0Rd3DnZsCqUyN96zkeV/8xA/eX0/AH/2/ef54fM7eGBTN3967/P887pXeeNAH3+4/AyWv2sutz3yMjv293HW/JkAE9JDH3UMXVIe+DLwi0AX8ISkeyLi2Ypmy4El6e0C4Ob0/zX3i+88kT/55bP47F1PkxOcOKP9qF+webMms+J9pwDw7c4uLlw8m292buPKL/+YnMSvv3sRL7y+n7/+t5/w+r5eegtl+oolLv6ZDt7/zhPYsa+P+5/fwc6D/bx3yRxO6ZjGn3zvWf7tuR0A/Kel7+B/XHYam3cc4LEtuzhxxiTeu2QOr+/r44//5Vk2vb6fBcdP5g+Xn8HeQwX+7w82setgP2fNm8mNv3QmJ81s55lX99LTX+Sdc2dyasdUdvX0s21XDzmJRbOnMmtKK7t7CnTv72NKW54TZkyiLZ9jf1+R/b1Fpk1qYUZ7C5LoL5bpL5VpyYm2fG7wDZmIoKe/xMH+IlPbWjhUKHHd1x+np7/IJy49la888CK/fsvj/P7y01k0eyrHTWmt+mKIQqlMBLTmkwsoIoK+YpmcNLitVA56CyVa8znaWnKDz+stlJjcmqclnyMi6C2UKZTLTG1rIZ8T5XKwv68IAdPak229hRL7egu05nLMmNyKgN09/ew82M+M9lbmTGvjqW17+NpDL/Hoizu54qy53HDxYhbOnkL3/j56C2U6pk1ixuQWiuVg76FkYbeZk1tpzecolMoc6C3SkhdT21rI5ZKva09/kfbWPJPS+vuKZfoKZaZMytOa1n+oUKJYjiPq7ymUEDClLY8kiqUyB/tLtOVztLfmBr9vh/pLtLflmNSSH/xa9BVLTGlroa0lR7kcHOwvUioH0ya10JLPUSyV2d9bJCcd8fXZ31tkUmuOaW0tSHCwv8TBviJT2vJMm9RCOWDfoQKHCiVmTm5lSlueQinYdTAZxjx+ShuT2/Ic7CvSvb+PlryYMy35udvV00/3/j6mTWrhxBntSMlfzm8c6KNjWjtzZ7XT019i844D7OnpZ9GcqSw4bgqv7DxI5yu76SuUWLboeHbs7+W3/nEtJ0xv55WdPXzobx/l5l87l607e3hy624WzZ7KxT8zhylteTpf2c3mHQc4Y+50zlt4PHsO9bPmpZ3s2NfHeScfx9kLZvH89n386IVuCqXgfT87h9NPmsH9z+/gBxt/yuxpk/ilpe+gY/okbn1kC9/bsJ3zTj6O37h4Ma/v6+ULq59nx/4+lpwwjf9+2Wnc9ujL/HjzTqZNauGDX3mEay9YyFcf2sJ1F51MTuLrD29h1pRWzpg7g3efOpspbXm+9/R2AM6eP5NNPz3AO2ZNRozfwlwAGm2oQdJFwI0RcVn6+A8BIuILFW3+FnggIu5IH28CLomI7SMdd9myZdHZ2XnMhd/0w5/wF//6AucsmMXVyxZU/bxyBF++fzPb9/by4fMX8q55MymUyvzDmld46Y2DTG9vgYA9h45cvbG9NUdvIfnt3ZoX7z/jRAqlMvdv6q5YxF6DazdA8ifX9e9ZzLee2Mam9Lf8+YuO54qzTuLmH73I6/ve3CORYOi3JJ/Tm3r0Q18rnxOCI7ZBcslxaz5HOYJC6c3HuOHixZw8eyrrt+3hO2u7Bp+fE0jJMSUQIv3v8GOgv1Q+/LmJSt6Y7iuWB88hnxMtOdFXPDyk05oXQvRXDPO0teQoleOI85yUHqtSWz53xPOG+1oMmDWllQsXz+b+TTvedJyBOoZ+TYYeX4LW3JHbWvMi4sivdVtLEq6VZQytX0qOX7ktnxN5afTj53MUyuUjfjbaWnL0j/L1kZJAqTxWS06UIo441nBfi+G2Dfe1zokjznu4n+GRzJ3ZzvXvWczOA33c9ujLg//Ghh6zWvmcyIkj6n7HzHb2HCrQ05/8BdqWz3Hp6R10vrybnemV5WfPn8nVyxbw1QdfYuuuHlrz4gsfPJuLTp3NR2/r5Nnt+zhn4Sy+ueIiAD781TV0vrKbv/zQUj547nwArl75CGu37uGZGy/jrqdeBeCv7nuB6ZNb+M2Lk07lhy9YOPaTGkLSkxGxbNh9VQT6VcDlEfGb6eOPABdExG9XtPku8KcR8XD6+N+B34+IziHHWgGsSB+eBmw6tlMaNAd44y0eo9Fk8Zwgm+eVxXOCbJ5Xls7p5IjoGG5HNdMWh/t7YehvgWraEBGrgFVVvGZVJHWO9JuqWWXxnCCb55XFc4JsnlcWz2k41bwp2gVUjmnMB147hjZmZlZH1QT6E8ASSYsltQHXAPcMaXMPcF062+VCYO/Rxs/NzKz2Rh1yiYiipN8GfgDkgVsiYqOkj6X7VwKrgSuAzUAPcH39Sj5CzYZvGkgWzwmyeV5ZPCfI5nll8ZzeZNQ3Rc3MrDk03ZWiZmY2PAe6mVlGNEWgN9LSA7VSxTn9anouGyQ9ImnpRNQ5VqOdV0W7/yCplF7n0NCqOSdJl0haJ2mjpB+Nd43HooqfwZmS/kXS+vS8xuu9sWMm6RZJOyQ9M8L+psuKMRlYPaxRbyRvxL4InAK0AeuBdw5pcwVwL8l8+AuBxya67hqc07uB49L7yxv9nKo9r4p2PyR5M/2qia67Bt+rWcCzwML08QkTXXeNzuuzwJ+l9zuAXUDbRNc+ynm9DzgXeGaE/U2VFWO9NUMP/Xxgc0S8FBH9wD8BVw5pcyVweyTWALMkzR3vQsdg1HOKiEciYuADUteQzO1vdNV8rwB+B/gOsGM8iztG1ZzTh4E7I2IrQERk5bwCmK5kUZ9pJIFeHN8yxyYiHiSpcyTNlhVj0gyBPg/YVvG4K9021jaNZKz13kDSq2h0o56XpHnAfwZWjmNdb0U136ufBY6T9ICkJyVdN27VHbtqzusm4AySiwSfBj4ZEc2+znKzZcWYNMMnFtVs6YEGUnW9ki4lCfSL61pRbVRzXn9Nss5PqdrVHCdYNefUApwH/AIwGXhU0pqIeKHexb0F1ZzXZcA64OeBU4H7JD0UEfvqXVwdNVtWjEkzBHoWlx6oql5JZwNfA5ZHxM5xqu2tqOa8lgH/lIb5HOAKScWIuHt8Shyzan/+3oiIg8BBSQ8CS4FGDvRqzut6kkX3AtgsaQtwOvD4+JRYF82WFWPSDEMuWVx6YNRzkrQQuBP4SIP39CqNel4RsTgiFkXEIuD/Ab/VwGEO1f38/TPwXkktkqaQfBbAc+Nc51hVc15bSf7qQNKJJCukvjSuVdZes2XFmDR8Dz0ae+mBY1LlOX0OmA18Je3NFqPBV4ur8ryaSjXnFBHPSfo+sAEoA1+LiGGnzTWKKr9X/xu4VdLTJEMVvx8RDb0EraQ7gEuAOZK6gD8CWqE5s2KsfOm/mVlGNMOQi5mZVcGBbmaWEQ50M7OMcKCbmWWEA93MbByMtnDYkLYLJd0v6al0EbErqnkNB7o1lHQFxnUVt0XpSobfreFrLJJ0KP3H8pykxyX9eq2On77Gp9I56QOPV0uaVcvXsKZzK3B5lW3/F/CtiDiH5BqBr1TzpIafh25vO4ci4ucqN0haVIfXeTH9x4KkU4A7JeUi4u+qeXK6YJWOsrbJp4B/IJnrTERU1cOy7IqIB4f+LEs6FfgyyWqWPcBHI+J5kuUIZqTNZlLl1azuoVtTkXS8pLvTP0PXpMsjIOlpSbPSKwB3DiyQJenvJb3/aMeMiJeA3wN+N33OjZI+U/Gaz6S9+kVpj/4rwFpggaSbJXUqWS/882n73wXeAdwv6f5028uS5qT3fy895jOSPpVuGzj2V9Nj/aukybX96lkDWgX8TkScB3yGwz3xG4FfSy+OWk2yQumoHOjWaCZXDLfcNcz+zwNPRcTZJOt1355u/zHwHuBMksvT35tuv5Bk+eHRrCVZp2Q0p5Esv3pORLwC/M/0Ct6zgf8o6eyI+CJJj+rSiLi08smSziO5OvGCtLaPSjon3b0E+HJEnAnsAX6linqsSUmaRvK5B9+WtA74W2BgKd9rgVsjYj7Jla1/L2nUvPaQizWaNw25DHExadBFxA8lzZY0E3iI5MMNXgFuBlYoWap3V0QcqOJ1q1368ZV0He0BH5K0guTf0lzgnSRLAByt/rvShbyQdCfJL597gC0RsS5t9ySwqMqarDnlgD0j/LzfQDreHhGPSmonWczuqGvtu4duzWak5U8fJAnG9wIPAN3AVSRBX41zOLygVpEj/220V9w/OFiItJjkz+RfSP9i+N6QttXWP6Cv4n4Jd7gyLV2GeIukq2Hw4/EGPmqycmG0M0h+rrpHO6YD3ZrNg8CvQvI5niTL1u6LiG0kPZgl6Zj4wyRhO2qgp29U/QXwpXTTyyQfY4aSz5xcPMJTZ5AE/N50NcLlFfv2A9NHqP+XJU2RNJXkwz6q/aVjTSxdOOxR4DRJXZJuIPlZvkHSemAjhz816tMkw3HrgTuA/xJVLLzlHoA1mxuBv5O0gWRWQOV0w8dIVg6EJCS/QBLswzlV0lMkPZ/9wJcqZrh8h2SJ1XUky8wOu3xxRKxPj7GRZNz+xxW7VwH3StpeOY4eEWsl3crhNcW/FhFP1WkmjzWQiLh2hF1vmsoYEc+SvCc0Jl5t0cwsIzzkYmaWEQ50M7OMcKCbmWWEA93MLCMc6GZmGeFANzPLCAe6mVlG/H8Pqe0OEMT6ogAAAABJRU5ErkJggg==\n",
      "text/plain": [
       "<Figure size 432x288 with 1 Axes>"
      ]
     },
     "metadata": {
      "needs_background": "light"
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "#plot a histogram of a sample of our dataset with a kde kernal density estimate overlaid \n",
    "sns.distplot(gdf['Flow Duration'].head(1000))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "It looks like `Flow Duration` is bimodal, what would it mean to have a single threshold to determine outliers within this field?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <font color=\"green\">Code Me</font>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Use another visual analysis to investigate data distributions. [Violin plots](https://seaborn.pydata.org/generated/seaborn.violinplot.html#seaborn.violinplot) could be informative.  "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [],
   "source": [
    "# your code here"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Graph Representation of the Network Data"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Networks (including cybersecurity networks) are frequently interpreted and represented as graphs. A graph representation affords us many benefits during analysis, including using both the structure, edge features, and generated features for anomaly detection. We first demonstrate how to create a [cuGraph](https://github.com/rapidsai/cugraph) representation of graph data represented in cuDF, then we walk through some analysis."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {},
   "outputs": [],
   "source": [
    "G = cugraph.Graph()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CPU times: user 47.7 ms, sys: 23.9 ms, total: 71.7 ms\n",
      "Wall time: 71.5 ms\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "gdf['src_ip_r'], gdf['dst_ip_r'], numbering = cugraph.renumber(gdf['src_ip'], gdf['dst_ip'])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Flow ID</th>\n",
       "      <th>Src IP</th>\n",
       "      <th>Src Port</th>\n",
       "      <th>Dst IP</th>\n",
       "      <th>Dst Port</th>\n",
       "      <th>Protocol</th>\n",
       "      <th>Timestamp</th>\n",
       "      <th>Flow Duration</th>\n",
       "      <th>Tot Fwd Pkts</th>\n",
       "      <th>Tot Bwd Pkts</th>\n",
       "      <th>...</th>\n",
       "      <th>Idle Mean</th>\n",
       "      <th>Idle Std</th>\n",
       "      <th>Idle Max</th>\n",
       "      <th>Idle Min</th>\n",
       "      <th>Label</th>\n",
       "      <th>datetime</th>\n",
       "      <th>src_ip</th>\n",
       "      <th>dst_ip</th>\n",
       "      <th>src_ip_r</th>\n",
       "      <th>dst_ip_r</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>8.0.6.4-8.6.0.1-0-0-0</td>\n",
       "      <td>8.6.0.1</td>\n",
       "      <td>0</td>\n",
       "      <td>8.0.6.4</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>02/03/2018 12:50:13 PM</td>\n",
       "      <td>112640178</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>...</td>\n",
       "      <td>56320092.0</td>\n",
       "      <td>159.806137</td>\n",
       "      <td>56320200.0</td>\n",
       "      <td>56319976.0</td>\n",
       "      <td>No Label</td>\n",
       "      <td>1520038213</td>\n",
       "      <td>134610945</td>\n",
       "      <td>134219268</td>\n",
       "      <td>189</td>\n",
       "      <td>6461</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>8.0.6.4-8.6.0.1-0-0-0</td>\n",
       "      <td>8.6.0.1</td>\n",
       "      <td>0</td>\n",
       "      <td>8.0.6.4</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>02/03/2018 12:53:02 PM</td>\n",
       "      <td>112642593</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>...</td>\n",
       "      <td>56321296.0</td>\n",
       "      <td>120.915260</td>\n",
       "      <td>56321384.0</td>\n",
       "      <td>56321212.0</td>\n",
       "      <td>No Label</td>\n",
       "      <td>1520038382</td>\n",
       "      <td>134610945</td>\n",
       "      <td>134219268</td>\n",
       "      <td>189</td>\n",
       "      <td>6461</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>8.0.6.4-8.6.0.1-0-0-0</td>\n",
       "      <td>8.6.0.1</td>\n",
       "      <td>0</td>\n",
       "      <td>8.0.6.4</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>02/03/2018 12:55:51 PM</td>\n",
       "      <td>112640127</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>...</td>\n",
       "      <td>56320068.0</td>\n",
       "      <td>251.022903</td>\n",
       "      <td>56320240.0</td>\n",
       "      <td>56319884.0</td>\n",
       "      <td>No Label</td>\n",
       "      <td>1520038551</td>\n",
       "      <td>134610945</td>\n",
       "      <td>134219268</td>\n",
       "      <td>189</td>\n",
       "      <td>6461</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>8.0.6.4-8.6.0.1-0-0-0</td>\n",
       "      <td>8.6.0.1</td>\n",
       "      <td>0</td>\n",
       "      <td>8.0.6.4</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>02/03/2018 12:58:40 PM</td>\n",
       "      <td>112641715</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>...</td>\n",
       "      <td>56320852.0</td>\n",
       "      <td>67.175140</td>\n",
       "      <td>56320904.0</td>\n",
       "      <td>56320812.0</td>\n",
       "      <td>No Label</td>\n",
       "      <td>1520038720</td>\n",
       "      <td>134610945</td>\n",
       "      <td>134219268</td>\n",
       "      <td>189</td>\n",
       "      <td>6461</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>8.0.6.4-8.6.0.1-0-0-0</td>\n",
       "      <td>8.6.0.1</td>\n",
       "      <td>0</td>\n",
       "      <td>8.0.6.4</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>02/03/2018 01:01:29 PM</td>\n",
       "      <td>112642245</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>...</td>\n",
       "      <td>56321120.0</td>\n",
       "      <td>3.535534</td>\n",
       "      <td>56321124.0</td>\n",
       "      <td>56321120.0</td>\n",
       "      <td>No Label</td>\n",
       "      <td>1519995689</td>\n",
       "      <td>134610945</td>\n",
       "      <td>134219268</td>\n",
       "      <td>189</td>\n",
       "      <td>6461</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 89 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                 Flow ID   Src IP  Src Port   Dst IP  Dst Port  Protocol  \\\n",
       "0  8.0.6.4-8.6.0.1-0-0-0  8.6.0.1         0  8.0.6.4         0         0   \n",
       "1  8.0.6.4-8.6.0.1-0-0-0  8.6.0.1         0  8.0.6.4         0         0   \n",
       "2  8.0.6.4-8.6.0.1-0-0-0  8.6.0.1         0  8.0.6.4         0         0   \n",
       "3  8.0.6.4-8.6.0.1-0-0-0  8.6.0.1         0  8.0.6.4         0         0   \n",
       "4  8.0.6.4-8.6.0.1-0-0-0  8.6.0.1         0  8.0.6.4         0         0   \n",
       "\n",
       "                Timestamp  Flow Duration  Tot Fwd Pkts  Tot Bwd Pkts  ...  \\\n",
       "0  02/03/2018 12:50:13 PM      112640178             2             1  ...   \n",
       "1  02/03/2018 12:53:02 PM      112642593             2             1  ...   \n",
       "2  02/03/2018 12:55:51 PM      112640127             2             1  ...   \n",
       "3  02/03/2018 12:58:40 PM      112641715             2             1  ...   \n",
       "4  02/03/2018 01:01:29 PM      112642245             2             1  ...   \n",
       "\n",
       "    Idle Mean    Idle Std    Idle Max    Idle Min     Label    datetime  \\\n",
       "0  56320092.0  159.806137  56320200.0  56319976.0  No Label  1520038213   \n",
       "1  56321296.0  120.915260  56321384.0  56321212.0  No Label  1520038382   \n",
       "2  56320068.0  251.022903  56320240.0  56319884.0  No Label  1520038551   \n",
       "3  56320852.0   67.175140  56320904.0  56320812.0  No Label  1520038720   \n",
       "4  56321120.0    3.535534  56321124.0  56321120.0  No Label  1519995689   \n",
       "\n",
       "      src_ip     dst_ip  src_ip_r  dst_ip_r  \n",
       "0  134610945  134219268       189      6461  \n",
       "1  134610945  134219268       189      6461  \n",
       "2  134610945  134219268       189      6461  \n",
       "3  134610945  134219268       189      6461  \n",
       "4  134610945  134219268       189      6461  \n",
       "\n",
       "[5 rows x 89 columns]"
      ]
     },
     "execution_count": 24,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "gdf.head().to_pandas()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CPU times: user 298 µs, sys: 28 µs, total: 326 µs\n",
      "Wall time: 330 µs\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "G.add_edge_list(gdf['src_ip_r'],gdf['dst_ip_r'],None)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Calculating the Degree"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We'll find the number of connections at each node. This is often useful to see what nodes have the most connections, as these are typically backbone assets of the network."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CPU times: user 5.39 ms, sys: 4.42 ms, total: 9.81 ms\n",
      "Wall time: 9.81 ms\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "deg = G.degree()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "       vertex   degree\n",
      "1110     1110  2093163\n",
      "28314   28314   506784\n",
      "11418   11418   286191\n"
     ]
    }
   ],
   "source": [
    "# top 3 most connected vertices \n",
    "print(deg.sort_values('degree', ascending=False).head(3))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "This isn't super useful though since it's the internal cuGraph renumbering representation of the vertex. Ideally, we want the actual IPv4 address. We can do that via a quick [`merge` operation](https://rapidsai.github.io/projects/cudf/en/latest/api.html?highlight=merge#cudf.dataframe.DataFrame.merge)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CPU times: user 296 ms, sys: 201 ms, total: 496 ms\n",
      "Wall time: 498 ms\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "ip_lookup_gdf = cudf.concat([gdf[['Src IP','src_ip_r']].rename({'Src IP': 'ip','src_ip_r':'vertex'}),\n",
    "                             gdf[['Dst IP','dst_ip_r']].rename({'Dst IP': 'ip','dst_ip_r':'vertex'})]) \\\n",
    "                .drop_duplicates()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CPU times: user 2.42 ms, sys: 11.5 ms, total: 13.9 ms\n",
      "Wall time: 12.6 ms\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "ip_to_vertex_gdf = deg.drop_duplicates() \\\n",
    "                        .merge(ip_lookup_gdf, how='left', left_on='vertex', right_on='vertex')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>vertex</th>\n",
       "      <th>degree</th>\n",
       "      <th>ip</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>764</th>\n",
       "      <td>1110</td>\n",
       "      <td>2093163</td>\n",
       "      <td>172.31.0.2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25824</th>\n",
       "      <td>28314</td>\n",
       "      <td>506784</td>\n",
       "      <td>169.254.169.254</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16064</th>\n",
       "      <td>11418</td>\n",
       "      <td>286191</td>\n",
       "      <td>18.219.211.138</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>28197</th>\n",
       "      <td>20991</td>\n",
       "      <td>119999</td>\n",
       "      <td>5.101.40.43</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>34423</th>\n",
       "      <td>21265</td>\n",
       "      <td>110934</td>\n",
       "      <td>5.101.40.105</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3779</th>\n",
       "      <td>189</td>\n",
       "      <td>83222</td>\n",
       "      <td>8.6.0.1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>29827</th>\n",
       "      <td>6461</td>\n",
       "      <td>83222</td>\n",
       "      <td>8.0.6.4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20245</th>\n",
       "      <td>23183</td>\n",
       "      <td>72525</td>\n",
       "      <td>213.202.230.222</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>24134</th>\n",
       "      <td>30144</td>\n",
       "      <td>63190</td>\n",
       "      <td>72.21.91.29</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>28664</th>\n",
       "      <td>22834</td>\n",
       "      <td>59877</td>\n",
       "      <td>213.202.230.143</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "       vertex   degree               ip\n",
       "764      1110  2093163       172.31.0.2\n",
       "25824   28314   506784  169.254.169.254\n",
       "16064   11418   286191   18.219.211.138\n",
       "28197   20991   119999      5.101.40.43\n",
       "34423   21265   110934     5.101.40.105\n",
       "3779      189    83222          8.6.0.1\n",
       "29827    6461    83222          8.0.6.4\n",
       "20245   23183    72525  213.202.230.222\n",
       "24134   30144    63190      72.21.91.29\n",
       "28664   22834    59877  213.202.230.143"
      ]
     },
     "execution_count": 30,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# top 10 most connected vertices\n",
    "ip_to_vertex_gdf.sort_values('degree', ascending=False).head(10).to_pandas()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now we have a better idea of what IPs have the highest degree. It looks like `172.31.0.2` is the highest, followed by the `169.254.169.254` IP address and the `18.219.211.138` address. Unfortunately, only one of these (the last one) is responsible for launching any attacks in this dataset. How can we write a different analytic that will move that IP address to the top of our triage list?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Say Hello to PageRank"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "PageRank (PR) is a [fairly well-known algorithm](https://en.wikipedia.org/wiki/PageRank), originally developed to rank web pages in Google search results. Traditionally, the PageRank algorithm outputs a probability distribution which represents the likelihood that a person randomly clicking on links will arrive at any particular page. We can use that same property to rank states of an attack graph.\n",
    "\n",
    "Fortunately for us, cuGraph makes it easy to calculate the PR of each node in a graph."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CPU times: user 113 ms, sys: 56.3 ms, total: 169 ms\n",
      "Wall time: 171 ms\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "# Call cugraph.pagerank to get the pagerank scores\n",
    "gdf_pr = cugraph.pagerank(G)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "And here are some of the PR values."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 32,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>vertex</th>\n",
       "      <th>pagerank</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>0</td>\n",
       "      <td>0.000005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>1</td>\n",
       "      <td>0.000013</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>2</td>\n",
       "      <td>0.000110</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>3</td>\n",
       "      <td>0.000005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>4</td>\n",
       "      <td>0.000005</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "   vertex  pagerank\n",
       "0       0  0.000005\n",
       "1       1  0.000013\n",
       "2       2  0.000110\n",
       "3       3  0.000005\n",
       "4       4  0.000005"
      ]
     },
     "execution_count": 32,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "gdf_pr.head().to_pandas()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "In order to find the most important node, we first find the maximum PR value"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 33,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "0.14738360047340393\n"
     ]
    }
   ],
   "source": [
    "pr_max = gdf_pr['pagerank'].max()\n",
    "print(pr_max)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "And we then write a function that can search for that vertex and return it."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 34,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Use this value in a query to find the vertex and convert back to IP\n",
    "def print_pagerank_threshold(_df, t=0) :\n",
    "    filtered = _df.query('pagerank >= @t')    \n",
    "    for i in range(len(filtered)):\n",
    "        print(\"The most important vertex is \" + str(filtered['vertex'][i]) + \n",
    "            \" with a pagerank score of \" + str(filtered['pagerank'][i]))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 35,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "The most important vertex is 1110 with a pagerank score of 0.1473836\n"
     ]
    }
   ],
   "source": [
    "print_pagerank_threshold(gdf_pr, pr_max)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <font color=\"green\">Code Me</font>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Using what you know about cuDF and cuGraph, is there a different way you could write the function `print_pagerank_threshold`? What about if we want the actual IPv4 address and not the renumbered vertex ID?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 36,
   "metadata": {},
   "outputs": [],
   "source": [
    "# your code here"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We know either by looking or by writing some more code that the node with the maximum PR value corresponds to the IP address `172.31.0.2`. That's the IP address that had the highest degree, and it's not one of the IPs that responsible for the botnet attack. Well that wasn't super useful."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Personalized PageRank to the Rescue"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The issue for us is that PageRank sets the initial weights of all the nodes the same. In other words, it assumes a uniform starting probability for every node. What if we have _a priori_ information about the nodes? In this context, what if we know some of the victim IP addresses, and we're not sure we have identified all of them? We can use personalized PageRank (PPR) to assist."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We first construct a list of `training_victim_ips`. These are the IP addresses that we _know_ to be compromised. But since we have ground truth data, we also know _all_ of the affected IP addresses. We'll make another list for those (but we don't use them in training)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 37,
   "metadata": {},
   "outputs": [],
   "source": [
    "# the victim IPs we're going to consider for training\n",
    "training_victim_ips = ['172.31.69.23','172.31.69.17', '172.31.69.14', '172.31.69.12', '172.31.69.10', \n",
    "              '172.31.69.26', '172.31.69.29', '172.31.69.30']\n",
    "\n",
    "# all of the victim IPs we know via ground truth\n",
    "all_victim_ips = ['172.31.69.23','172.31.69.17', '172.31.69.14', '172.31.69.12', '172.31.69.10', '172.31.69.8', \n",
    "              '172.31.69.6', '172.31.69.26', '172.31.69.29', '172.31.69.30']\n",
    "\n",
    "# we know the times of the attack, so we put the [start, stop] times here for reference\n",
    "attack_time_1 = [1519999860, 1520004840]\n",
    "attack_time_2 = [1520015040, 1520020500]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We can now filter out the attack flows. There were two attacks at two different times on this date. We construct two DFs for each attack. We then assign a label of `1` if the flow represents an attack and `0` if it's benign. We do this for all IP addresses in our training set over the two affected time periods.\n",
    "\n",
    "TL;DR - we're constructing a labeled training set. More accurately in this case, we're constructing a dataset to help us set initial probabilities (weights) for the PPR algorithm."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 38,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CPU times: user 5.31 s, sys: 2.52 s, total: 7.83 s\n",
      "Wall time: 8.34 s\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "attack1_gdf = gdf[(gdf['Src IP'] == \"18.219.211.138\") & ((gdf['Dst IP'] == training_victim_ips[0]) | \n",
    "                                                         (gdf['Dst IP'] == training_victim_ips[1]) | \n",
    "                                                         (gdf['Dst IP'] == training_victim_ips[2]) | \n",
    "                                                         (gdf['Dst IP'] == training_victim_ips[3]) | \n",
    "                                                         (gdf['Dst IP'] == training_victim_ips[4]) |\n",
    "                                                         (gdf['Dst IP'] == training_victim_ips[5]) |\n",
    "                                                         (gdf['Dst IP'] == training_victim_ips[6]) |\n",
    "                                                         (gdf['Dst IP'] == training_victim_ips[7])) &\n",
    "                    (gdf['datetime'] > attack_time_1[0]) * (gdf['datetime'] < attack_time_1[1])]\n",
    "\n",
    "attack2_gdf = gdf[(gdf['Src IP'] == \"18.219.211.138\") & ((gdf['Dst IP'] == training_victim_ips[0]) | \n",
    "                                                         (gdf['Dst IP'] == training_victim_ips[1]) | \n",
    "                                                         (gdf['Dst IP'] == training_victim_ips[2]) | \n",
    "                                                         (gdf['Dst IP'] == training_victim_ips[3]) | \n",
    "                                                         (gdf['Dst IP'] == training_victim_ips[4]) |\n",
    "                                                         (gdf['Dst IP'] == training_victim_ips[5]) |\n",
    "                                                         (gdf['Dst IP'] == training_victim_ips[6]) |\n",
    "                                                         (gdf['Dst IP'] == training_victim_ips[7])) &\n",
    "                    (gdf['datetime'] > attack_time_2[0]) * (gdf['datetime'] < attack_time_2[1])]\n",
    "\n",
    "attack_flow_ids_gdf = cudf.concat([attack1_gdf,attack2_gdf])['Flow ID'].unique().to_frame(name='Flow ID')\n",
    "attack_flow_ids_gdf['Label'] = int(1)\n",
    "\n",
    "gdf = gdf.merge(attack_flow_ids_gdf, left_on=['Flow ID'], right_on=['Flow ID'], how='left', suffixes=('_orig',''))\n",
    "gdf['Label'] = gdf['Label'].fillna(0)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Just for fun, the cell below performs the same task using pandas. It's commented out, but feel free to uncomment and compare timings."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 39,
   "metadata": {},
   "outputs": [],
   "source": [
    "# %%time\n",
    "# gdf_as_pdf = gdf.to_pandas()\n",
    "\n",
    "# attack1 = gdf_as_pdf[(gdf_as_pdf['Src IP'] == \"18.219.211.138\") & (gdf_as_pdf['Dst IP'].isin(training_victim_ips)) & \n",
    "#                    (gdf_as_pdf['datetime'] > attack_time_1[0]) & (gdf_as_pdf['datetime'] < attack_time_1[1])]\n",
    "\n",
    "# attack2 = gdf_as_pdf[(gdf_as_pdf['Src IP'] == \"18.219.211.138\") & (gdf_as_pdf['Dst IP'].isin(training_victim_ips)) & \n",
    "#                    (gdf_as_pdf['datetime'] > attack_time_2[0]) & (gdf_as_pdf['datetime'] < attack_time_2[1])]\n",
    "\n",
    "# attack_flow_ids = set(attack1['Flow ID']) | set(attack2['Flow ID'])\n",
    "\n",
    "# gdf_as_pdf[\"Label\"] = [int(1) if fid in attack_flow_ids else int(0) for fid in gdf_as_pdf['Flow ID']]\n",
    "\n",
    "# gdf = cudf.DataFrame.from_pandas(gdf_as_pdf)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Let's inspect the head of the DF to make sure we have what we need."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 40,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Label</th>\n",
       "      <th>datetime</th>\n",
       "      <th>Src IP</th>\n",
       "      <th>Dst IP</th>\n",
       "      <th>src_ip_r</th>\n",
       "      <th>dst_ip_r</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>0</td>\n",
       "      <td>1520017541</td>\n",
       "      <td>172.31.64.118</td>\n",
       "      <td>169.254.169.254</td>\n",
       "      <td>1604</td>\n",
       "      <td>28314</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>0</td>\n",
       "      <td>1520017541</td>\n",
       "      <td>172.31.64.118</td>\n",
       "      <td>169.254.169.254</td>\n",
       "      <td>1604</td>\n",
       "      <td>28314</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>0</td>\n",
       "      <td>1520017541</td>\n",
       "      <td>172.31.64.118</td>\n",
       "      <td>169.254.169.254</td>\n",
       "      <td>1604</td>\n",
       "      <td>28314</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>0</td>\n",
       "      <td>1520017541</td>\n",
       "      <td>172.31.64.118</td>\n",
       "      <td>169.254.169.254</td>\n",
       "      <td>1604</td>\n",
       "      <td>28314</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>0</td>\n",
       "      <td>1520017495</td>\n",
       "      <td>172.31.64.118</td>\n",
       "      <td>169.254.169.254</td>\n",
       "      <td>1604</td>\n",
       "      <td>28314</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>0</td>\n",
       "      <td>1520017549</td>\n",
       "      <td>172.31.64.118</td>\n",
       "      <td>169.254.169.254</td>\n",
       "      <td>1604</td>\n",
       "      <td>28314</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>0</td>\n",
       "      <td>1520006372</td>\n",
       "      <td>24.234.124.9</td>\n",
       "      <td>172.31.64.118</td>\n",
       "      <td>3756</td>\n",
       "      <td>1604</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>0</td>\n",
       "      <td>1520017597</td>\n",
       "      <td>172.31.64.118</td>\n",
       "      <td>169.254.169.254</td>\n",
       "      <td>1604</td>\n",
       "      <td>28314</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>0</td>\n",
       "      <td>1520017597</td>\n",
       "      <td>172.31.64.118</td>\n",
       "      <td>169.254.169.254</td>\n",
       "      <td>1604</td>\n",
       "      <td>28314</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>0</td>\n",
       "      <td>1520017597</td>\n",
       "      <td>172.31.64.118</td>\n",
       "      <td>169.254.169.254</td>\n",
       "      <td>1604</td>\n",
       "      <td>28314</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "   Label    datetime         Src IP           Dst IP  src_ip_r  dst_ip_r\n",
       "0      0  1520017541  172.31.64.118  169.254.169.254      1604     28314\n",
       "1      0  1520017541  172.31.64.118  169.254.169.254      1604     28314\n",
       "2      0  1520017541  172.31.64.118  169.254.169.254      1604     28314\n",
       "3      0  1520017541  172.31.64.118  169.254.169.254      1604     28314\n",
       "4      0  1520017495  172.31.64.118  169.254.169.254      1604     28314\n",
       "5      0  1520017549  172.31.64.118  169.254.169.254      1604     28314\n",
       "6      0  1520006372   24.234.124.9    172.31.64.118      3756      1604\n",
       "7      0  1520017597  172.31.64.118  169.254.169.254      1604     28314\n",
       "8      0  1520017597  172.31.64.118  169.254.169.254      1604     28314\n",
       "9      0  1520017597  172.31.64.118  169.254.169.254      1604     28314"
      ]
     },
     "execution_count": 40,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "gdf[['Label', 'datetime','Src IP', 'Dst IP', 'src_ip_r', 'dst_ip_r']].head(10).to_pandas()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Let's think about what we have here. We have _known attacks_ on _known IPs_. We also know there are some unknown number of other IPs that could be impacted. We want a way to prioritize what other IPs to investigate. Personalized PageRank take a `personalization vector` as an initialization parameter. Technically, this vector contains the transport probabilities for each node in the vector. For us, this amounts to setting some initial weights that are not uniform.\n",
    "\n",
    "But how to do this? One straightforward way is, for each node, to count the number of attack-labeled edges it has. This is a task made for a `groupby().count()`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 41,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CPU times: user 1.94 s, sys: 757 ms, total: 2.7 s\n",
      "Wall time: 2.75 s\n"
     ]
    }
   ],
   "source": [
    "%%time \n",
    "# Get only rows that are labeld as 1 (attack)\n",
    "attacked_gdf = gdf[gdf['Label'] == 1]\n",
    "\n",
    "# For each node, count how many attack-labeled edges it makes\n",
    "aggregated_gdf = attacked_gdf.groupby(['src_ip_r']).count()\n",
    "\n",
    "# Get personalization vector\n",
    "# (make sure that the type of vertex is int32 and that of values is float32)\n",
    "personalization_vec = cudf.DataFrame()\n",
    "personalization_vec['vertex'] = aggregated_gdf.index.values\n",
    "personalization_vec['values'] = aggregated_gdf['Timestamp'].astype('float32')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We now have everything we need to run PPR. In cuGraph, PPR is the same function as regular PR. The only change is that we add a `personalization` parameter and feed it in the personalization vector we computed above."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 42,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CPU times: user 132 ms, sys: 32.6 ms, total: 165 ms\n",
      "Wall time: 162 ms\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "# Run PPR\n",
    "ppr = cugraph.pagerank(G, alpha=0.85, personalization=personalization_vec, max_iter=100, tol=1.0e-5, nstart=None)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now what if we query the PPR results for the node with the maximum PPR value?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 43,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "The most important vertex is 11418 with a pagerank score of 0.38848895\n"
     ]
    }
   ],
   "source": [
    "ppr_max = ppr['pagerank'].max()\n",
    "\n",
    "print_pagerank_threshold(ppr, ppr_max)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Looking back in our original dataset, we see that this vertex corresponds to the IP address `18.219.211.138`. This is the same IP address that is responsible for initiating the botnet attacks."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 44,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Flow ID</th>\n",
       "      <th>Src IP</th>\n",
       "      <th>Src Port</th>\n",
       "      <th>Dst IP</th>\n",
       "      <th>Dst Port</th>\n",
       "      <th>Protocol</th>\n",
       "      <th>Timestamp</th>\n",
       "      <th>Flow Duration</th>\n",
       "      <th>Tot Fwd Pkts</th>\n",
       "      <th>Tot Bwd Pkts</th>\n",
       "      <th>...</th>\n",
       "      <th>Idle Std</th>\n",
       "      <th>Idle Max</th>\n",
       "      <th>Idle Min</th>\n",
       "      <th>Label_orig</th>\n",
       "      <th>datetime</th>\n",
       "      <th>src_ip</th>\n",
       "      <th>dst_ip</th>\n",
       "      <th>src_ip_r</th>\n",
       "      <th>dst_ip_r</th>\n",
       "      <th>Label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>5353089</th>\n",
       "      <td>172.31.69.10-18.219.211.138-55063-8080-6</td>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>8080</td>\n",
       "      <td>172.31.69.10</td>\n",
       "      <td>55063</td>\n",
       "      <td>6</td>\n",
       "      <td>02/03/2018 03:23:29 PM</td>\n",
       "      <td>579</td>\n",
       "      <td>0</td>\n",
       "      <td>3</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>No Label</td>\n",
       "      <td>1520004209</td>\n",
       "      <td>316396426</td>\n",
       "      <td>2887730442</td>\n",
       "      <td>11418</td>\n",
       "      <td>6616</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5356769</th>\n",
       "      <td>172.31.69.10-18.219.211.138-51393-8080-6</td>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>8080</td>\n",
       "      <td>172.31.69.10</td>\n",
       "      <td>51393</td>\n",
       "      <td>6</td>\n",
       "      <td>02/03/2018 07:49:10 PM</td>\n",
       "      <td>11457</td>\n",
       "      <td>4</td>\n",
       "      <td>3</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>No Label</td>\n",
       "      <td>1520020150</td>\n",
       "      <td>316396426</td>\n",
       "      <td>2887730442</td>\n",
       "      <td>11418</td>\n",
       "      <td>6616</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5356771</th>\n",
       "      <td>172.31.69.10-18.219.211.138-51394-8080-6</td>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>8080</td>\n",
       "      <td>172.31.69.10</td>\n",
       "      <td>51394</td>\n",
       "      <td>6</td>\n",
       "      <td>02/03/2018 07:49:10 PM</td>\n",
       "      <td>12068</td>\n",
       "      <td>4</td>\n",
       "      <td>3</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>No Label</td>\n",
       "      <td>1520020150</td>\n",
       "      <td>316396426</td>\n",
       "      <td>2887730442</td>\n",
       "      <td>11418</td>\n",
       "      <td>6616</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5356773</th>\n",
       "      <td>172.31.69.10-18.219.211.138-51395-8080-6</td>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>8080</td>\n",
       "      <td>172.31.69.10</td>\n",
       "      <td>51395</td>\n",
       "      <td>6</td>\n",
       "      <td>02/03/2018 07:49:11 PM</td>\n",
       "      <td>11608</td>\n",
       "      <td>4</td>\n",
       "      <td>3</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>No Label</td>\n",
       "      <td>1520020151</td>\n",
       "      <td>316396426</td>\n",
       "      <td>2887730442</td>\n",
       "      <td>11418</td>\n",
       "      <td>6616</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5356775</th>\n",
       "      <td>172.31.69.10-18.219.211.138-51396-8080-6</td>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>8080</td>\n",
       "      <td>172.31.69.10</td>\n",
       "      <td>51396</td>\n",
       "      <td>6</td>\n",
       "      <td>02/03/2018 07:49:11 PM</td>\n",
       "      <td>10175</td>\n",
       "      <td>4</td>\n",
       "      <td>3</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>No Label</td>\n",
       "      <td>1520020151</td>\n",
       "      <td>316396426</td>\n",
       "      <td>2887730442</td>\n",
       "      <td>11418</td>\n",
       "      <td>6616</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5356777</th>\n",
       "      <td>172.31.69.10-18.219.211.138-51398-8080-6</td>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>8080</td>\n",
       "      <td>172.31.69.10</td>\n",
       "      <td>51398</td>\n",
       "      <td>6</td>\n",
       "      <td>02/03/2018 07:49:12 PM</td>\n",
       "      <td>11869</td>\n",
       "      <td>4</td>\n",
       "      <td>3</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>No Label</td>\n",
       "      <td>1520020152</td>\n",
       "      <td>316396426</td>\n",
       "      <td>2887730442</td>\n",
       "      <td>11418</td>\n",
       "      <td>6616</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5356779</th>\n",
       "      <td>172.31.69.10-18.219.211.138-51399-8080-6</td>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>8080</td>\n",
       "      <td>172.31.69.10</td>\n",
       "      <td>51399</td>\n",
       "      <td>6</td>\n",
       "      <td>02/03/2018 07:49:13 PM</td>\n",
       "      <td>11627</td>\n",
       "      <td>4</td>\n",
       "      <td>3</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>No Label</td>\n",
       "      <td>1520020153</td>\n",
       "      <td>316396426</td>\n",
       "      <td>2887730442</td>\n",
       "      <td>11418</td>\n",
       "      <td>6616</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5356781</th>\n",
       "      <td>172.31.69.10-18.219.211.138-51401-8080-6</td>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>8080</td>\n",
       "      <td>172.31.69.10</td>\n",
       "      <td>51401</td>\n",
       "      <td>6</td>\n",
       "      <td>02/03/2018 07:49:14 PM</td>\n",
       "      <td>11678</td>\n",
       "      <td>4</td>\n",
       "      <td>3</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>No Label</td>\n",
       "      <td>1520020154</td>\n",
       "      <td>316396426</td>\n",
       "      <td>2887730442</td>\n",
       "      <td>11418</td>\n",
       "      <td>6616</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5356783</th>\n",
       "      <td>172.31.69.10-18.219.211.138-51402-8080-6</td>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>8080</td>\n",
       "      <td>172.31.69.10</td>\n",
       "      <td>51402</td>\n",
       "      <td>6</td>\n",
       "      <td>02/03/2018 07:49:14 PM</td>\n",
       "      <td>12821</td>\n",
       "      <td>4</td>\n",
       "      <td>3</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>No Label</td>\n",
       "      <td>1520020154</td>\n",
       "      <td>316396426</td>\n",
       "      <td>2887730442</td>\n",
       "      <td>11418</td>\n",
       "      <td>6616</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5356785</th>\n",
       "      <td>172.31.69.10-18.219.211.138-51405-8080-6</td>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>8080</td>\n",
       "      <td>172.31.69.10</td>\n",
       "      <td>51405</td>\n",
       "      <td>6</td>\n",
       "      <td>02/03/2018 07:49:15 PM</td>\n",
       "      <td>12241</td>\n",
       "      <td>4</td>\n",
       "      <td>3</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>No Label</td>\n",
       "      <td>1520020155</td>\n",
       "      <td>316396426</td>\n",
       "      <td>2887730442</td>\n",
       "      <td>11418</td>\n",
       "      <td>6616</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>10 rows × 90 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                                          Flow ID          Src IP  Src Port  \\\n",
       "5353089  172.31.69.10-18.219.211.138-55063-8080-6  18.219.211.138      8080   \n",
       "5356769  172.31.69.10-18.219.211.138-51393-8080-6  18.219.211.138      8080   \n",
       "5356771  172.31.69.10-18.219.211.138-51394-8080-6  18.219.211.138      8080   \n",
       "5356773  172.31.69.10-18.219.211.138-51395-8080-6  18.219.211.138      8080   \n",
       "5356775  172.31.69.10-18.219.211.138-51396-8080-6  18.219.211.138      8080   \n",
       "5356777  172.31.69.10-18.219.211.138-51398-8080-6  18.219.211.138      8080   \n",
       "5356779  172.31.69.10-18.219.211.138-51399-8080-6  18.219.211.138      8080   \n",
       "5356781  172.31.69.10-18.219.211.138-51401-8080-6  18.219.211.138      8080   \n",
       "5356783  172.31.69.10-18.219.211.138-51402-8080-6  18.219.211.138      8080   \n",
       "5356785  172.31.69.10-18.219.211.138-51405-8080-6  18.219.211.138      8080   \n",
       "\n",
       "               Dst IP  Dst Port  Protocol               Timestamp  \\\n",
       "5353089  172.31.69.10     55063         6  02/03/2018 03:23:29 PM   \n",
       "5356769  172.31.69.10     51393         6  02/03/2018 07:49:10 PM   \n",
       "5356771  172.31.69.10     51394         6  02/03/2018 07:49:10 PM   \n",
       "5356773  172.31.69.10     51395         6  02/03/2018 07:49:11 PM   \n",
       "5356775  172.31.69.10     51396         6  02/03/2018 07:49:11 PM   \n",
       "5356777  172.31.69.10     51398         6  02/03/2018 07:49:12 PM   \n",
       "5356779  172.31.69.10     51399         6  02/03/2018 07:49:13 PM   \n",
       "5356781  172.31.69.10     51401         6  02/03/2018 07:49:14 PM   \n",
       "5356783  172.31.69.10     51402         6  02/03/2018 07:49:14 PM   \n",
       "5356785  172.31.69.10     51405         6  02/03/2018 07:49:15 PM   \n",
       "\n",
       "         Flow Duration  Tot Fwd Pkts  Tot Bwd Pkts  ...  Idle Std  Idle Max  \\\n",
       "5353089            579             0             3  ...       0.0       0.0   \n",
       "5356769          11457             4             3  ...       0.0       0.0   \n",
       "5356771          12068             4             3  ...       0.0       0.0   \n",
       "5356773          11608             4             3  ...       0.0       0.0   \n",
       "5356775          10175             4             3  ...       0.0       0.0   \n",
       "5356777          11869             4             3  ...       0.0       0.0   \n",
       "5356779          11627             4             3  ...       0.0       0.0   \n",
       "5356781          11678             4             3  ...       0.0       0.0   \n",
       "5356783          12821             4             3  ...       0.0       0.0   \n",
       "5356785          12241             4             3  ...       0.0       0.0   \n",
       "\n",
       "         Idle Min  Label_orig    datetime     src_ip      dst_ip  src_ip_r  \\\n",
       "5353089       0.0    No Label  1520004209  316396426  2887730442     11418   \n",
       "5356769       0.0    No Label  1520020150  316396426  2887730442     11418   \n",
       "5356771       0.0    No Label  1520020150  316396426  2887730442     11418   \n",
       "5356773       0.0    No Label  1520020151  316396426  2887730442     11418   \n",
       "5356775       0.0    No Label  1520020151  316396426  2887730442     11418   \n",
       "5356777       0.0    No Label  1520020152  316396426  2887730442     11418   \n",
       "5356779       0.0    No Label  1520020153  316396426  2887730442     11418   \n",
       "5356781       0.0    No Label  1520020154  316396426  2887730442     11418   \n",
       "5356783       0.0    No Label  1520020154  316396426  2887730442     11418   \n",
       "5356785       0.0    No Label  1520020155  316396426  2887730442     11418   \n",
       "\n",
       "         dst_ip_r  Label  \n",
       "5353089      6616      1  \n",
       "5356769      6616      1  \n",
       "5356771      6616      1  \n",
       "5356773      6616      1  \n",
       "5356775      6616      1  \n",
       "5356777      6616      1  \n",
       "5356779      6616      1  \n",
       "5356781      6616      1  \n",
       "5356783      6616      1  \n",
       "5356785      6616      1  \n",
       "\n",
       "[10 rows x 90 columns]"
      ]
     },
     "execution_count": 44,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "gdf.query('src_ip_r == 11418').head(10).to_pandas()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Let's merge our PPR values back with this larger cuDF."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 45,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CPU times: user 3.46 s, sys: 2.22 s, total: 5.68 s\n",
      "Wall time: 5.76 s\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "gdf = ppr.merge(gdf, how='left', left_on='vertex', right_on='src_ip_r')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now the moment of truth. If we sort our entire cuDF by the PPR value, we should find those with a maximum PPR at the top. The hypothesis is that these IPs are involved in the attacks."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 46,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CPU times: user 369 ms, sys: 248 ms, total: 618 ms\n",
      "Wall time: 674 ms\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Src IP</th>\n",
       "      <th>Src Port</th>\n",
       "      <th>Dst IP</th>\n",
       "      <th>pagerank</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>255319</th>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>8080</td>\n",
       "      <td>172.31.69.10</td>\n",
       "      <td>0.388489</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>447724</th>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>8080</td>\n",
       "      <td>172.31.69.17</td>\n",
       "      <td>0.388489</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>547515</th>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>8080</td>\n",
       "      <td>172.31.69.29</td>\n",
       "      <td>0.388489</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>566418</th>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>8080</td>\n",
       "      <td>172.31.69.30</td>\n",
       "      <td>0.388489</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>646744</th>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>8080</td>\n",
       "      <td>172.31.69.6</td>\n",
       "      <td>0.388489</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>981243</th>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>8080</td>\n",
       "      <td>172.31.69.8</td>\n",
       "      <td>0.388489</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7207468</th>\n",
       "      <td>172.31.69.30</td>\n",
       "      <td>0</td>\n",
       "      <td>131.202.242.193</td>\n",
       "      <td>0.130268</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3132618</th>\n",
       "      <td>172.31.69.30</td>\n",
       "      <td>0</td>\n",
       "      <td>18.219.211.138</td>\n",
       "      <td>0.130268</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7546939</th>\n",
       "      <td>172.31.69.30</td>\n",
       "      <td>0</td>\n",
       "      <td>209.85.203.91</td>\n",
       "      <td>0.130268</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3680824</th>\n",
       "      <td>172.31.69.30</td>\n",
       "      <td>0</td>\n",
       "      <td>224.0.0.22</td>\n",
       "      <td>0.130268</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3363660</th>\n",
       "      <td>172.31.69.30</td>\n",
       "      <td>0</td>\n",
       "      <td>23.218.62.30</td>\n",
       "      <td>0.130268</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5895348</th>\n",
       "      <td>172.31.69.30</td>\n",
       "      <td>0</td>\n",
       "      <td>23.218.63.234</td>\n",
       "      <td>0.130268</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7465097</th>\n",
       "      <td>172.31.69.30</td>\n",
       "      <td>0</td>\n",
       "      <td>40.80.145.27</td>\n",
       "      <td>0.130268</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6990836</th>\n",
       "      <td>172.31.69.30</td>\n",
       "      <td>0</td>\n",
       "      <td>40.80.145.38</td>\n",
       "      <td>0.130268</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6990848</th>\n",
       "      <td>172.31.69.30</td>\n",
       "      <td>0</td>\n",
       "      <td>52.10.55.151</td>\n",
       "      <td>0.130268</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                 Src IP  Src Port           Dst IP  pagerank\n",
       "255319   18.219.211.138      8080     172.31.69.10  0.388489\n",
       "447724   18.219.211.138      8080     172.31.69.17  0.388489\n",
       "547515   18.219.211.138      8080     172.31.69.29  0.388489\n",
       "566418   18.219.211.138      8080     172.31.69.30  0.388489\n",
       "646744   18.219.211.138      8080      172.31.69.6  0.388489\n",
       "981243   18.219.211.138      8080      172.31.69.8  0.388489\n",
       "7207468    172.31.69.30         0  131.202.242.193  0.130268\n",
       "3132618    172.31.69.30         0   18.219.211.138  0.130268\n",
       "7546939    172.31.69.30         0    209.85.203.91  0.130268\n",
       "3680824    172.31.69.30         0       224.0.0.22  0.130268\n",
       "3363660    172.31.69.30         0     23.218.62.30  0.130268\n",
       "5895348    172.31.69.30         0    23.218.63.234  0.130268\n",
       "7465097    172.31.69.30         0     40.80.145.27  0.130268\n",
       "6990836    172.31.69.30         0     40.80.145.38  0.130268\n",
       "6990848    172.31.69.30         0     52.10.55.151  0.130268"
      ]
     },
     "execution_count": 46,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%time \n",
    "gdf[['Src IP','Src Port','Dst IP','pagerank']] \\\n",
    "        .drop_duplicates() \\\n",
    "        .sort_values(by='pagerank', ascending=False) \\\n",
    "        .head(15) \\\n",
    "        .to_pandas()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 47,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "['172.31.69.23',\n",
       " '172.31.69.17',\n",
       " '172.31.69.14',\n",
       " '172.31.69.12',\n",
       " '172.31.69.10',\n",
       " '172.31.69.26',\n",
       " '172.31.69.29',\n",
       " '172.31.69.30']"
      ]
     },
     "execution_count": 47,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "training_victim_ips"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "A visual inspection of this table shows us that there are IPs we suspect. Looking in the `Dst IP` column, we find `172.31.69.10`, `172.31.69.17`, `172.31.69.29`, and `172.31.69.30`. But we also see `172.31.69.6` and `172.31.69.8`. These were not in our original training dataset (meaning we assumed we didn't know about them), but they _are_ victims of the attack as shown in the ground truth dataset. Neat."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <font color=\"green\">Code Me</font>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We used simple counts to provide the personalization vector for PPR. There are other ways you could construct this vector. What about degree (especially degree in a digraph)?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 48,
   "metadata": {},
   "outputs": [],
   "source": [
    "# your code here"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <font color=\"green\">Code Me</font>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We've talked about PageRank and Personalized PageRank, but there are other graph analyitcs availabe in cuGraph. One of them is [Louvain modularity](https://rapidsai.github.io/projects/cugraph/en/0.8.0/api.html?highlight=louvain#cugraph.nvLouvain) (community detection). Calculating the partitions is fairly straightforward:\n",
    "\n",
    "```louvain_parts, modularity_score = cugraph.louvain(G)```\n",
    "\n",
    "Use Louvain modularity to partition the network graph, and investigate the results. Are all the the victim IPs in the same community? Would you expect them to be?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 49,
   "metadata": {},
   "outputs": [],
   "source": [
    "# your code here"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Visualization"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Many times, analysts are content (and prefer) raw analytic results that are enriched back to the original dataset and/or the [SIEM](https://searchsecurity.techtarget.com/definition/security-information-and-event-management-SIEM). But what if you do want to visualize some of these results? Here we show how some of that is possible, including a live demo using [Graphistry](https://www.graphistry.com)."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "![Visualization](./images/viz_1.jpg)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<hr />\n",
    "\n",
    "## Acknowledgmnets"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We would like to thank the [Canadian Institute for Cybersecurity](https://www.unb.ca/cic/) for the data used in this tutorial. A complete description of the dataset used is [available online](https://registry.opendata.aws/cse-cic-ids2018/). In addition, the paper associated with this dataset is:\n",
    "\n",
    "> Iman Sharafaldin, Arash Habibi Lashkari, and Ali A. Ghorbani, “Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization”, 4th International Conference on Information Systems Security and Privacy (ICISSP), Portugal, January 2018\n",
    "\n",
    "We would also like to acknowledge the contributions of Eli Fajardo (NVIDIA), Brad Rees, PhD (NVIDIA), and the [RAPIDS](https://rapids.ai) engineering team."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.6.7"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}