labs/Lab-3/Lab-3-Practical/03_Random_Forest_Pipeline_Lab.ipynb

Module 3 — Lab 3: A Random Forest Security Pipeline

Topics: Scikit-learn Pipeline, imputation, Random Forest, fit, predict

Instructions: Run the cells in order. Complete every TODO, then run the Self-check cell. Do not open the Solution notebook before attempting the tasks yourself.

Learning objectives

After completing this lab, you will be able to:

• create one reusable preprocessing-and-model pipeline;
• train a Random Forest binary classifier;
• generate predictions for unseen data;
• explain why tree models do not require feature standardization.

In [ ]:

from pathlib import Path
import numpy as np
import pandas as pd

DATA_PATH = Path("data/cicids2017_binary_sample.csv")
RANDOM_STATE = 42

from sklearn.model_selection import train_test_split
from sklearn.pipeline import Pipeline
from sklearn.impute import SimpleImputer
from sklearn.ensemble import RandomForestClassifier

1. Prepare the binary classification data

In [ ]:

df = pd.read_csv(DATA_PATH)
df.columns = df.columns.str.strip()
df = df.drop_duplicates().replace([np.inf, -np.inf], np.nan)

# TODO 1: create numeric X and binary y
X = None
y = None

# TODO 2: create a stratified 80/20 split
X_train, X_test, y_train, y_test = None, None, None, None

2. Build one pipeline

In [ ]:

# TODO 3: create a Pipeline with:
# - SimpleImputer(strategy="median")
# - RandomForestClassifier with n_estimators=100, max_depth=12,
#   random_state=42, and n_jobs=-1
pipeline = None

print(pipeline)

Why there is no StandardScaler

Random Forest makes decisions by comparing feature values with thresholds. Scaling a column does not change the ordering of its values, so standardization is not required for this model family. The imputer remains inside the pipeline because the model needs finite values.

3. Train and predict

In [ ]:

# TODO 4: fit the complete pipeline on X_train and y_train

# TODO 5: predict labels for X_test and store them in y_pred
y_pred = None

print("Predictions:", None)
print("Number of test samples:", None)

4. Predict one flow

In [ ]:

one_flow = X_test.iloc[[0]]

# TODO 6: predict one_flow and convert the result to int
one_prediction = None

print("Prediction:", one_prediction)
print("Meaning:", "ATTACK" if one_prediction == 1 else "BENIGN")

Self-check

In [ ]:

assert list(pipeline.named_steps) == ["imputer", "model"]
assert pipeline.named_steps["model"].n_estimators == 100
assert len(y_pred) == len(y_test)
assert set(np.unique(y_pred)).issubset({0, 1})
assert one_prediction in {0, 1}
print("✓ Lab 3 completed")

Reflection questions

1. What problem does the imputer solve inside the pipeline?
2. Why is a pipeline safer than manually transforming train and test data in separate cells?
3. What does random_state=42 contribute to the experiment?