labs/Lab-6/Lab-6-Practical/04_OneClass_IsolationForest_Lab.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "cell-001",
   "metadata": {},
   "source": [
    "# Module 6 — Lab 4: One-Class SVM and Isolation Forest\n",
    "\n",
    " \n",
    "**Topics:** normal-only learning, anomaly scores, validation thresholds, PR-AUC, runtime\n",
    "\n",
    "> **Lab version:** Complete every `TODO`, run the cells in order, and use the self-check before opening the Solution."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "cell-002",
   "metadata": {},
   "source": [
    "## Learning objectives\n",
    "\n",
    "After completing this lab, you will be able to:\n",
    "\n",
    "- fit two normal-only novelty detectors;\n",
    "- standardize features for One-Class SVM;\n",
    "- derive a common anomaly-score convention;\n",
    "- compare detectors with the same normal-validation alert budget;\n",
    "- explain performance and scalability trade-offs."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "cell-003",
   "metadata": {},
   "outputs": [],
   "source": [
    "from pathlib import Path\n",
    "import numpy as np\n",
    "import pandas as pd\n",
    "import matplotlib.pyplot as plt\n",
    "\n",
    "TRAIN_PATH = Path(\"data/nsl_kdd_train.csv\")\n",
    "TEST_PATH = Path(\"data/nsl_kdd_test.csv\")\n",
    "\n",
    "missing_files = [str(path) for path in (TRAIN_PATH, TEST_PATH) if not path.exists()]\n",
    "if missing_files:\n",
    "    raise FileNotFoundError(\n",
    "        \"Missing prepared NSL-KDD files: \" + \", \".join(missing_files) +\n",
    "        \". Follow data/README.md and run: python data/prepare_dataset.py\"\n",
    "    )\n",
    "\n",
    "TARGET_COLUMNS = [\"attack_label\", \"attack_group\", \"binary_label\", \"difficulty\"]\n",
    "CATEGORICAL_FEATURES = [\"protocol_type\", \"service\", \"flag\"]\n",
    "\n",
    "\n",
    "from sklearn.ensemble import IsolationForest\n",
    "from sklearn.model_selection import train_test_split\n",
    "from sklearn.pipeline import Pipeline\n",
    "from sklearn.preprocessing import StandardScaler\n",
    "from sklearn.svm import OneClassSVM\n",
    "\n",
    "\n",
    "from sklearn.metrics import (\n",
    "    accuracy_score, average_precision_score, confusion_matrix,\n",
    "    f1_score, precision_score, recall_score,\n",
    ")\n",
    "\n",
    "\n",
    "def security_metrics(y_true, y_pred):\n",
    "    tn, fp, fn, tp = confusion_matrix(y_true, y_pred, labels=[0, 1]).ravel()\n",
    "    return {\n",
    "        \"accuracy\": accuracy_score(y_true, y_pred),\n",
    "        \"attack_precision\": precision_score(y_true, y_pred, zero_division=0),\n",
    "        \"attack_recall\": recall_score(y_true, y_pred, zero_division=0),\n",
    "        \"attack_f1\": f1_score(y_true, y_pred, zero_division=0),\n",
    "        \"false_positives\": int(fp),\n",
    "        \"false_negatives\": int(fn),\n",
    "        \"false_positive_rate\": fp / (fp + tn) if fp + tn else 0.0,\n",
    "        \"alerts_per_10000\": 10000 * (fp + tp) / len(y_true),\n",
    "    }"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "cell-004",
   "metadata": {},
   "outputs": [],
   "source": [
    "# TODO 1: load data, define anomaly_features, split normal training rows,\n",
    "# and cap the normal fit sample at 5,000 records.\n",
    "train_df = None\n",
    "test_df = None\n",
    "anomaly_features = None\n",
    "normal_fit = None\n",
    "normal_valid = None\n",
    "X_test = None\n",
    "y_test = None"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "cell-005",
   "metadata": {},
   "source": [
    "## 1. Fit the two detectors"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "cell-006",
   "metadata": {},
   "outputs": [],
   "source": [
    "# TODO 2: build StandardScaler pipelines for OneClassSVM and IsolationForest.\n",
    "detectors = None\n",
    "\n",
    "# TODO 3: fit both detectors on normal_fit only.\n",
    "print(\"Fitted detectors:\", None)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "cell-007",
   "metadata": {},
   "source": [
    "## 2. Apply a common validation-threshold policy"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "cell-008",
   "metadata": {},
   "outputs": [],
   "source": [
    "# TODO 4: for each detector, negate decision_function so larger means\n",
    "# more anomalous, choose the 99th normal-validation percentile, and evaluate.\n",
    "detector_outputs = None\n",
    "detector_comparison = None\n",
    "display(detector_comparison)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "cell-009",
   "metadata": {},
   "source": [
    "## 3. Compare attack-group recall"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "cell-010",
   "metadata": {},
   "outputs": [],
   "source": [
    "# TODO 5: calculate recall separately for DoS, Probe, R2L, and U2R.\n",
    "group_recall = None\n",
    "display(group_recall)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "cell-011",
   "metadata": {},
   "source": [
    "## Self-check"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "cell-012",
   "metadata": {},
   "outputs": [],
   "source": [
    "assert set(detectors) == {\"One-Class SVM\", \"Isolation Forest\"}\n",
    "assert len(normal_fit) <= 5000\n",
    "assert all(len(output[\"test_scores\"]) == len(test_df) for output in detector_outputs.values())\n",
    "assert detector_comparison.shape[0] == 2\n",
    "assert set(group_recall.index) == {\"DoS\", \"Probe\", \"R2L\", \"U2R\"}\n",
    "assert detector_comparison[\"false_positive_rate\"].between(0, 1).all()\n",
    "print(\"✓ Lab 4 completed\")"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "cell-013",
   "metadata": {},
   "source": [
    "## Reflection questions\n",
    "\n",
    "1. Why is One-Class SVM trained on a capped sample?\n",
    "2. Why convert both model outputs to a common anomaly-score direction?\n",
    "3. Why should per-group recall accompany aggregate attack recall?"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.11.6"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}