Web application Firewall .ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "8a905ce4",
   "metadata": {},
   "outputs": [],
   "source": [
    "import pandas as pd\n",
    "from sklearn.model_selection import train_test_split\n",
    "from sklearn.linear_model import LogisticRegression\n",
    "from sklearn.metrics import classification_report, accuracy_score\n",
    "import urllib.parse\n",
    "import numpy as np\n",
    "import pickle\n",
    "\n",
    "# List of bad words to check in the URL path\n",
    "badwords = ['sleep', 'uid', 'select', 'waitfor', 'delay', 'system', 'union', 'order by', 'group by', 'admin', 'drop', 'script']\n",
    "\n",
    "# Function to extract features from the URL path and body\n",
    "def ExtractFeatures(path, body):\n",
    "    path = str(path)\n",
    "    body = str(body)\n",
    "    combined_raw = path + body\n",
    "    raw_percentages = combined_raw.count(\"%\")\n",
    "    raw_spaces = combined_raw.count(\" \")\n",
    "\n",
    "    # Check if both counts exceed the threshold\n",
    "    raw_percentages_count = raw_percentages if raw_percentages > 3 else 0\n",
    "    raw_spaces_count = raw_spaces if raw_spaces > 3 else 0\n",
    "\n",
    "    # Decode the path and body for other feature extractions\n",
    "    path_decoded = urllib.parse.unquote_plus(path)\n",
    "    body_decoded = urllib.parse.unquote_plus(body)\n",
    "\n",
    "    single_q = path_decoded.count(\"'\") + body_decoded.count(\"'\")\n",
    "    double_q = path_decoded.count(\"\\\"\") + body_decoded.count(\"\\\"\")\n",
    "    dashes = path_decoded.count(\"--\") + body_decoded.count(\"--\")\n",
    "    braces = path_decoded.count(\"(\") + body_decoded.count(\"(\")\n",
    "    spaces = path_decoded.count(\" \") + body_decoded.count(\" \")\n",
    "    semicolons = path_decoded.count(\";\") + body_decoded.count(\";\")\n",
    "    angle_brackets = path_decoded.count(\"<\") + path_decoded.count(\">\") + body_decoded.count(\"<\") + body_decoded.count(\">\")\n",
    "    special_chars = sum(path_decoded.count(c) + body_decoded.count(c) for c in '$&|')\n",
    "\n",
    "    badwords_count = sum(path_decoded.lower().count(word) + body_decoded.lower().count(word) for word in badwords)\n",
    "\n",
    "    path_length = len(path_decoded)\n",
    "    body_length = len(body_decoded)\n",
    "\n",
    "    return [single_q, double_q, dashes, braces, spaces, raw_percentages_count, semicolons, angle_brackets, special_chars, path_length, body_length, badwords_count]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "1c5dfedb",
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "method              0\n",
      "path                0\n",
      "body              422\n",
      "single_q            0\n",
      "double_q            0\n",
      "dashes              0\n",
      "braces              0\n",
      "spaces              0\n",
      "percentages         0\n",
      "semicolons          0\n",
      "angle_brackets      0\n",
      "special_chars       0\n",
      "path_length         0\n",
      "body_length         0\n",
      "badwords_count      0\n",
      "class               0\n",
      "dtype: int64\n",
      "Accuracy: 0.97\n",
      "Classification Report:\n",
      "              precision    recall  f1-score   support\n",
      "\n",
      "           0       0.95      1.00      0.97        57\n",
      "           1       1.00      0.93      0.96        43\n",
      "\n",
      "    accuracy                           0.97       100\n",
      "   macro avg       0.97      0.97      0.97       100\n",
      "weighted avg       0.97      0.97      0.97       100\n",
      "\n"
     ]
    }
   ],
   "source": [
    "import pandas as pd\n",
    "import numpy as np\n",
    "from sklearn.model_selection import train_test_split\n",
    "from sklearn.linear_model import LogisticRegression\n",
    "from sklearn.metrics import accuracy_score, classification_report\n",
    "import urllib.parse\n",
    "import pickle\n",
    "\n",
    "# Load dataset\n",
    "http = pd.read_csv(r'C:\\Users\\PRATHAM\\Documents\\python project\\All_data.csv')\n",
    "missing_values = http.isna().sum()\n",
    "print(missing_values)\n",
    "\n",
    "# Check if the necessary columns exist\n",
    "required_columns = ['path', 'body', 'class']\n",
    "missing_columns = [col for col in required_columns if col not in http.columns]\n",
    "\n",
    "if missing_columns:\n",
    "    raise ValueError(f\"Error: The dataset is missing the following columns: {', '.join(missing_columns)}\")\n",
    "\n",
    "# Handle missing values (fill with mean for numeric columns as an example)\n",
    "# Note: Fill numeric columns only, if necessary\n",
    "#http.fillna(http.mean(), inplace=True)\n",
    "\n",
    "# Dummy badwords list for the example; replace it with actual bad words list\n",
    "badwords = ['badword1', 'badword2']\n",
    "\n",
    "\n",
    "# Extract features from the 'path' and 'body' columns\n",
    "http['features'] = http.apply(lambda row: ExtractFeatures(row['path'], row['body']), axis=1)\n",
    "\n",
    "# Prepare the feature matrix and the labels\n",
    "X = np.array(http['features'].tolist())\n",
    "y = http['class'].values\n",
    "\n",
    "# Split the data into training and testing sets\n",
    "X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2, random_state=42)\n",
    "\n",
    "# Train a logistic regression model\n",
    "model = LogisticRegression(random_state=42)\n",
    "model.fit(X_train, y_train)\n",
    "\n",
    "filename = 'training_model.pkl'\n",
    "pickle.dump(model, open(filename, 'wb'))\n",
    "\n",
    "# Predict on the test set\n",
    "y_pred = model.predict(X_test)\n",
    "\n",
    "# Evaluate the model\n",
    "print(\"Accuracy:\", accuracy_score(y_test, y_pred))\n",
    "print(\"Classification Report:\")\n",
    "print(classification_report(y_test, y_pred))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "962b2c03-d63e-4e34-ad9f-16fc82b40610",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Listening on http://127.0.0.1:8080\n",
      "['http:', '', 'detectportal.firefox.com', 'canonical.html']\n",
      "0\n",
      "['http:', '', 'detectportal.firefox.com', 'canonical.html']\n",
      "0\n",
      "['http:', '', 'detectportal.firefox.com', 'canonical.html']\n",
      "0\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "127.0.0.1 - - [27/May/2024 11:51:00] code 501, message Unsupported method ('CONNECT')\n",
      "127.0.0.1 - - [27/May/2024 11:51:00] \"CONNECT sb-ssl.google.com:443 HTTP/1.1\" 501 -\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "['http:', '', 'detectportal.firefox.com', 'canonical.html']\n",
      "0\n",
      "['http:', '', 'detectportal.firefox.com', 'canonical.html']\n",
      "0\n",
      "['http:', '', 'demo.testfire.net', 'search.jsp?query=1234+%27+AND+1%3D0+UNION+ALL+SELECT+%27admin%27%2C+%2781dc9bdb52d04dc20036dbd8313ed055']\n",
      "1\n",
      "Intrusion Detected\n",
      "['http:', '', 'detectportal.firefox.com', 'canonical.html']\n",
      "0\n",
      "['http:', '', 'detectportal.firefox.com', 'canonical.html']\n",
      "0\n",
      "['http:', '', 'detectportal.firefox.com', 'canonical.html']\n",
      "0\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "127.0.0.1 - - [27/May/2024 11:51:16] code 501, message Unsupported method ('CONNECT')\n",
      "127.0.0.1 - - [27/May/2024 11:51:16] \"CONNECT services.addons.mozilla.org:443 HTTP/1.1\" 501 -\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "['http:', '', 'detectportal.firefox.com', 'canonical.html']\n",
      "0\n",
      "['http:', '', 'detectportal.firefox.com', 'canonical.html']\n",
      "0\n",
      "['http:', '', 'detectportal.firefox.com', 'canonical.html']\n",
      "0\n",
      "['http:', '', 'detectportal.firefox.com', 'canonical.html']\n",
      "0\n",
      "\n",
      "Keyboard interrupt received, exiting.\n"
     ]
    }
   ],
   "source": [
    "from http.server import SimpleHTTPRequestHandler, HTTPServer\n",
    "from urllib import request, error, parse\n",
    "import numpy as np\n",
    "import pandas as pd\n",
    "import pickle\n",
    "from sklearn.linear_model import LogisticRegression\n",
    "from sklearn.model_selection import train_test_split\n",
    "from sklearn.metrics import accuracy_score, classification_report\n",
    "\n",
    "badwords = ['sleep', 'uid', 'select', 'waitfor', 'delay', 'system', 'union', 'order by', 'group by', 'admin', 'drop', 'script']\n",
    "# Define the ExtractFeatures function outside the class\n",
    "def ExtractFeatures(path, body):\n",
    "    path = str(path)\n",
    "    body = str(body)\n",
    "    combined_raw = path + body\n",
    "    raw_percentages = combined_raw.count(\"%\")\n",
    "    raw_spaces = combined_raw.count(\" \")\n",
    "\n",
    "    # Check if both counts exceed the threshold\n",
    "    raw_percentages_count = raw_percentages if raw_percentages > 3 else 0\n",
    "    raw_spaces_count = raw_spaces if raw_spaces > 3 else 0\n",
    "\n",
    "    # Decode the path and body for other feature extractions\n",
    "    path_decoded = urllib.parse.unquote_plus(path)\n",
    "    body_decoded = urllib.parse.unquote_plus(body)\n",
    "\n",
    "    single_q = path_decoded.count(\"'\") + body_decoded.count(\"'\")\n",
    "    double_q = path_decoded.count(\"\\\"\") + body_decoded.count(\"\\\"\")\n",
    "    dashes = path_decoded.count(\"--\") + body_decoded.count(\"--\")\n",
    "    braces = path_decoded.count(\"(\") + body_decoded.count(\"(\")\n",
    "    spaces = path_decoded.count(\" \") + body_decoded.count(\" \")\n",
    "    semicolons = path_decoded.count(\";\") + body_decoded.count(\";\")\n",
    "    angle_brackets = path_decoded.count(\"<\") + path_decoded.count(\">\") + body_decoded.count(\"<\") + body_decoded.count(\">\")\n",
    "    special_chars = sum(path_decoded.count(c) + body_decoded.count(c) for c in '$&|')\n",
    "\n",
    "    badwords_count = sum(path_decoded.lower().count(word) + body_decoded.lower().count(word) for word in badwords)\n",
    "\n",
    "    path_length = len(path_decoded)\n",
    "    body_length = len(body_decoded)\n",
    "\n",
    "    return [single_q, double_q, dashes, braces, spaces, raw_percentages_count, semicolons, angle_brackets, special_chars, path_length, body_length, badwords_count]\n",
    "\n",
    "# Define the SimpleHTTPProxy class\n",
    "class SimpleHTTPProxy(SimpleHTTPRequestHandler):\n",
    "    proxy_routes = {}\n",
    "\n",
    "    @classmethod\n",
    "    def set_routes(cls, proxy_routes):\n",
    "        cls.proxy_routes = proxy_routes\n",
    "\n",
    "    def do_GET(self):\n",
    "        parts = self.path.split('/')\n",
    "        print(parts)\n",
    "        if len(parts) > 3:\n",
    "            path_part = parts[3]\n",
    "            body = \"\"  # GET requests typically do not have a body\n",
    "            live_data = ExtractFeatures(path_part, body)\n",
    "            live_data = np.array(live_data).reshape(1, -1)  # Reshape for single prediction\n",
    "            \n",
    "            # Load the model inside the request handler\n",
    "            with open('training_model.pkl', 'rb') as file:\n",
    "                model = pickle.load(file)\n",
    "\n",
    "            result = model.predict(live_data)  # Use the trained model for prediction\n",
    "            print(result[0])\n",
    "            if result[0] == 1:\n",
    "                print('Intrusion Detected')\n",
    "        \n",
    "        if len(parts) >= 2:\n",
    "            self.proxy_request('http://' + parts[2] + '/')\n",
    "        else:\n",
    "            super().do_GET()\n",
    "\n",
    "    def proxy_request(self, url):\n",
    "        try:\n",
    "            response = request.urlopen(url)\n",
    "        except error.HTTPError as e:\n",
    "            print('err')\n",
    "            self.send_response_only(e.code)\n",
    "            self.end_headers()\n",
    "            return\n",
    "        self.send_response_only(response.status)\n",
    "        for name, value in response.headers.items():\n",
    "            self.send_header(name, value)\n",
    "        self.end_headers()\n",
    "        self.copyfile(response, self.wfile)\n",
    "\n",
    "# Set up and start the server\n",
    "SimpleHTTPProxy.set_routes({'proxy_route': 'http://demo.testfire.net/'})\n",
    "with HTTPServer(('127.0.0.1', 8080), SimpleHTTPProxy) as httpd:  # Correct reference to HTTPServer\n",
    "    host, port = httpd.socket.getsockname()\n",
    "    print(f'Listening on http://{host}:{port}')\n",
    "    try:\n",
    "        httpd.serve_forever()  # Corrected from serveforever to serve_forever\n",
    "    except KeyboardInterrupt:  # Corrected from keyboardInterrupt to KeyboardInterrupt\n",
    "        print(\"\\nKeyboard interrupt received, exiting.\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "d07922af",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Predictions saved to testing_datas_with_predictions.csv\n"
     ]
    }
   ],
   "source": [
    "testing_data = pd.read_csv(r'P:\\WAF\\Testing_data.csv')\n",
    "if 'path' in testing_data.columns and 'body' in testing_data.columns:\n",
    "        # Extract features from the testing data paths and bodies\n",
    "    test_features = testing_data.apply(lambda row: ExtractFeatures(row['path'], row['body']), axis=1).tolist()\n",
    "\n",
    "        # Convert test_features to a 2D numpy array\n",
    "    test_features = np.array(test_features)\n",
    "\n",
    "        # Predict whether each data point is good or bad\n",
    "    predictions = model.predict(test_features)\n",
    "\n",
    "        # Add the predictions to the testing data DataFrame\n",
    "    testing_data['Prediction'] = predictions\n",
    "\n",
    "        # Save the testing data with predictions to a new CSV file\n",
    "    testing_data.to_csv(r'P:\\WAF\\Testing_result.csv', index=False)\n",
    "    print(\"Predictions saved to testing_datas_with_predictions.csv\")\n",
    "else:\n",
    "    print(\"Error: The testing data must contain 'path' and 'body' columns.\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "dacaa8a5-889f-4f34-b414-a03ce5750498",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.11.9"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}