機械学習を利用して、サーバへの不正侵入を検知する

import matplotlib.pyplot as plt
import numpy as np
from sklearn.neighbors import LocalOutlierFactor

# テストデータの生成
np.random.seed(42)
# 正常なデータポイントを2次元の正規分布から生成
X_inliers = 0.3 * np.random.randn(100, 2)
X_inliers = np.r_[X_inliers + 2, X_inliers - 2]

# 異常なデータポイントを生成
X_outliers = np.random.uniform(low=-4, high=4, size=(20, 2))

# データセットの結合
X = np.r_[X_inliers, X_outliers]

# LOFによる異常検出
clf = LocalOutlierFactor(n_neighbors=20, contamination=0.1)
y_pred = clf.fit_predict(X)
# 異常度のスコア（negative_outlier_factor）は負の値が大きいほど異常
outlier_scores = clf.negative_outlier_factor_

# グラフの描画
plt.title("LOF (Local Outlier Factor)")
plt.scatter(X[:, 0], X[:, 1], color="b", label="Inliers")

# 異常値のみ赤で表示
radius = (outlier_scores.max() - outlier_scores) / (
    outlier_scores.max() - outlier_scores.min()
)
outliers = y_pred == -1
plt.scatter(
    X[outliers, 0],
    X[outliers, 1],
    s=1000 * radius[outliers],
    edgecolors="r",
    facecolors="none",
    label="Outliers",
)
plt.legend()
plt.xlabel("Feature 1")
plt.ylabel("Feature 2")
plt.show()

import pandas as pd
from mimizuku import Mimizuku

# Initialize the model with custom settings
model = Mimizuku(contamination=0.001, n_neighbors=5)

# Train the model using a Wazuh alert log file or DataFrame
model.fit("./training.json")

# Save the trained model for later use
model.save_model("./models")

import pandas as pd
from mimizuku import Mimizuku

# Load a saved model, ignoring specific users
loaded_model = Mimizuku.load_model("./models", ignore_users=["root"])

# Use the loaded model to detect anomalies in a new Wazuh alert log file
anomalies_df = loaded_model.predict("./test.json")

# Display the detected anomalies
print("Detected anomalies:")
print(anomalies_df)