高级python脚本:带有实时可视化的ai驱动网络异常检测器
此脚本组合:使用scapy的实时网络流量分析。
使用scikit-learn。
基于机器学习的异常检测。 使用matplotlib和plotly。使用大熊猫和电子邮件库的自动报告。
import time
import pandas as pd
import numpy as np
from scapy.all import sniff, IP, TCP
from sklearn.ensemble import IsolationForest
import matplotlib.pyplot as plt
import plotly.express as px
import smtplib
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart
from threading import Thread
# Global variables
network_data = []
anomalies = []
model = IsolationForest(contamination=0.01) # Anomaly detection model
# Email configuration
EMAIL_HOST = 'smtp.gmail.com'
EMAIL_PORT = 587
EMAIL_USER = 'your_email@gmail.com'
EMAIL_PASSWORD = 'your_password'
ALERT_EMAIL = 'recipient_email@example.com'
def capture_traffic(packet):
"""
Capture network traffic and extract features.
"""
if IP in packet:
src_ip = packet[IP].src
dst_ip = packet[IP].dst
protocol = packet[IP].proto
length = len(packet)
timestamp = time.time()
# Append to network data
network_data.append([timestamp, src_ip, dst_ip, protocol, length])
def detect_anomalies():
"""
Detect anomalies in network traffic using Isolation Forest.
"""
global network_data, anomalies
while True:
if len(network_data) > 100: # Wait for enough data
df = pd.DataFrame(network_data, columns=['timestamp', 'src_ip', 'dst_ip', 'protocol', 'length'])
X = df[['protocol', 'length']].values
# Train the model and predict anomalies
model.fit(X)
preds = model.predict(X)
df['anomaly'] = preds
# Extract anomalies
anomalies = df[df['anomaly'] == -1]
if not anomalies.empty:
print("Anomalies detected:")
print(anomalies)
send_alert_email(anomalies)
visualize_anomalies(anomalies)
# Clear old data
network_data = network_data[-100:] # Keep last 100 entries
time.sleep(10) # Check for anomalies every 10 seconds
def visualize_anomalies(anomalies):
"""
Visualize anomalies using Plotly.
"""
fig = px.scatter(anomalies, x='timestamp', y='length', color='protocol',
title='Network Anomalies Detected')
fig.show()
def send_alert_email(anomalies):
"""
Send an email alert with detected anomalies.
"""
msg = MIMEMultipart()
msg['From'] = EMAIL_USER
msg['To'] = ALERT_EMAIL
msg['Subject'] = 'Network Anomaly Alert'
body = "The following network anomalies were detected:\n\n"
body += anomalies.to_string()
msg.attach(MIMEText(body, 'plain'))
try:
server = smtplib.SMTP(EMAIL_HOST, EMAIL_PORT)
server.starttls()
server.login(EMAIL_USER, EMAIL_PASSWORD)
server.sendmail(EMAIL_USER, ALERT_EMAIL, msg.as_string())
server.quit()
print("Alert email sent.")
except Exception as e:
print(f"Failed to send email: {e}")
def start_capture():
"""
Start capturing network traffic.
"""
print("Starting network traffic capture...")
sniff(prn=capture_traffic, store=False)
if __name__ == "__main__":
# Start traffic capture in a separate thread
capture_thread = Thread(target=start_capture)
capture_thread.daemon = True
capture_thread.start()
# Start anomaly detection
detect_anomalies()
它的工作原理
网络流量捕获:
>脚本使用scapy捕获实时网络流量并提取源ip,目标ip,协议和数据包长度等功能。
>它使用scikit-learn的隔离森林算法来检测网络流量中的异常模式。
实时可视化:
使用plotly实时可视化检测到的异常。>
电子邮件警报:如果检测到异常,则脚本将发送带有详细信息的电子邮件警报。
多线程:
易语言是一款全中文全可视跨平台的编程工具,由大连大有吴涛易语言软件开发有限公司设计开发的,它的特点是全中文化,入门要求低,几乎只要懂得使用计算机和文字输入的人都可以进行程序设计,而且它的开发语言也是全中文的、生活化,这在今后的学习中我们会深刻体会到它的“易”。让我们一起进入“易”的世界吧!本平台提供易语言编程初级版下载,需要的朋友可以下载看看!
0
流量捕获和异常检测在单独的线程中运行以提高效率。
以上就是我要求DeepSeek编码我的python,这是没有人制作的的详细内容,更多请关注php中文网其它相关文章!
Copyright 2014-2025 https://www.php.cn/ All Rights Reserved | php.cn | 湘ICP备2023035733号