Network Analysis.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "ef8b59ab-4296-4aea-a86a-b925ddf1c5a2",
   "metadata": {},
   "outputs": [],
   "source": [
    "import pandas as pd\n",
    "import matplotlib.pyplot as plt\n",
    "import networkx as nx\n",
    "import geoip2.database"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "e6af586b-caac-45c1-83c1-1edf58339cdf",
   "metadata": {},
   "outputs": [],
   "source": [
    "CapURL=\"\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "a17a3aa0-9929-42c4-82b9-1ee734b11201",
   "metadata": {},
   "outputs": [],
   "source": [
    "CapData=pd.read_csv(CapURL)\n",
    "CapData.head(10)\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "015511d3-c877-4ae6-adb1-6ba019b0a5c7",
   "metadata": {},
   "outputs": [],
   "source": [
    "#Taking a look at “sources” reveals which devices had the least/most number of communications\n",
    "\n",
    "sources=CapData.groupby(\"Source\").Source.count()\n",
    "sources.sort_values()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d7b45bd0-872b-4902-baf6-608870f01814",
   "metadata": {},
   "outputs": [],
   "source": [
    "\n",
    "dest=CapData.groupby(\"Destination\").Destination.count()\n",
    "dest.sort_values()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "0986191d-6dfe-45df-98c3-c28aca8b7d9c",
   "metadata": {},
   "outputs": [],
   "source": [
    "#If you investigate “protocols”, you’ll see a few HTTP types of communications. \n",
    "#As a security professional, you know that means information communicated is not encrypted. \n",
    "#Meaning, anyone can read it, so hopefully, there was nothing confidential!\n",
    "\n",
    "protocol=CapData.groupby(\"Protocol\").Protocol.count()\n",
    "protocol.sort_values()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e62e32b2-9387-4a95-9ebe-5ebb02678545",
   "metadata": {},
   "source": [
    "</n><b>** build node graphs that represent a type of communication **</b>"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "7024e252-475f-4677-a8c7-617af8bfc610",
   "metadata": {},
   "outputs": [],
   "source": [
    "network = nx.from_pandas_edgelist(CapData, source=\"Source\", target=\"Destination\", edge_attr=True)\n",
    "network.nodes()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "0dd6f87c-9397-4103-a8c1-742ab3a885db",
   "metadata": {},
   "outputs": [],
   "source": [
    "network.edges()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d80271c2-b8b4-4100-ba66-79d2cf806dc7",
   "metadata": {},
   "outputs": [],
   "source": [
    "#display a network map based on the traffic\n",
    "nx.draw_circular(network, with_labels=True)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "f23fb6f9-b39a-44d0-9a5e-34b431324582",
   "metadata": {},
   "outputs": [],
   "source": [
    "#create a color-coded map showing us which devices the malicious device communicated with.\n",
    "\n",
    "suspect = \"192.168.0.0.\"\n",
    "pos=nx.spring_layout(network)\n",
    "nx.draw(network, pos, node_color=\"green\", node_size=300, with_labels=True)\n",
    "\n",
    "options = {\"node_size\":1000, \"node_color\":\"r\"}\n",
    "nx.draw_networkx_nodes(network, pos, nodelist=[suspect],**options)\n",
    "plt.show()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b0e5a392-ac17-4f25-a20c-04f02a232640",
   "metadata": {},
   "outputs": [],
   "source": [
    "#Seeing captured information of suspect flag address\n",
    "\n",
    "CapData.loc[CapData[\"Source\"]==\"192.168.1.5\"]"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "db7d104f-7579-48bb-a06a-2f5e44410731",
   "metadata": {},
   "source": [
    "<h4>GeoIP2 and finding location</h4>"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b7fe78a5-3eb9-4429-9248-b3abeab8efc9",
   "metadata": {},
   "outputs": [],
   "source": [
    "#IF ADDRESS NOT FOUND ERROR --> they are reserved IPs \n",
    "\n",
    "reader = geoip2.database.Reader(\"C:\\\\Users\\\\Aadith Sukumar\\\\Desktop\\\\CyberSec Project\\\\Network Analyzer\\\\GeoLite2-Country.mmdb\")\n",
    "response = reader.country(\"192.101.101.101\")\n",
    "response.country.name"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "3aa7afcc",
   "metadata": {},
   "outputs": [],
   "source": [
    "reader = geoip2.database.Reader(\"C:\\\\Users\\\\Aadith Sukumar\\\\Desktop\\\\CyberSec Project\\\\Network Analyzer\\\\GeoLite2-Country.mmdb\")\n",
    "geoloc_input=input(\"Enter Public IP Address to locate: \")\n",
    "try:\n",
    "    response = reader.country(geoloc_input)\n",
    "    print(response.country.name)\n",
    "except geoip2.errors.AddressNotFoundError:\n",
    "    print(\"Address not in database\")\n",
    "except ValueError:\n",
    "    print(\"Invalid Input\")\n",
    "\n"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3.9.10 64-bit (windows store)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.10"
  },
  "vscode": {
   "interpreter": {
    "hash": "6c097b70c618557334e2b30d74a3fe2fca5e88c2b6a328bb82b1391b5769e469"
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}