FlowPrint¶

The FlowPrint object that is used to generate Fingerprint’s. Note that this is mainly a wrapper method, the actual Fingerprint generation is done in the FingerprintGenerator.

class flowprint.FlowPrint(batch=300, window=30, correlation=0.1, similarity=0.9, threshold=0.1)[source]¶

FlowPrint object creates fingerprints from mobile network traffic.

batch¶

Threshold for the batch size in seconds.

Type:	float

window¶

Threshold for the window size in seconds.

Type:	float

correlation¶

Threshold for the minimum required correlation.

Type:	float

similarity¶

Threshold for the minimum required similarity.

Type:	float

threshold¶

Threshold for anomaly detection.

Type:	float

fingerprinter¶

FingerprintGenerator used for generating fingerprints.

Type:	fingerprints.FingerprintGenerator

fingerprints¶

Dictionary of Fingerprint -> label, containing all fingerprints generated by FlowPrint.

Type:	dict

FlowPrint.__init__(batch=300, window=30, correlation=0.1, similarity=0.9, threshold=0.1)[source]¶

FlowPrint object creates fingerprints from mobile network traffic.

Parameters:

batch (float, default=300) – Threshold for the batch size in seconds.
window (float, default=30) – Threshold for the window size in seconds.
correlation (float, default=0.1) – Threshold for the minimum required correlation.
similarity (float, default=0.9) – Threshold for the minimum required similarity.
threshold (float, default=0.1) – Threshold for anomaly detection.

Fitting and Predicting¶

We train FlowPrint using the fit() method and can predict using the predict() method.

FlowPrint.fit(X, y=None)[source]¶

Fit FlowPrint object with fingerprints from given flows.

Parameters:	X (Array-like of shape=(n_samples,)) – Flows for fitting FlowPrint. y (Array-like of shape=(n_samples,), optional) – If given, attach labels to fingerprints from X.
Returns:	self – Returns FlowPrint object.
Return type:	self

FlowPrint.predict(X, y=None, default='common')[source]¶

Find closest fingerprint to trained fingerprints.

Parameters:	X (Array-like of Fingerprint of shape=(n_fingerprints,)) – Fingerprints to compare against training set. y (Ignored) – default ("common"\|"largest"\|"other", default="common") – Default to this strategy if no match is found ”common” : return the fingerprint with most flows ”largest”: return the largest fingerprint other : return <other> as match, e.g. Fingerprint()/None
Returns:	result – Closest matching fingerprints to original. If no match is found, fall back on default.
Return type:	np.array of shape=(n_fingerprints,)

FlowPrint.fit_predict(X, y=None, default='common')[source]¶

Fit FlowPrint with samples and labels and return the predictions of the same samples after running them through FlowPrint.

Parameters:	X (Array-like of shape=(n_samples,)) – Flows for fitting FlowPrint. y (Array-like of shape=(n_samples,), optional) – If given, attach labels to fingerprints from X. default ("common"\|"largest"\|"other", default="common") – Default to this strategy if no match is found ”common” : return the fingerprint with most flows ”largest”: return the largest fingerprint other : return <other> as match, e.g. Fingerprint()/None
Returns:	result – Closest matching fingerprints to original. If no match is found, fall back on default.
Return type:	np.array of shape=(n_fingerprints,)

Generating fingerprints¶

As opposed to the fit() and predict() methods, recognize() and detect() require Fingerprint objects as input instead of Flow objects. Therefore, we provide a simple method to transform Flow objects to their corresponding Fingerprint.

FlowPrint.fingerprint(X, y=None)[source]¶

Create fingerprints from given flows.

Parameters:	X (Array-like of Flows of shape=(n_flows,)) – Flows for which to create fingerprints.
Returns:	fingerprints – Fingerprints generated by X.
Return type:	np.array of shape=(n_fingerprints,)

App Recognition¶

Once FlowPrint is trained using the fit(), you can use FlowPrint to label unknown Flows with known apps.

FlowPrint.recognize(X, y=None, default='common')[source]¶

Return labels corresponding to closest matching fingerprints.

Parameters:	X (Array-like of Fingerprint of shape=(n_fingerprints,)) – Fingerprints to compare against training set. y (Ignored) – default ("common"\|"largest"\|"other", default="common") – Default to this strategy if no match is found ”common” : return the fingerprint with most flows ”largest”: return the largest fingerprint other : return <other> as match, e.g. Fingerprint()/None
Returns:	result – Label of closest matching fingerprints to original
Return type:	np.array of shape=(n_fingerprints,)

Unseen app detection¶

Once FlowPrint is trained using the fit(), you can use FlowPrint to detect if unknown Flows are in the set of known (trained) apps or if they are a previously unseen app.

FlowPrint.detect(X, y=None, threshold=None)[source]¶

Predict whether fingerprints of X are anomalous or not.

Parameters:	X (Array-like of Fingerprint of shape=(n_fingerprints,)) – Fingerprints to compare against training set. y (Ignored) – threshold (float, default=None) – Minimum required threshold to consider point benign. If None is given, use FlowPrint default
Returns:	result – Prediction of samples in X: +1 if benign, -1 if anomalous.
Return type:	np.array of shape=(n_samples,)

I/O methods¶

FlowPrint provides methods to save and load a FlowPrint object, including its fingerprints to a json file.

FlowPrint.save(file, fingerprints=None)[source]¶

Save fingerprints to file.

Parameters:	file (string) – File in which to save flowprint fingerprints. fingerprints (iterable of Fingerprint (optional)) – If None export fingerprints from fitted FlowPrint object, otherwise, export given fingerprints.

FlowPrint.load(*files, store=True, parameters=False)[source]¶

Load fingerprints from files.

Parameters:	file (string) – Files from which to load fingerprints. store (boolean, default=True) – If True, store fingerprints in FlowPrint object parameters (boolean, default=False) – If True, also update FlowPrint parameters from file
Returns:	result – Fingerprints imported from file.
Return type:	dict of Fingerprint -> label