Malware_Detection.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Malware Detection"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Import Required Packages"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 106,
   "metadata": {},
   "outputs": [],
   "source": [
    "import json\n",
    "import numpy as np\n",
    "import pandas as pd\n",
    "from sklearn.ensemble import AdaBoostClassifier, RandomForestClassifier, VotingClassifier\n",
    "from sklearn.svm import SVC\n",
    "from sklearn.tree import DecisionTreeClassifier\n",
    "from matplotlib import pyplot as plt"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Running the python script <i>'prepare_dataset.py'</i>, We have decompiled all the APKs available in dataset and get the as much as features that we can grab and are relevant to detect malware or phising Apps.\n",
    "\n",
    "\n",
    "In android app development, The main part of getting into in someone's privacy is allowing the dangerous permissions that application ask to the user. Such as permission like Contacts, Storage, Get Running Tasks etc. By using these permission various apk grabs the confedential data from the app and may missuse it or sell it.\n",
    "\n",
    "So We have full list of permissions available in android os so loading them and creating matrix for permission in a way that we can feed it into classifier."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 107,
   "metadata": {},
   "outputs": [],
   "source": [
    "ALL_PERMISSIONS = open('permissions.txt', 'r').readlines()\n",
    "ALL_OPECODES = []\n",
    "ALL_STRINGS = []\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 108,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Listing 1st 20 permissions\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "['android.permission.ACCESS_ALL_DOWNLOADS\\n',\n",
       " 'android.permission.ACCESS_BLUETOOTH_SHARE\\n',\n",
       " 'android.permission.ACCESS_CACHE_FILESYSTEM\\n',\n",
       " 'android.permission.ACCESS_CHECKIN_PROPERTIES\\n',\n",
       " 'android.permission.ACCESS_CONTENT_PROVIDERS_EXTERNALLY\\n',\n",
       " 'android.permission.ACCESS_DOWNLOAD_MANAGER\\n',\n",
       " 'android.permission.ACCESS_DOWNLOAD_MANAGER_ADVANCED\\n',\n",
       " 'android.permission.ACCESS_DRM_CERTIFICATES\\n',\n",
       " 'android.permission.ACCESS_EPHEMERAL_APPS\\n',\n",
       " 'android.permission.ACCESS_FM_RADIO\\n',\n",
       " 'android.permission.ACCESS_INPUT_FLINGER\\n',\n",
       " 'android.permission.ACCESS_KEYGUARD_SECURE_STORAGE\\n',\n",
       " 'android.permission.ACCESS_LOCATION_EXTRA_COMMANDS\\n',\n",
       " 'android.permission.ACCESS_MOCK_LOCATION\\n',\n",
       " 'android.permission.ACCESS_MTP\\n',\n",
       " 'android.permission.ACCESS_NETWORK_CONDITIONS\\n',\n",
       " 'android.permission.ACCESS_NETWORK_STATE\\n',\n",
       " 'android.permission.ACCESS_NOTIFICATIONS\\n',\n",
       " 'android.permission.ACCESS_NOTIFICATION_POLICY\\n',\n",
       " 'android.permission.ACCESS_PDB_STATE\\n']"
      ]
     },
     "execution_count": 108,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "print('Listing 1st 20 permissions')\n",
    "ALL_PERMISSIONS[0:20]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now loading <b>data.json</b> file which is generated through <b>prepare_dataset.py</b> that contains all the <b>static</b> and <b>dynamic</b> features such as OpCodes, Scan Info, VirusTotal Analysis, String, Api Calls, Permissions etc of all the android apps.\n",
    "\n",
    "This below line may take some time as it is loading the 38.6mb large json dataset of APKs.\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 109,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Printing the availlable features of 1st APK in data.json\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "[{'ALYac': False,\n",
       "  'API calls': {'android.app.Activity': 7,\n",
       "   'android.app.Activity.onDestroy': 2,\n",
       "   'android.app.IntentService': 3,\n",
       "   'android.app.IntentService.onDestroy': 1,\n",
       "   'android.app.IntentService.onStartCommand': 1,\n",
       "   'android.content.SharedPreferences': 2,\n",
       "   'java.lang.Boolean': 224,\n",
       "   'java.lang.Boolean.booleanValue': 13,\n",
       "   'java.lang.Character': 3,\n",
       "   'java.lang.Exception': 4,\n",
       "   'java.lang.Integer': 84,\n",
       "   'java.lang.Integer.intValue': 16,\n",
       "   'java.lang.Integer.valueOf': 67,\n",
       "   'java.lang.Long': 6,\n",
       "   'java.lang.Long.longValue': 5,\n",
       "   'java.lang.Object': 22,\n",
       "   'java.lang.Object.equals': 3,\n",
       "   'java.lang.Object.toString': 14,\n",
       "   'java.lang.String': 31,\n",
       "   'java.lang.String.charAt': 3,\n",
       "   'java.lang.String.contains': 2,\n",
       "   'java.lang.String.endsWith': 2,\n",
       "   'java.lang.String.equalsIgnoreCase': 6,\n",
       "   'java.lang.String.getBytes': 3,\n",
       "   'java.lang.String.indexOf': 1,\n",
       "   'java.lang.String.isEmpty': 1,\n",
       "   'java.lang.String.length': 4,\n",
       "   'java.lang.String.replace': 2,\n",
       "   'java.lang.String.startsWith': 1,\n",
       "   'java.lang.String.substring': 3,\n",
       "   'java.lang.String.toUpperCase': 1,\n",
       "   'java.lang.String.trim': 1,\n",
       "   'java.lang.reflect.Field': 7,\n",
       "   'java.lang.reflect.Field.getLong': 1,\n",
       "   'java.lang.reflect.Method': 576,\n",
       "   'java.util.concurrent.TimeUnit': 9},\n",
       "  'AVG': True,\n",
       "  'AVware': False,\n",
       "  'Ad-Aware': False,\n",
       "  'AegisLab': True,\n",
       "  'AhnLab-V3': True,\n",
       "  'Alibaba': True,\n",
       "  'Antiy-AVL': True,\n",
       "  'Arcabit': True,\n",
       "  'Avast': True,\n",
       "  'Avast-Mobile': True,\n",
       "  'Avira': True,\n",
       "  'Baidu': False,\n",
       "  'BitDefender': True,\n",
       "  'Bkav': False,\n",
       "  'CAT-QuickHeal': True,\n",
       "  'CMC': False,\n",
       "  'ClamAV': False,\n",
       "  'Comodo': True,\n",
       "  'Cyren': True,\n",
       "  'DrWeb': True,\n",
       "  'ESET-NOD32': True,\n",
       "  'Emsisoft': True,\n",
       "  'F-Prot': False,\n",
       "  'F-Secure': False,\n",
       "  'Fortinet': True,\n",
       "  'GData': True,\n",
       "  'Ikarus': True,\n",
       "  'Jiangmin': False,\n",
       "  'K7AntiVirus': False,\n",
       "  'K7GW': True,\n",
       "  'Kaspersky': True,\n",
       "  'Kingsoft': False,\n",
       "  'MAX': True,\n",
       "  'Malwarebytes': False,\n",
       "  'McAfee': True,\n",
       "  'McAfee-GW-Edition': False,\n",
       "  'MicroWorld-eScan': False,\n",
       "  'Microsoft': False,\n",
       "  'NANO-Antivirus': True,\n",
       "  'Opcodes': {'add-int/2addr': 5,\n",
       "   'add-int/lit8': 20,\n",
       "   'aget': 1,\n",
       "   'aget-byte': 13,\n",
       "   'aget-object': 29,\n",
       "   'and-int/lit16': 4,\n",
       "   'aput-byte': 7,\n",
       "   'aput-object': 948,\n",
       "   'array-length': 12,\n",
       "   'check-cast': 73,\n",
       "   'cmp-long': 8,\n",
       "   'const': 955,\n",
       "   'const-class': 23,\n",
       "   'const-string': 34,\n",
       "   'const-wide/16': 19,\n",
       "   'const-wide/32': 1,\n",
       "   'const/16': 75,\n",
       "   'const/4': 2056,\n",
       "   'const/high16': 6,\n",
       "   'fill-array-data': 1,\n",
       "   'fill-array-data-payload': 1,\n",
       "   'goto': 97,\n",
       "   'goto/16': 65,\n",
       "   'if-eq': 5,\n",
       "   'if-eqz': 77,\n",
       "   'if-ge': 19,\n",
       "   'if-gt': 4,\n",
       "   'if-gtz': 2,\n",
       "   'if-le': 2,\n",
       "   'if-lez': 8,\n",
       "   'if-lt': 12,\n",
       "   'if-ltz': 4,\n",
       "   'if-ne': 17,\n",
       "   'if-nez': 32,\n",
       "   'iget': 20,\n",
       "   'iget-boolean': 5,\n",
       "   'iget-object': 176,\n",
       "   'iget-wide': 12,\n",
       "   'int-to-byte': 2,\n",
       "   'int-to-char': 1,\n",
       "   'int-to-long': 1,\n",
       "   'invoke-direct': 75,\n",
       "   'invoke-direct/range': 3,\n",
       "   'invoke-interface': 33,\n",
       "   'invoke-static': 1394,\n",
       "   'invoke-static/range': 13,\n",
       "   'invoke-super': 12,\n",
       "   'invoke-virtual': 1028,\n",
       "   'iput': 11,\n",
       "   'iput-boolean': 7,\n",
       "   'iput-object': 63,\n",
       "   'iput-wide': 5,\n",
       "   'move': 35,\n",
       "   'move-exception': 111,\n",
       "   'move-object': 12,\n",
       "   'move-object/from16': 71,\n",
       "   'move-result': 76,\n",
       "   'move-result-object': 1912,\n",
       "   'move-result-wide': 7,\n",
       "   'move-wide': 10,\n",
       "   'move-wide/from16': 2,\n",
       "   'move/from16': 9,\n",
       "   'new-array': 924,\n",
       "   'new-instance': 21,\n",
       "   'nop': 2,\n",
       "   'or-int/lit16': 1,\n",
       "   'or-int/lit8': 3,\n",
       "   'packed-switch': 1,\n",
       "   'packed-switch-payload': 1,\n",
       "   'rem-int': 1,\n",
       "   'rem-int/lit8': 1,\n",
       "   'return': 9,\n",
       "   'return-object': 31,\n",
       "   'return-void': 84,\n",
       "   'return-wide': 1,\n",
       "   'sget': 18,\n",
       "   'sget-boolean': 5,\n",
       "   'sget-object': 338,\n",
       "   'sget-wide': 3,\n",
       "   'sput': 14,\n",
       "   'sput-boolean': 17,\n",
       "   'sput-object': 22,\n",
       "   'sput-wide': 7,\n",
       "   'sub-int': 2,\n",
       "   'sub-long/2addr': 6,\n",
       "   'throw': 9,\n",
       "   'xor-int/2addr': 1},\n",
       "  'Package name': 'denp.zsexnmjp.jlpuazhsotnr',\n",
       "  'Panda': False,\n",
       "  'Permissions': ['android.permission.CHANGE_NETWORK_STATE',\n",
       "   'android.permission.SEND_SMS',\n",
       "   'android.permission.RECEIVE_BOOT_COMPLETED',\n",
       "   'android.permission.READ_PHONE_STATE',\n",
       "   'com.android.alarm.permission.SET_ALARM',\n",
       "   'android.permission.SYSTEM_ALERT_WINDOW',\n",
       "   'android.permission.ACCESS_WIFI_STATE',\n",
       "   'android.permission.WRITE_SMS',\n",
       "   'android.permission.ACCESS_NETWORK_STATE',\n",
       "   'android.permission.WAKE_LOCK',\n",
       "   'android.permission.GET_TASKS',\n",
       "   'android.permission.CHANGE_WIFI_STATE',\n",
       "   'android.permission.RECEIVE_SMS',\n",
       "   'android.permission.READ_CONTACTS',\n",
       "   'android.permission.INTERNET',\n",
       "   'android.permission.WRITE_CONTACTS',\n",
       "   'android.permission.READ_SMS'],\n",
       "  'Qihoo-360': True,\n",
       "  'Rising': False,\n",
       "  'SUPERAntiSpyware': False,\n",
       "  'Sophos': True,\n",
       "  'Strings': {'-1': 1,\n",
       "   '7c4eef1808': 1,\n",
       "   'Cdbcea': 1,\n",
       "   '[B': 1,\n",
       "   '[C': 1,\n",
       "   '[I': 1,\n",
       "   '[J': 1,\n",
       "   '\\\\\\\\n': 1,\n",
       "   '\\\\n': 3,\n",
       "   'android.app.Application': 1,\n",
       "   'android.util.Base64': 1,\n",
       "   'append': 1,\n",
       "   'available': 1,\n",
       "   'decode': 1,\n",
       "   'fileWithConstants': 1,\n",
       "   'getAssets': 1,\n",
       "   'java.lang.String': 1,\n",
       "   'java.lang.StringBuilder': 1,\n",
       "   'open': 1,\n",
       "   'read': 1,\n",
       "   '|': 1},\n",
       "  'Symantec': True,\n",
       "  'SymantecMobileInsight': True,\n",
       "  'Tencent': True,\n",
       "  'TheHacker': False,\n",
       "  'TotalDefense': False,\n",
       "  'TrendMicro': False,\n",
       "  'Trustlook': True,\n",
       "  'VBA32': False,\n",
       "  'VIPRE': False,\n",
       "  'VersionCode': 1,\n",
       "  'ViRobot': False,\n",
       "  'Webroot': False,\n",
       "  'WhiteArmor': True,\n",
       "  'Yandex': False,\n",
       "  'Zillya': False,\n",
       "  'ZoneAlarm': True,\n",
       "  'Zoner': True,\n",
       "  'malware': True,\n",
       "  'nProtect': False,\n",
       "  'sha1': '41a0d7a61473dede741b1cc40c5fccb2b03ecf5c',\n",
       "  'vt_positives': 33,\n",
       "  'vt_total': 62}]"
      ]
     },
     "execution_count": 109,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "with open('data.json', 'r') as jsonFile:\n",
    "    data = json.load(jsonFile)\n",
    "\n",
    "print(\"Printing the availlable features of 1st APK in data.json\")    \n",
    "data[0:1]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now we have very complex dataset of APKs which includes numerical and nonnumerical dataset. But the classifier only understands only numerical dataset. So we are converting nonnumerical dataset into categorical dataset.\n",
    "\n",
    "\n",
    "The following function is defined to get permission matrix in which we are marking them as binary. <b>1</b> for the permission used in app and <b>0</b> for not used."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 110,
   "metadata": {},
   "outputs": [],
   "source": [
    "def get_permission_matrix(permissions):\n",
    "    perm_vector = np.zeros(len(ALL_PERMISSIONS))\n",
    "    for permission in permissions:\n",
    "        for i in range(len(perm_vector)):\n",
    "            if ALL_PERMISSIONS[i].strip() == permission:\n",
    "                perm_vector[i] = 1\n",
    "            else:\n",
    "                perm_vector[i] = 0\n",
    "    return perm_vector"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "So we just finished by creating on method for creating permission matrix which is defined static in android application. Lets create matrix for dynamic features that are created from the dynamic methods available in the android app. Such as moveObj() = 'move-object' that used to move object from one directory to another or to delete that object.\n",
    "\n",
    "To list all the operational code used in android app."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 111,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "TOTAL OPCODES 218\n"
     ]
    }
   ],
   "source": [
    "def generate_opcode_vector(dictOpCodes, ALL_OPECODES):\n",
    "    opcode_vec = []\n",
    "    for opcode in ALL_OPECODES:\n",
    "        try:\n",
    "            opcode_vec.append(dictOpCodes[opcode])\n",
    "        except Exception as err:\n",
    "            opcode_vec.append(0)\n",
    "    return opcode_vec\n",
    "\n",
    "# generating all opcodes\n",
    "for datarow in data:\n",
    "    ALL_OPECODES += list(datarow['Opcodes'].keys())\n",
    "\n",
    "ALL_OPECODES = sorted(list(set(ALL_OPECODES)))\n",
    "print('TOTAL OPCODES ' + str(len(ALL_OPECODES)))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Listing some of operation codes of android apps that we grabbed."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 112,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "['div-float',\n",
       " 'div-float/2addr',\n",
       " 'div-int',\n",
       " 'div-int/2addr',\n",
       " 'div-int/lit16',\n",
       " 'div-int/lit8',\n",
       " 'div-long',\n",
       " 'div-long/2addr',\n",
       " 'double-to-float',\n",
       " 'double-to-int',\n",
       " 'double-to-long',\n",
       " 'fill-array-data',\n",
       " 'fill-array-data-payload',\n",
       " 'filled-new-array',\n",
       " 'filled-new-array/range',\n",
       " 'float-to-double',\n",
       " 'float-to-int',\n",
       " 'float-to-long',\n",
       " 'goto',\n",
       " 'goto/16']"
      ]
     },
     "execution_count": 112,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "ALL_OPECODES[50:70]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Sometimes majority of malware apps does not follow the coding guidence so they place most of information static in application. The main scope of malware apps to damage the target because of that they did not focus on removing static strings from the apps.\n",
    "\n",
    "function to list all the static strings are defined in android app."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 113,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "TOTAL STRINGS 197549\n",
      "Printing some examples of static strings defined\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "['#publicit\\\\u00e9',\n",
       " '#publicite',\n",
       " '#px',\n",
       " '#read(byte[]) returned invalid result:',\n",
       " '#recent-check',\n",
       " '#root',\n",
       " '#sdk_version_',\n",
       " '#search_input{',\n",
       " '#search_input{color: #6c6c6c;}',\n",
       " '#search_input{color:#666666;}']"
      ]
     },
     "execution_count": 113,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# genrating all strings\n",
    "for datarow in data:\n",
    "    ALL_STRINGS += list(datarow['Strings'].keys())\n",
    "\n",
    "ALL_STRINGS = sorted(list(set(ALL_STRINGS)))\n",
    "print('TOTAL STRINGS ' + str(len(ALL_STRINGS)))\n",
    "\n",
    "print('Printing some examples of static strings defined')\n",
    "ALL_STRINGS[500:510]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "function to generate string vector matric from all the above strings"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 114,
   "metadata": {},
   "outputs": [],
   "source": [
    "def generate_opstrings_vector(dictOpStrings, ALL_STRINGS):\n",
    "    opstring_vec = []\n",
    "    for opstring in ALL_STRINGS:\n",
    "        try:\n",
    "            opstring_vec.append(dictOpStrings[opstring])\n",
    "        except Exception as err:\n",
    "            opstring_vec.append(0)\n",
    "    return opstring_vec"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Finally, We are merging the all processed and proper features to create one dataframe so that we can easily see or reuse it.\n",
    "\n",
    "Creating dataset for all the data available from data json and storing it into matrix form.\n",
    "\n",
    "Following method also may take some time as it also loops through all APK's feature and stores into dictionary and then into dataframe."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 115,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "'TrendMicro-HouseCall'\n",
      "'WhiteArmor'\n",
      "'TheHacker'\n",
      "'TrendMicro-HouseCall'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TrendMicro'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'Webroot'\n",
      "'TheHacker'\n",
      "'Bkav'\n",
      "'TrendMicro-HouseCall'\n",
      "'TheHacker'\n",
      "'WhiteArmor'\n",
      "'GData'\n",
      "'AVware'\n",
      "'Baidu'\n",
      "'Baidu'\n",
      "'TheHacker'\n",
      "'AVware'\n",
      "'TrendMicro'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TrendMicro-HouseCall'\n",
      "'TrendMicro'\n",
      "'TheHacker'\n",
      "'Kingsoft'\n",
      "'TrendMicro-HouseCall'\n",
      "'TheHacker'\n",
      "'WhiteArmor'\n",
      "'TotalDefense'\n",
      "'TheHacker'\n",
      "'McAfee'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TotalDefense'\n",
      "'TrendMicro-HouseCall'\n",
      "'AVware'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TrendMicro-HouseCall'\n",
      "'SymantecMobileInsight'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TrendMicro-HouseCall'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'AVware'\n",
      "'TrendMicro-HouseCall'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'AVware'\n",
      "'AVware'\n",
      "'Ikarus'\n",
      "'TrendMicro'\n",
      "'F-Secure'\n",
      "'Kingsoft'\n",
      "'TheHacker'\n",
      "'WhiteArmor'\n",
      "'TrendMicro'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'WhiteArmor'\n",
      "'TheHacker'\n",
      "'Kingsoft'\n",
      "'TheHacker'\n",
      "'AVware'\n",
      "'TheHacker'\n",
      "'WhiteArmor'\n",
      "'TrendMicro-HouseCall'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'AVware'\n",
      "'AVware'\n",
      "'Bkav'\n",
      "'TheHacker'\n",
      "'Baidu'\n",
      "'TrendMicro-HouseCall'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'Rising'\n",
      "'WhiteArmor'\n",
      "'WhiteArmor'\n",
      "'Baidu'\n",
      "'TheHacker'\n",
      "'SymantecMobileInsight'\n",
      "'TheHacker'\n",
      "'GData'\n",
      "'Kingsoft'\n",
      "'TheHacker'\n",
      "'TrendMicro-HouseCall'\n",
      "'Bkav'\n",
      "'Baidu'\n",
      "'TheHacker'\n",
      "'TrendMicro'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TrendMicro-HouseCall'\n",
      "'AVware'\n",
      "'Kingsoft'\n",
      "'TrendMicro'\n",
      "'Tencent'\n",
      "'TheHacker'\n",
      "'TrendMicro-HouseCall'\n",
      "'TrendMicro-HouseCall'\n",
      "'DrWeb'\n",
      "'Webroot'\n",
      "'TrendMicro-HouseCall'\n",
      "'TheHacker'\n",
      "'F-Secure'\n",
      "'TheHacker'\n",
      "'F-Secure'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'WhiteArmor'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'AVware'\n",
      "'TheHacker'\n",
      "'McAfee'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'AVware'\n",
      "'AVware'\n",
      "'McAfee'\n",
      "'TheHacker'\n",
      "'McAfee'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'F-Secure'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'McAfee'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TrendMicro-HouseCall'\n",
      "'TheHacker'\n",
      "'McAfee'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TrendMicro-HouseCall'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'F-Secure'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'F-Secure'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'McAfee'\n",
      "'TheHacker'\n",
      "'AVware'\n",
      "'TheHacker'\n",
      "'TrendMicro-HouseCall'\n",
      "'WhiteArmor'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'AVware'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'McAfee'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'AVware'\n",
      "'WhiteArmor'\n",
      "'TrendMicro-HouseCall'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'F-Secure'\n",
      "'McAfee'\n",
      "'TheHacker'\n",
      "'TrendMicro-HouseCall'\n",
      "'AVware'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TrendMicro-HouseCall'\n",
      "'McAfee'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'WhiteArmor'\n",
      "'TrendMicro-HouseCall'\n",
      "'AVware'\n",
      "'TrendMicro-HouseCall'\n",
      "'TheHacker'\n",
      "'AVware'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'TheHacker'\n",
      "'AVware'\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>McAfee</th>\n",
       "      <th>Permissions</th>\n",
       "      <th>Panda</th>\n",
       "      <th>VBA32</th>\n",
       "      <th>F-Secure</th>\n",
       "      <th>K7AntiVirus</th>\n",
       "      <th>Kingsoft</th>\n",
       "      <th>TrendMicro-HouseCall</th>\n",
       "      <th>TheHacker</th>\n",
       "      <th>McAfee-GW-Edition</th>\n",
       "      <th>...</th>\n",
       "      <th>SymantecMobileInsight</th>\n",
       "      <th>Trustlook</th>\n",
       "      <th>VIPRE</th>\n",
       "      <th>Zoner</th>\n",
       "      <th>ClamAV</th>\n",
       "      <th>Qihoo-360</th>\n",
       "      <th>Ad-Aware</th>\n",
       "      <th>nProtect</th>\n",
       "      <th>AVG</th>\n",
       "      <th>TrendMicro</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>1.0</td>\n",
       "      <td>[0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, ...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>1.0</td>\n",
       "      <td>[0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, ...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>1.0</td>\n",
       "      <td>[0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, ...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>1.0</td>\n",
       "      <td>[0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, ...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>1.0</td>\n",
       "      <td>[0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, ...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 65 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "   McAfee                                        Permissions  Panda  VBA32  \\\n",
       "0     1.0  [0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, ...    1.0    1.0   \n",
       "1     1.0  [0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, ...    1.0    1.0   \n",
       "2     1.0  [0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, ...    1.0    1.0   \n",
       "3     1.0  [0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, ...    1.0    1.0   \n",
       "4     1.0  [0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, ...    0.0    0.0   \n",
       "\n",
       "   F-Secure  K7AntiVirus  Kingsoft  TrendMicro-HouseCall  TheHacker  \\\n",
       "0       1.0          1.0       1.0                   1.0        1.0   \n",
       "1       1.0          1.0       1.0                   1.0        1.0   \n",
       "2       1.0          1.0       1.0                   1.0        1.0   \n",
       "3       1.0          1.0       1.0                   1.0        1.0   \n",
       "4       1.0          0.0       0.0                   0.0        0.0   \n",
       "\n",
       "   McAfee-GW-Edition     ...      SymantecMobileInsight  Trustlook  VIPRE  \\\n",
       "0                1.0     ...                        1.0        1.0    1.0   \n",
       "1                1.0     ...                        1.0        1.0    1.0   \n",
       "2                1.0     ...                        1.0        1.0    1.0   \n",
       "3                1.0     ...                        1.0        1.0    1.0   \n",
       "4                0.0     ...                        1.0        0.0    0.0   \n",
       "\n",
       "   Zoner  ClamAV  Qihoo-360  Ad-Aware  nProtect  AVG  TrendMicro  \n",
       "0    1.0     1.0        1.0       1.0       1.0  1.0         1.0  \n",
       "1    1.0     1.0        1.0       1.0       1.0  1.0         1.0  \n",
       "2    1.0     1.0        1.0       1.0       1.0  1.0         1.0  \n",
       "3    1.0     1.0        1.0       1.0       1.0  1.0         1.0  \n",
       "4    0.0     0.0        1.0       0.0       0.0  1.0         0.0  \n",
       "\n",
       "[5 rows x 65 columns]"
      ]
     },
     "execution_count": 115,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "pdArr = []\n",
    "scan_columns = []\n",
    "appendCols = True\n",
    "for i in range(len(data)):\n",
    "    datarow = data[i]\n",
    "    permission_vec = get_permission_matrix(datarow['Permissions'])\n",
    "    opcode_vec = generate_opcode_vector(datarow['Opcodes'], ALL_OPECODES)\n",
    "    opstring_vec = generate_opstrings_vector(datarow['Strings'], ALL_STRINGS)\n",
    "    \n",
    "    #Creating each apk's dictionary and appending into array.\n",
    "    dictVector = {}\n",
    "    dictVector['Permissions'] = permission_vec\n",
    "    dictVector['Opcodes'] = opcode_vec\n",
    "    dictVector['Strings'] = opstring_vec\n",
    "    dictVector['VersionCode'] = datarow['VersionCode']\n",
    "    dictVector['isMalware'] = int(datarow['malware'])\n",
    "    \n",
    "    \n",
    "    #appending virustotal features\n",
    "    vt_json = json.load(open('VT_ANALYSIS/test.json'))  # to append key value\n",
    "   \n",
    "    try:\n",
    "        #appedning virus info cols dynamically \n",
    "        for scanInfo in vt_json['scans']:\n",
    "            dictVector[str(scanInfo)] = int(datarow[scanInfo])\n",
    "            if appendCols: scan_columns.append(str(scanInfo))\n",
    "\n",
    "        dictVector['vt_total'] = datarow['vt_total']\n",
    "        dictVector['vt_positives'] = datarow['vt_positives']\n",
    "    except Exception as err:\n",
    "        #appedning virus info for not available\n",
    "        for scanInfo in vt_json['scans']:\n",
    "            dictVector[str(scanInfo)] = int(datarow['malware'])\n",
    "\n",
    "        dictVector['vt_total'] = 0\n",
    "        dictVector['vt_positives'] = 0\n",
    "        print(err)\n",
    "    \n",
    "    scan_columns.append('Permissions')\n",
    "    scan_columns.append('Opcodes')\n",
    "    scan_columns.append('Strings')\n",
    "    scan_columns.append('VersionCode')\n",
    "    scan_columns.append('vt_total')\n",
    "    scan_columns.append('vt_positives')\n",
    "    scan_columns.append('isMalware')\n",
    "    \n",
    "    pdArr.append(dictVector)\n",
    "\n",
    "df = pd.DataFrame(pdArr, columns=list(set(scan_columns)), dtype=np.float32)\n",
    "# df.to_csv('dataframe.csv', index=None, header=True) stores large size of csv\n",
    "df.head()\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "As we can see that, We have all the features are presented in visualize form to evaluate it in better way."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 116,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "(array([114.,   0., 178.]),\n",
       " array([0.        , 0.33333333, 0.66666667, 1.        ]),\n",
       " <a list of 3 Patch objects>)"
      ]
     },
     "execution_count": 116,
     "metadata": {},
     "output_type": "execute_result"
    },
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAXoAAAD8CAYAAAB5Pm/hAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADl0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uIDMuMC4wLCBodHRwOi8vbWF0cGxvdGxpYi5vcmcvqOYd8AAAD4tJREFUeJzt3X+MJ3V9x/Hnq5zaVLGgtxLCjy6Yw5TS9jAbYtNqsViLaEDbhnKpCpZ4YqVpq2mDmhRjY6JVNDG12CNcwEYQlFIvEauEWkkbz7oIvR4oeuChdz25FZTa0lKBd//YOfv13Lv93s58d9kPz0fyzc585jMz78/t3utmP9/5zqWqkCS16ydWugBJ0mQZ9JLUOINekhpn0EtS4wx6SWqcQS9JjTPoJalxBr0kNc6gl6TGrVnpAgDWrl1b09PTK12GJK0qt91223eqamqxfk+IoJ+enmZ2dnaly5CkVSXJfeP0c+pGkhpn0EtS4wx6SWqcQS9JjTPoJalxBr0kNc6gl6TGGfSS1DiDXpIat+gnY5NsBl4B7K2qU7q264DndV2OAL5XVeuTTANfAe7utm2tqouGLlrSoZu+5FMrXYIWsPPdL5/4OcZ5BMJVwF8CH9nXUFW/s285yWXAQyP976mq9UMVKEnqZ9Ggr6pbuyv1H5MkwLnArw1bliRpKH3n6F8I3F9VXx9pOyHJ7Uk+n+SFB9oxycYks0lm5+bmepYhSTqQvkG/Abh2ZH0PcHxVnQq8GbgmyTMX2rGqNlXVTFXNTE0t+pRNSdISLTnok6wBfhO4bl9bVT1SVQ90y7cB9wAn9S1SkrR0fa7oXwJ8tap27WtIMpXksG75RGAdcG+/EiVJfSwa9EmuBb4APC/JriQXdpvO40enbQBeBGxLcgfwCeCiqnpwyIIlSYdmnLtuNhyg/YIF2m4AbuhfliRpKH4yVpIaZ9BLUuMMeklqnEEvSY0z6CWpcQa9JDXOoJekxhn0ktQ4g16SGmfQS1LjDHpJapxBL0mNM+glqXEGvSQ1zqCXpMYZ9JLUOINekhpn0EtS4wx6SWqcQS9JjVs06JNsTrI3yfaRtnck2Z3kju511si2tybZkeTuJL8xqcIlSeMZ54r+KuDMBdo/UFXru9dNAElOBs4Dfq7b56+SHDZUsZKkQ7do0FfVrcCDYx7vHOBjVfVIVX0D2AGc1qM+SVJPfeboL06yrZvaObJrOwb41kifXV3bj0myMclsktm5ubkeZUiSDmapQX858FxgPbAHuOxQD1BVm6pqpqpmpqamlliGJGkxSwr6qrq/qh6rqseBK/j/6ZndwHEjXY/t2iRJK2RJQZ/k6JHVVwH77sjZApyX5GlJTgDWAf/Sr0RJUh9rFuuQ5FrgdGBtkl3ApcDpSdYDBewE3gBQVXcmuR64C3gUeFNVPTaZ0iVJ41g06KtqwwLNVx6k/7uAd/UpSpI0HD8ZK0mNM+glqXEGvSQ1zqCXpMYZ9JLUOINekhpn0EtS4wx6SWqcQS9JjTPoJalxBr0kNc6gl6TGGfSS1DiDXpIaZ9BLUuMMeklqnEEvSY0z6CWpcQa9JDXOoJekxi0a9Ek2J9mbZPtI23uTfDXJtiQ3Jjmia59O8t9J7uheH55k8ZKkxY1zRX8VcOZ+bTcDp1TVLwBfA946su2eqlrfvS4apkxJ0lItGvRVdSvw4H5tn62qR7vVrcCxE6hNkjSAIebofw/49Mj6CUluT/L5JC880E5JNiaZTTI7Nzc3QBmSpIX0CvokbwceBT7aNe0Bjq+qU4E3A9ckeeZC+1bVpqqaqaqZqampPmVIkg5iyUGf5ALgFcDvVlUBVNUjVfVAt3wbcA9w0gB1SpKWaElBn+RM4E+Bs6vq4ZH2qSSHdcsnAuuAe4coVJK0NGsW65DkWuB0YG2SXcClzN9l8zTg5iQAW7s7bF4EvDPJD4DHgYuq6sEFDyxJWhaLBn1VbVig+coD9L0BuKFvUZKk4fjJWElqnEEvSY0z6CWpcQa9JDXOoJekxhn0ktQ4g16SGrfoffSrwfQln1rpErSfne9++UqXIKnjFb0kNc6gl6TGGfSS1DiDXpIaZ9BLUuMMeklqnEEvSY0z6CWpcQa9JDXOoJekxhn0ktQ4g16SGjdW0CfZnGRvku0jbc9KcnOSr3dfj+zak+SDSXYk2Zbk+ZMqXpK0uHGv6K8Cztyv7RLglqpaB9zSrQO8DFjXvTYCl/cvU5K0VGMFfVXdCjy4X/M5wNXd8tXAK0faP1LztgJHJDl6iGIlSYeuzxz9UVW1p1v+NnBUt3wM8K2Rfru6th+RZGOS2SSzc3NzPcqQJB3MIG/GVlUBdYj7bKqqmaqamZqaGqIMSdIC+gT9/fumZLqve7v23cBxI/2O7dokSSugT9BvAc7vls8HPjnS/tru7psXAA+NTPFIkpbZWP9nbJJrgdOBtUl2AZcC7wauT3IhcB9wbtf9JuAsYAfwMPC6gWuWJB2CsYK+qjYcYNMZC/Qt4E19ipIkDcdPxkpS4wx6SWqcQS9JjTPoJalxBr0kNc6gl6TGGfSS1DiDXpIaZ9BLUuMMeklqnEEvSY0z6CWpcQa9JDXOoJekxhn0ktQ4g16SGmfQS1LjDHpJapxBL0mNM+glqXFj/efgC0nyPOC6kaYTgT8DjgBeD8x17W+rqpuWXKEkqZclB31V3Q2sB0hyGLAbuBF4HfCBqnrfIBVKknoZaurmDOCeqrpvoONJkgYyVNCfB1w7sn5xkm1JNic5cqBzSJKWoHfQJ3kqcDbw8a7pcuC5zE/r7AEuO8B+G5PMJpmdm5tbqIskaQBDXNG/DPhyVd0PUFX3V9VjVfU4cAVw2kI7VdWmqpqpqpmpqakBypAkLWSIoN/AyLRNkqNHtr0K2D7AOSRJS7Tku24Akjwd+HXgDSPNf5FkPVDAzv22SZKWWa+gr6r/Ap69X9trelUkSRqUn4yVpMYZ9JLUOINekhpn0EtS4wx6SWqcQS9JjTPoJalxBr0kNc6gl6TGGfSS1DiDXpIaZ9BLUuMMeklqnEEvSY0z6CWpcQa9JDXOoJekxhn0ktQ4g16SGmfQS1Ljev3n4ABJdgLfBx4DHq2qmSTPAq4DpoGdwLlV9d2+55IkHbqhruhfXFXrq2qmW78EuKWq1gG3dOuSpBUwqambc4Cru+WrgVdO6DySpEUMEfQFfDbJbUk2dm1HVdWebvnbwFEDnEeStAS95+iBX6mq3UmeA9yc5KujG6uqktT+O3X/KGwEOP744wcoQ5K0kN5X9FW1u/u6F7gROA24P8nRAN3XvQvst6mqZqpqZmpqqm8ZkqQD6BX0SZ6e5PB9y8BLge3AFuD8rtv5wCf7nEeStHR9p26OAm5Msu9Y11TV3yf5EnB9kguB+4Bze55HkrREvYK+qu4FfnGB9geAM/ocW5I0DD8ZK0mNM+glqXEGvSQ1zqCXpMYZ9JLUOINekhpn0EtS4wx6SWqcQS9JjTPoJalxBr0kNc6gl6TGGfSS1DiDXpIaZ9BLUuMMeklqnEEvSY0z6CWpcQa9JDXOoJekxi056JMcl+RzSe5KcmeSP+za35Fkd5I7utdZw5UrSTpUa3rs+yjwlqr6cpLDgduS3Nxt+0BVva9/eZKkvpYc9FW1B9jTLX8/yVeAY4YqTJI0jEHm6JNMA6cCX+yaLk6yLcnmJEcOcQ5J0tL0DvokzwBuAP6oqv4DuBx4LrCe+Sv+yw6w38Yks0lm5+bm+pYhSTqAXkGf5CnMh/xHq+pvAarq/qp6rKoeB64ATlto36raVFUzVTUzNTXVpwxJ0kH0uesmwJXAV6rq/SPtR490exWwfenlSZL66nPXzS8DrwH+LckdXdvbgA1J1gMF7ATe0KtCSVIvfe66+ScgC2y6aenlSJKG5idjJalxBr0kNc6gl6TGGfSS1DiDXpIaZ9BLUuMMeklqnEEvSY0z6CWpcQa9JDXOoJekxhn0ktQ4g16SGmfQS1LjDHpJapxBL0mNM+glqXEGvSQ1zqCXpMYZ9JLUuIkFfZIzk9ydZEeSSyZ1HknSwU0k6JMcBnwIeBlwMrAhycmTOJck6eAmdUV/GrCjqu6tqv8FPgacM6FzSZIOYlJBfwzwrZH1XV2bJGmZrVmpEyfZCGzsVv8zyd09DrcW+E7/qlaNJ/x4857BD/mEH/MEOOYngbyn15h/ZpxOkwr63cBxI+vHdm0/VFWbgE1DnCzJbFXNDHGs1eDJNl5wzE8WjnkyJjV18yVgXZITkjwVOA/YMqFzSZIOYiJX9FX1aJKLgc8AhwGbq+rOSZxLknRwE5ujr6qbgJsmdfz9DDIFtIo82cYLjvnJwjFPQKpq0ueQJK0gH4EgSY1bNUG/2CMVkjwtyXXd9i8mmV7+Koc1xpjfnOSuJNuS3JJkrFutnsjGfXRGkt9KUklW/R0a44w5ybnd9/rOJNcsd41DG+Nn+/gkn0tye/fzfdZK1DmUJJuT7E2y/QDbk+SD3Z/HtiTPH7SAqnrCv5h/Q/ce4ETgqcC/Aifv1+f3gQ93y+cB16103csw5hcDP9Utv/HJMOau3+HArcBWYGal616G7/M64HbgyG79OStd9zKMeRPwxm75ZGDnStfdc8wvAp4PbD/A9rOATwMBXgB8ccjzr5Yr+nEeqXAOcHW3/AngjCRZxhqHtuiYq+pzVfVwt7qV+c8rrGbjPjrjz4H3AP+znMVNyDhjfj3woar6LkBV7V3mGoc2zpgLeGa3/NPAvy9jfYOrqluBBw/S5RzgIzVvK3BEkqOHOv9qCfpxHqnwwz5V9SjwEPDsZaluMg71MRIXMn9FsJotOubuV9rjqupTy1nYBI3zfT4JOCnJPyfZmuTMZatuMsYZ8zuAVyfZxfzde3+wPKWtmIk+NmbFHoGg4SR5NTAD/OpK1zJJSX4CeD9wwQqXstzWMD99czrzv7XdmuTnq+p7K1rVZG0Arqqqy5L8EvA3SU6pqsdXurDVaLVc0S/6SIXRPknWMP/r3gPLUt1kjDNmkrwEeDtwdlU9sky1TcpiYz4cOAX4xyQ7mZ/L3LLK35Ad5/u8C9hSVT+oqm8AX2M++FerccZ8IXA9QFV9AfhJ5p+D06qx/r4v1WoJ+nEeqbAFOL9b/m3gH6p7l2OVWnTMSU4F/pr5kF/t87awyJir6qGqWltV01U1zfz7EmdX1ezKlDuIcX62/475q3mSrGV+Kufe5SxyYOOM+ZvAGQBJfpb5oJ9b1iqX1xbgtd3dNy8AHqqqPUMdfFVM3dQBHqmQ5J3AbFVtAa5k/te7Hcy/6XHeylXc35hjfi/wDODj3fvO36yqs1es6J7GHHNTxhzzZ4CXJrkLeAz4k6patb+tjjnmtwBXJPlj5t+YvWA1X7gluZb5f6zXdu87XAo8BaCqPsz8+xBnATuAh4HXDXr+VfxnJ0kaw2qZupEkLZFBL0mNM+glqXEGvSQ1zqCXpMYZ9JLUOINekhpn0EtS4/4PLqAj5cBds4UAAAAASUVORK5CYII=\n",
      "text/plain": [
       "<Figure size 432x288 with 1 Axes>"
      ]
     },
     "metadata": {
      "needs_background": "light"
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "plt.hist(df['isMalware'], bins=3)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 117,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "From above chart\n",
      "We have 114 benign and 178 malware APKs\n"
     ]
    }
   ],
   "source": [
    "print('From above chart')\n",
    "print('We have '+str(len(df[df['isMalware'] == 0]))+ ' benign and ' +str(len(df[df['isMalware'] == 1])) + ' malware APKs')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now we done with the feature  engineering, now we have to combine them all. \n",
    "\n",
    "Creating label <b>y</b> from the <b>'isMalware'</b> column as it is out target label for classifier."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 118,
   "metadata": {},
   "outputs": [],
   "source": [
    "y = np.asarray(list(df['isMalware']))\n",
    "del df['isMalware']"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now we have to combine individual matrix of \"Permissions\", \"Opcodes\" and \"Strings\" into X. But lets create Xp, Xo and Xs seprately and combine them later.\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 119,
   "metadata": {},
   "outputs": [],
   "source": [
    "Xp = np.asarray(list(df['Permissions']))\n",
    "Xo = np.asarray(list(df['Opcodes']))\n",
    "Xs = np.asarray(list(df['Strings']))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "\n",
    "Creating features from the columns 'Permissions', 'Opcodes', 'Strings', 'VersionCode' and storing it into X"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 120,
   "metadata": {},
   "outputs": [],
   "source": [
    "\n",
    "X = np.concatenate((Xp, Xo), 1)\n",
    "X = np.concatenate((X, Xs), 1)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Remove the above defined columns as we already saved the features in Xp, Xo and Xs."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 121,
   "metadata": {},
   "outputs": [],
   "source": [
    "del df['Permissions'], df['Opcodes'], df['Strings']"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Let's check the remaining columns "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 122,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "(292, 61)"
      ]
     },
     "execution_count": 122,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df.values.shape"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "So we have still 61 columns left to be added into feature matrix. Let's see which columns yet pending."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 123,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>McAfee</th>\n",
       "      <th>Panda</th>\n",
       "      <th>VBA32</th>\n",
       "      <th>F-Secure</th>\n",
       "      <th>K7AntiVirus</th>\n",
       "      <th>Kingsoft</th>\n",
       "      <th>TrendMicro-HouseCall</th>\n",
       "      <th>TheHacker</th>\n",
       "      <th>McAfee-GW-Edition</th>\n",
       "      <th>Baidu</th>\n",
       "      <th>...</th>\n",
       "      <th>SymantecMobileInsight</th>\n",
       "      <th>Trustlook</th>\n",
       "      <th>VIPRE</th>\n",
       "      <th>Zoner</th>\n",
       "      <th>ClamAV</th>\n",
       "      <th>Qihoo-360</th>\n",
       "      <th>Ad-Aware</th>\n",
       "      <th>nProtect</th>\n",
       "      <th>AVG</th>\n",
       "      <th>TrendMicro</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 61 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "   McAfee  Panda  VBA32  F-Secure  K7AntiVirus  Kingsoft  \\\n",
       "0     1.0    1.0    1.0       1.0          1.0       1.0   \n",
       "1     1.0    1.0    1.0       1.0          1.0       1.0   \n",
       "2     1.0    1.0    1.0       1.0          1.0       1.0   \n",
       "3     1.0    1.0    1.0       1.0          1.0       1.0   \n",
       "4     1.0    0.0    0.0       1.0          0.0       0.0   \n",
       "\n",
       "   TrendMicro-HouseCall  TheHacker  McAfee-GW-Edition  Baidu     ...      \\\n",
       "0                   1.0        1.0                1.0    1.0     ...       \n",
       "1                   1.0        1.0                1.0    1.0     ...       \n",
       "2                   1.0        1.0                1.0    1.0     ...       \n",
       "3                   1.0        1.0                1.0    1.0     ...       \n",
       "4                   0.0        0.0                0.0    1.0     ...       \n",
       "\n",
       "   SymantecMobileInsight  Trustlook  VIPRE  Zoner  ClamAV  Qihoo-360  \\\n",
       "0                    1.0        1.0    1.0    1.0     1.0        1.0   \n",
       "1                    1.0        1.0    1.0    1.0     1.0        1.0   \n",
       "2                    1.0        1.0    1.0    1.0     1.0        1.0   \n",
       "3                    1.0        1.0    1.0    1.0     1.0        1.0   \n",
       "4                    1.0        0.0    0.0    0.0     0.0        1.0   \n",
       "\n",
       "   Ad-Aware  nProtect  AVG  TrendMicro  \n",
       "0       1.0       1.0  1.0         1.0  \n",
       "1       1.0       1.0  1.0         1.0  \n",
       "2       1.0       1.0  1.0         1.0  \n",
       "3       1.0       1.0  1.0         1.0  \n",
       "4       0.0       0.0  1.0         0.0  \n",
       "\n",
       "[5 rows x 61 columns]"
      ]
     },
     "execution_count": 123,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now combining the all above matrices into out final feature matrix X."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 124,
   "metadata": {},
   "outputs": [],
   "source": [
    "\n",
    "X = np.concatenate((X, df.values), 1)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Feature Vector is Ready !!\n",
    "\n",
    "Splitting the data into training/testing dataset is one of the techniques that used to check that our dataset is working proper. It also used to reduce overfitting and underfitting related problems.\n",
    "\n",
    "The most used trade off is the <b>70%</b> (training data) and <b>30%</b> (testing data)\n",
    "\n",
    "so splitting the data into training and testing dataset for making the dataset as robust as possible"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 125,
   "metadata": {},
   "outputs": [],
   "source": [
    "from sklearn.model_selection import train_test_split, StratifiedKFold, cross_val_score\n",
    "xTrain, xTest, yTrain, yTest = train_test_split(X, y, test_size=0.3, random_state=0, shuffle=True)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 126,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "length of training dataset 204 & length of testing dataset 88\n"
     ]
    }
   ],
   "source": [
    "print('length of training dataset '+ str(len(yTrain)) + ' & length of testing dataset '+ str(len(yTest)))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Feeding these feature and labels in SVC classifier"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 127,
   "metadata": {},
   "outputs": [],
   "source": [
    "svc = SVC(C=1.0, kernel='linear', probability=True, gamma=0.1, tol=0.001)\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 128,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "SVC Score 0.9545454545454546\n"
     ]
    }
   ],
   "source": [
    "svc.fit(xTrain, yTrain)\n",
    "score = str(svc.score(xTest, yTest))\n",
    "print('SVC Score ' + score)\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Lets evaluate result report of our SVC Classifier"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 129,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "             precision    recall  f1-score   support\n",
      "\n",
      "     benign       1.00      0.89      0.94        38\n",
      "    malware       0.93      1.00      0.96        50\n",
      "\n",
      "avg / total       0.96      0.95      0.95        88\n",
      "\n"
     ]
    }
   ],
   "source": [
    "y_pred = svc.predict(xTest)\n",
    "from sklearn import metrics\n",
    "\n",
    "svc_report = metrics.classification_report(yTest, y_pred, target_names=['benign', 'malware'])\n",
    "print(svc_report)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "So we have out classification report that predicts 100% accuracy.\n",
    "Howerver another approch of testing our classifier is plotting confusion matrix.\n",
    "Which will give you the exact idea about how our algo works in perspective of True Positive & False Positive."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 130,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[[34  4]\n",
      " [ 0 50]]\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<matplotlib.image.AxesImage at 0x7fb755c81b70>"
      ]
     },
     "execution_count": 130,
     "metadata": {},
     "output_type": "execute_result"
    },
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAARUAAAD8CAYAAABZ0jAcAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADl0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uIDMuMC4wLCBodHRwOi8vbWF0cGxvdGxpYi5vcmcvqOYd8AAAD+tJREFUeJzt3X+s3XV9x/HnywKtDpWWTmiQ8SPiDwxatCkqRlEQkD+ARDZLtlEWCNPJlmhcxJCgwZmh+4PFTDcbZKJuwGRT64QxoBKXYNG6AZU6oBQzqCiOYg0Bwdb3/jjfLsfrPe2993w4556b5yM5Od/z+Xw/576/ue0r53zP+d53qgpJauV54y5A0sJiqEhqylCR1JShIqkpQ0VSU4aKpKaGCpUky5LckuSB7n7pgP12J7mru63vGz8qyZ1Jtia5PskBw9QjafyGfaVyCXBbVR0D3NY9ns7TVbWyu53ZN/4J4MqqehnwBHDBkPVIGrMM8+W3JPcBJ1XVo0lWALdX1Sum2e/JqjpwyliAnwKHVtWuJG8EPlpVp825IEljt9+Q6w+pqke77R8DhwzYb0mSTcAu4Iqq+ipwMPCzqtrV7fMIcNigH5TkIuAigOct2f/1zz982ZCla5QW/dBvbk+Sp3f/nGd3P525rN1nqCS5FTh0mqlL+x9UVSUZ9C/niKranuRoYEOSzcDO2RRaVeuAdQAHvvzQWvnp82azXGP2wgueHXcJmoU7fnztnNfuM1Sq6pRBc0l+kmRF39ufxwY8x/bufluS24HjgX8GDkqyX/dq5aXA9jkcg6R5ZNgTteuBtd32WuBrU3dIsjTJ4m57OXAisKV6J3O+CZyzt/WSJsuwoXIF8I4kDwCndI9JsirJVd0+rwI2JbmbXohcUVVburkPAR9IspXeOZbPDVmPpDEb6kRtVT0OnDzN+Cbgwm77DuC4Aeu3AauHqUHS/OI3aiU1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIauo5b3uaZGWSbye5N8k9Sd7dN/f5JA/1tURdOUw9ksZvFG1PnwLOq6pXA6cDf53koL75P+9riXrXkPVIGrNhQ+Us4Jpu+xrg7Kk7VNX9VfVAt/0jer2BfnvInytpnho2VGba9hSAJKuBA4AH+4Y/3r0tunJPfyBJk2tUbU/pOhh+EVhbVb/qhj9ML4wOoNfS9EPA5QPW/38v5cUvedG+ypY0JiNpe5rkRcA3gEuramPfc+95lfNMkr8HPriXOn6tl/K+6pY0HqNoe3oA8BXgC1V1w5S5Fd196J2P+f6Q9Ugas1G0Pf094C3A+dN8dPwPSTYDm4HlwF8MWY+kMRtF29MvAV8asP7tw/x8SfOP36iV1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU01CJcnpSe5LsjXJb7Q+TbI4yfXd/J1Jjuyb+3A3fl+S01rUI2l8hg6VJIuATwPvBI4Fzk1y7JTdLgCeqKqXAVcCn+jWHgusAfb0Wf5M93ySJlSLVyqrga1Vta2qngWuo9djuV9/z+UbgJO7Xj9nAddV1TNV9RCwtXs+SROqRagcBjzc9/iRbmzafapqF7ATOHiGa4Fe29Mkm5Js2rXz6QZlS3ouTMyJ2qpaV1WrqmrVfi9+/rjLkTRAi1DZDhze9/il3di0+yTZD3gx8PgM10qaIC1C5bvAMUmO6vomr6HXY7lff8/lc4ANVVXd+Jru06GjgGOA7zSoSdKYDNX2FHrnSJJcDNwMLAKurqp7k1wObKqq9cDngC8m2QrsoBc8dPv9E7AF2AW8r6p2D1uTpPEZOlQAqupG4MYpY5f1bf8C+N0Baz8OfLxFHZLGb2JO1EqaDIaKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKZG1fb0A0m2JLknyW1Jjuib253kru429Q9mS5owQ/+N2r62p++g1wzsu0nWV9WWvt3+C1hVVU8leS/wSeDd3dzTVbVy2DokzQ8jaXtaVd+sqqe6hxvp9feRtACNqu1pvwuAm/oeL+namW5McvagRbY9lSZDkxYdM5XkD4BVwFv7ho+oqu1JjgY2JNlcVQ9OXVtV64B1AAe+/NAaScGSZm1UbU9JcgpwKXBmVT2zZ7yqtnf324DbgeMb1CRpTEbS9jTJ8cBn6QXKY33jS5Ms7raXAyfS61YoaUKNqu3pXwEHAl9OAvA/VXUm8Crgs0l+RS/grpjyqZGkCTOqtqenDFh3B3BcixokzQ9+o1ZSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKZG1fb0/CQ/7WtvemHf3NokD3S3tS3qkTQ+o2p7CnB9VV08Ze0y4CP0egEV8L1u7RPD1iVpPEbS9nQvTgNuqaodXZDcApzeoCZJY9Lir+lP1/b0hGn2e1eStwD3A++vqocHrJ22ZWqSi4CLAJbwAp5/2kMNSteofONHd427BM3C6tN2znntqE7Ufh04sqpeQ+/VyDWzfYKqWldVq6pq1f4sbl6gpDZG0va0qh7va3V6FfD6ma6VNFlG1fZ0Rd/DM4EfdNs3A6d27U+XAqd2Y5Im1Kjanv5ZkjOBXcAO4Pxu7Y4kH6MXTACXV9WOYWuSND6pqnHXMGsvyrI6ISePuwzNws2eqJ0oq097mE13/yJzWes3aiU1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIampUbU+v7Gt5en+Sn/XN7e6bWz91raTJMpK2p1X1/r79/xQ4vu8pnq6qlcPWIWl+GEfb03OBaxv8XEnzUItQmU3r0iOAo4ANfcNLkmxKsjHJ2YN+SJKLuv02/ZJnBu0macxa9FKejTXADVW1u2/siKranuRoYEOSzVX14NSFVbUOWAe9Fh2jKVfSbI2k7WmfNUx561NV27v7bcDt/Pr5FkkTZiRtTwGSvBJYCny7b2xpksXd9nLgRGDL1LWSJseo2p5CL2yuq19vifgq4LNJfkUv4K7o/9RI0uRpck6lqm4EbpwydtmUxx+dZt0dwHEtapA0P/iNWklNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmmrV9vTqJI8l+f6A+ST5VNcW9Z4kr+ubW5vkge62tkU9ksan1SuVzwOn72X+ncAx3e0i4G8BkiwDPgKcQK/T4UeSLG1Uk6QxaBIqVfUtYMdedjkL+EL1bAQOSrICOA24pap2VNUTwC3sPZwkzXOj6lA4qDXqbFqmXkTvVQ5LeMFzU6WkoU3MidqqWldVq6pq1f4sHnc5kgYYVagMao06m5apkibAqEJlPXBe9ynQG4CdVfUova6Gp3btT5cCp3ZjkiZUk3MqSa4FTgKWJ3mE3ic6+wNU1d/R6154BrAVeAr4o25uR5KP0evHDHB5Ve3thK+kea5V29Nz9zFfwPsGzF0NXN2iDknjNzEnaiVNBkNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOjanv6+127081J7kjy2r65H3bjdyXZ1KIeSeMzqranDwFvrarjgI8B66bMv62qVlbVqkb1SBqTVn/4+ltJjtzL/B19DzfS6+8jaQEaxzmVC4Cb+h4X8O9Jvte1NpU0wUbVSxmAJG+jFypv7ht+c1VtT/IS4JYk/901fJ+61l7K0gQY2SuVJK8BrgLOqqrH94xX1fbu/jHgK8Dq6dbbS1maDCMJlSS/A/wL8IdVdX/f+G8leeGebXptT6f9BEnSZBhV29PLgIOBzyQB2NV90nMI8JVubD/gH6vq31rUJGk8RtX29ELgwmnGtwGv/c0VkiaV36iV1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU6PqpXxSkp1dv+S7klzWN3d6kvuSbE1ySYt6JI3PqHopA/xH1y95ZVVdDpBkEfBp4J3AscC5SY5tVJOkMWgSKl1HwR1zWLoa2FpV26rqWeA64KwWNUkaj1G2PX1jkruBHwEfrKp7gcOAh/v2eQQ4YbrF/W1PgWdurRsWYtOx5cD/jruI58KiFQv22Bbqcb1irgtHFSr/CRxRVU8mOQP4KnDMbJ6gqtYB6wCSbOqakS0oC/W4YOEe20I+rrmuHcmnP1X186p6stu+Edg/yXJgO3B4364v7cYkTahR9VI+NF1v0ySru5/7OPBd4JgkRyU5AFgDrB9FTZKeG6PqpXwO8N4ku4CngTVVVcCuJBcDNwOLgKu7cy37sq5F3fPQQj0uWLjH5nFNkd7/bUlqw2/USmrKUJHU1ESESpJlSW5J8kB3v3TAfrv7LgWYtyd893VpQpLFSa7v5u9McuToq5y9GRzX+Ul+2vc7unAcdc7WDC5DSZJPdcd9T5LXjbrGuRjm8pq9qqp5fwM+CVzSbV8CfGLAfk+Ou9YZHMsi4EHgaOAA4G7g2Cn7/Anwd932GuD6cdfd6LjOB/5m3LXO4djeArwO+P6A+TOAm4AAbwDuHHfNjY7rJOBfZ/u8E/FKhd5X96/ptq8Bzh5jLcOayaUJ/cd7A3Dyno/k57EFe8lF7fsylLOAL1TPRuCgJCtGU93czeC45mRSQuWQqnq02/4xcMiA/ZYk2ZRkY5L5GjzTXZpw2KB9qmoXsBM4eCTVzd1MjgvgXd1bhBuSHD7N/CSa6bFPojcmuTvJTUlePZMFo7z2Z6+S3AocOs3Upf0PqqqSDPoc/Iiq2p7kaGBDks1V9WDrWjVnXweurapnkvwxvVdjbx9zTRpsTpfXzJtQqapTBs0l+UmSFVX1aPey8rEBz7G9u9+W5HbgeHrv8+eTmVyasGefR5LsB7yY3jeQ57N9HldV9R/DVfTOlS0EC/Jyk6r6ed/2jUk+k2R5Ve31AspJefuzHljbba8FvjZ1hyRLkyzutpcDJwJbRlbhzM3k0oT+4z0H2FDdmbN5bJ/HNeU8w5nAD0ZY33NpPXBe9ynQG4CdfW/XJ9ZeLq/Zu3GfgZ7hWeqDgduAB4BbgWXd+Crgqm77TcBmep86bAYuGHfdezmeM4D76b2KurQbuxw4s9teAnwZ2Ap8Bzh63DU3Oq6/BO7tfkffBF457ppneFzXAo8Cv6R3vuQC4D3Ae7r50PtjYw92//ZWjbvmRsd1cd/vayPwppk8r1/Tl9TUpLz9kTQhDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpqf8Db4y8W/BpZuwAAAAASUVORK5CYII=\n",
      "text/plain": [
       "<Figure size 432x288 with 1 Axes>"
      ]
     },
     "metadata": {
      "needs_background": "light"
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "# Plot the confusion matrix\n",
    "cm = metrics.confusion_matrix(yTest, y_pred)\n",
    "print(cm)\n",
    "plt.imshow(cm)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "So our algo. works quite good in this report also as it classifies 34 out of 38 of benign and 4 misclassified and 50 out of 50 of malware. "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 131,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "AdaBoostClassifier Score 0.9886363636363636\n"
     ]
    }
   ],
   "source": [
    "clf = AdaBoostClassifier(n_estimators=100, random_state=0)\n",
    "clf.fit(xTrain, yTrain)\n",
    "score = str(clf.score(xTest, yTest))\n",
    "print('AdaBoostClassifier Score ' + score)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Lets evaluate result report of our AdaBoostClassifier"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 132,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "             precision    recall  f1-score   support\n",
      "\n",
      "     benign       0.97      1.00      0.99        38\n",
      "    malware       1.00      0.98      0.99        50\n",
      "\n",
      "avg / total       0.99      0.99      0.99        88\n",
      "\n"
     ]
    }
   ],
   "source": [
    "y_pred = clf.predict(xTest)\n",
    "ada_report = metrics.classification_report(yTest, y_pred, target_names=['benign', 'malware'])\n",
    "print(ada_report)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 133,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[[38  0]\n",
      " [ 1 49]]\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<matplotlib.image.AxesImage at 0x7fb74b3e5198>"
      ]
     },
     "execution_count": 133,
     "metadata": {},
     "output_type": "execute_result"
    },
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAARUAAAD8CAYAAABZ0jAcAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADl0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uIDMuMC4wLCBodHRwOi8vbWF0cGxvdGxpYi5vcmcvqOYd8AAAD/lJREFUeJzt3X+sZGV9x/H3R36t1grLboUNWn5Eoq5BF92sKEZRkV9/AIlEl7R1aSBUK22isRFDggbbFO0fNKZa3SAVxQKVVl1bkK4gsQnu6toCK1hgWZrCimJZxFB+yOK3f8zZ5ni9d/feOw8zd27er2QyZ57nPHO/J3f3k5kzc+43VYUktfK8cRcgaXExVCQ1ZahIaspQkdSUoSKpKUNFUlNDhUqSg5NsTHJvd790hv2eTXJbd9vQGz8yyeYk25Jcm2T/YeqRNH7DvlK5ELipqo4GbuoeT+fJqlrV3U7vjX8CuKyqXgY8Cpw7ZD2SxizDfPktyd3ACVX1UJIVwC1V9fJp9nu8ql44ZSzAz4BDq2pXkjcAH6uqk+ddkKSx23fI9YdU1UPd9k+AQ2bYb0mSLcAu4NKq+hqwDPh5Ve3q9nkQOGymH5TkfOB8gH2fv8/rlh5x4JCla5Se+pHf3J4kT/G//LKeznzW7jVUknwLOHSaqYv6D6qqksz0L+fwqtqR5Cjg5iRbgcfmUmhVrQfWA7x45bJ611W+oJkkd69+ZtwlaA42103zXrvXUKmqE2eaS/LTJCt6b38enuE5dnT325PcAhwL/CNwUJJ9u1crLwF2zOMYJC0gw56o3QCs67bXAV+fukOSpUkO6LaXA8cDd9XgZM63gbP2tF7SZBk2VC4F3pHkXuDE7jFJVie5vNvnlcCWJLczCJFLq+qubu7DwAeTbGNwjuXzQ9YjacyGOlFbVY8Ab59mfAtwXrd9K3DMDOu3A2uGqUHSwuI3aiU1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIauo5b3uaZFWS7ya5M8kdSd7dm/tCkvt7LVFXDVOPpPEbRdvTJ4D3VNWrgFOAv05yUG/+z3otUW8bsh5JYzZsqJwBXNltXwmcOXWHqrqnqu7ttn/MoDfQ7wz5cyUtUMOGymzbngKQZA2wP3Bfb/gvurdFl+3uDyRpco2q7SldB8MvAeuq6lfd8EcYhNH+DFqafhi4ZIb1/99L+YWHvmBvZUsak5G0PU3yIuBfgIuqalPvuXe/ynk6yd8BH9pDHb/WS3lvdUsaj1G0Pd0f+Crwxaq6bsrciu4+DM7H/HDIeiSN2Sjanr4LeDNwzjQfHX85yVZgK7Ac+PMh65E0ZqNoe3oVcNUM6982zM+XtPD4jVpJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ11SRUkpyS5O4k25L8RuvTJAckubab35zkiN7cR7rxu5Oc3KIeSeMzdKgk2Qf4NHAqsBI4O8nKKbudCzxaVS8DLgM+0a1dCawFdvdZ/kz3fJImVItXKmuAbVW1vap+CVzDoMdyX7/n8nXA27teP2cA11TV01V1P7Ctez5JE6pFqBwGPNB7/GA3Nu0+VbULeAxYNsu1wKDtaZItSbY8+ehTDcqW9FyYmBO1VbW+qlZX1ernL10y7nIkzaBFqOwAXtp7/JJubNp9kuwLHAg8Msu1kiZIi1D5PnB0kiO7vslrGfRY7uv3XD4LuLmqqhtf2306dCRwNPC9BjVJGpOh2p7C4BxJkguAG4F9gCuq6s4klwBbqmoD8HngS0m2ATsZBA/dfv8A3AXsAt5fVc8OW5Ok8cngBcNkefHKZfWuq/xKyyS5e/Uz4y5Bc7C5buIXtTPzWTsxJ2olTQZDRVJThoqkpgwVSU0ZKpKaMlQkNWWoSGrKUJHUlKEiqSlDRVJThoqkpgwVSU0ZKpKaMlQkNWWoSGrKUJHUlKEiqSlDRVJTo2p7+sEkdyW5I8lNSQ7vzT2b5LbuNvUPZkuaMEP/4ete29N3MGgG9v0kG6rqrt5u/wGsrqonkrwP+CTw7m7uyapaNWwdkhaGkbQ9rapvV9UT3cNNDPr7SFqERtX2tO9c4Ibe4yVdO9NNSc6caZFtT6XJMPTbn7lI8vvAauAtveHDq2pHkqOAm5Nsrar7pq6tqvXAehi06BhJwZLmbFRtT0lyInARcHpVPb17vKp2dPfbgVuAYxvUJGlMRtL2NMmxwOcYBMrDvfGlSQ7otpcDxzPoVihpQo2q7elfAS8EvpIE4L+r6nTglcDnkvyKQcBdOuVTI0kTpsk5laq6Hrh+ytjFve0TZ1h3K3BMixokLQx+o1ZSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKZG1fb0nCQ/67U3Pa83ty7Jvd1tXYt6JI3PqNqeAlxbVRdMWXsw8FEGvYAK+EG39tFh65I0HiNpe7oHJwMbq2pnFyQbgVMa1CRpTFr8Nf3p2p6+fpr93pnkzcA9wAeq6oEZ1k7bMjXJ+cD5AEt4Afcc7+mgSXLjj28bdwmagzUnP7H3nWYwqv+Z3wCOqKpXM3g1cuVcn6Cq1lfV6qpavV+WNC9QUhsjaXtaVY/0Wp1eDrxutmslTZZRtT1d0Xt4OvCjbvtG4KSu/elS4KRuTNKEGlXb0z9NcjqwC9gJnNOt3Znk4wyCCeCSqto5bE2SxidVNe4a5uxFz1tWxx1w6rjL0Bx88/7N4y5Bc7Dm5AfYcvtTmc9aP0KR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqmpUbU9vazX8vSeJD/vzT3bm9swda2kyTKStqdV9YHe/n8CHNt7iieratWwdUhaGMbR9vRs4OoGP1fSAtQiVObSuvRw4Ejg5t7wkiRbkmxKcuZMPyTJ+d1+W56ppxqULem50KKX8lysBa6rqmd7Y4dX1Y4kRwE3J9laVfdNXVhV64H1MGjRMZpyJc3VSNqe9qxlylufqtrR3W8HbuHXz7dImjAjaXsKkOQVwFLgu72xpUkO6LaXA8cDd01dK2lyjKrtKQzC5pr69ZaIrwQ+l+RXDALu0v6nRpImT5NzKlV1PXD9lLGLpzz+2DTrbgWOaVGDpIXBb9RKaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdRUq7anVyR5OMkPZ5hPkk91bVHvSPLa3ty6JPd2t3Ut6pE0Pq1eqXwBOGUP86cCR3e384G/BUhyMPBR4PUMOh1+NMnSRjVJGoMmoVJV3wF27mGXM4Av1sAm4KAkK4CTgY1VtbOqHgU2sudwkrTAjapD4UytUefSMvV8Bq9yWMILnpsqJQ1tYk7UVtX6qlpdVav3y5JxlyNpBqMKlZlao86lZaqkCTCqUNkAvKf7FOg44LGqeohBV8OTuvanS4GTujFJE6rJOZUkVwMnAMuTPMjgE539AKrqswy6F54GbAOeAP6wm9uZ5OMM+jEDXFJVezrhK2mBa9X29Oy9zBfw/hnmrgCuaFGHpPGbmBO1kiaDoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpqVG1Pf29rt3p1iS3JnlNb+6/uvHbkmxpUY+k8RlV29P7gbdU1THAx4H1U+bfWlWrqmp1o3okjUmrP3z9nSRH7GH+1t7DTQz6+0hahMZxTuVc4Ibe4wL+NckPutamkibYqHopA5DkrQxC5U294TdV1Y4kLwY2JvnPruH71LX2UpYmwMheqSR5NXA5cEZVPbJ7vKp2dPcPA18F1ky33l7K0mQYSagk+V3gn4A/qKp7euO/leS3d28zaHs67SdIkibDqNqeXgwsAz6TBGBX90nPIcBXu7F9gb+vqm+2qEnSeIyq7el5wHnTjG8HXvObKyRNKr9RK6kpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKZG1Uv5hCSPdf2Sb0tycW/ulCR3J9mW5MIW9Ugan1H1Ugb4t65f8qqqugQgyT7Ap4FTgZXA2UlWNqpJ0hg0CZWuo+DOeSxdA2yrqu1V9UvgGuCMFjVJGo9Rtj19Q5LbgR8DH6qqO4HDgAd6+zwIvH66xf22p8DTG5/68mJsOrYc+J9xF/Fc2GfFoj22xXpcL5/vwlGFyr8Dh1fV40lOA74GHD2XJ6iq9cB6gCRbumZki8piPS5YvMe2mI9rvmtH8ulPVf2iqh7vtq8H9kuyHNgBvLS360u6MUkTalS9lA9N19s0yZru5z4CfB84OsmRSfYH1gIbRlGTpOfGqHopnwW8L8ku4ElgbVUVsCvJBcCNwD7AFd25lr1Z36LuBWixHhcs3mPzuKbI4P+2JLXhN2olNWWoSGpqIkIlycFJNia5t7tfOsN+z/YuBViwJ3z3dmlCkgOSXNvNb05yxOirnLtZHNc5SX7W+x2dN44652oWl6Ekyae6474jyWtHXeN8DHN5zR5V1YK/AZ8ELuy2LwQ+McN+j4+71lkcyz7AfcBRwP7A7cDKKfv8MfDZbnstcO246250XOcAfzPuWudxbG8GXgv8cIb504AbgADHAZvHXXOj4zoB+Oe5Pu9EvFJh8NX9K7vtK4Ezx1jLsGZzaUL/eK8D3r77I/kFbNFeclF7vwzlDOCLNbAJOCjJitFUN3+zOK55mZRQOaSqHuq2fwIcMsN+S5JsSbIpyUINnukuTThspn2qahfwGLBsJNXN32yOC+Cd3VuE65K8dJr5STTbY59Eb0hye5IbkrxqNgtGee3PHiX5FnDoNFMX9R9UVSWZ6XPww6tqR5KjgJuTbK2q+1rXqnn7BnB1VT2d5I8YvBp725hr0szmdXnNggmVqjpxprkkP02yoqoe6l5WPjzDc+zo7rcnuQU4lsH7/IVkNpcm7N7nwST7Agcy+AbyQrbX46qq/jFczuBc2WKwKC83qapf9LavT/KZJMurao8XUE7K258NwLpuex3w9ak7JFma5IBuezlwPHDXyCqcvdlcmtA/3rOAm6s7c7aA7fW4ppxnOB340Qjrey5tAN7TfQp0HPBY7+36xNrD5TV7Nu4z0LM8S70MuAm4F/gWcHA3vhq4vNt+I7CVwacOW4Fzx133Ho7nNOAeBq+iLurGLgFO77aXAF8BtgHfA44ad82NjusvgTu739G3gVeMu+ZZHtfVwEPAMwzOl5wLvBd4bzcfBn9s7L7u397qcdfc6Lgu6P2+NgFvnM3z+jV9SU1NytsfSRPCUJHUlKEiqSlDRVJThoqkpgwVSU0ZKpKa+j+OvrsMYqOrqAAAAABJRU5ErkJggg==\n",
      "text/plain": [
       "<Figure size 432x288 with 1 Axes>"
      ]
     },
     "metadata": {
      "needs_background": "light"
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "# Plot the confusion matrix\n",
    "cm = metrics.confusion_matrix(yTest, y_pred)\n",
    "print(cm)\n",
    "plt.imshow(cm)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 134,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "DecisionTreeClassifier Score 0.9886363636363636\n"
     ]
    }
   ],
   "source": [
    "rclf = DecisionTreeClassifier(max_depth=20, random_state=0)\n",
    "rclf.fit(xTrain, yTrain)\n",
    "score = str(rclf.score(xTest, yTest))\n",
    "print('DecisionTreeClassifier Score ' + score)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Lets evaluate result report of our DecisionTreeClassifier"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 135,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "             precision    recall  f1-score   support\n",
      "\n",
      "     benign       0.97      1.00      0.99        38\n",
      "    malware       1.00      0.98      0.99        50\n",
      "\n",
      "avg / total       0.99      0.99      0.99        88\n",
      "\n"
     ]
    }
   ],
   "source": [
    "y_pred = rclf.predict(xTest)\n",
    "dt_report = metrics.classification_report(yTest, y_pred, target_names=['benign', 'malware'])\n",
    "print(dt_report)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 136,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[[38  0]\n",
      " [ 1 49]]\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<matplotlib.image.AxesImage at 0x7fb754dcf710>"
      ]
     },
     "execution_count": 136,
     "metadata": {},
     "output_type": "execute_result"
    },
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAARUAAAD8CAYAAABZ0jAcAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADl0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uIDMuMC4wLCBodHRwOi8vbWF0cGxvdGxpYi5vcmcvqOYd8AAAD/lJREFUeJzt3X+sZGV9x/H3R36t1grLboUNWn5Eoq5BF92sKEZRkV9/AIlEl7R1aSBUK22isRFDggbbFO0fNKZa3SAVxQKVVl1bkK4gsQnu6toCK1hgWZrCimJZxFB+yOK3f8zZ5ni9d/feOw8zd27er2QyZ57nPHO/J3f3k5kzc+43VYUktfK8cRcgaXExVCQ1ZahIaspQkdSUoSKpKUNFUlNDhUqSg5NsTHJvd790hv2eTXJbd9vQGz8yyeYk25Jcm2T/YeqRNH7DvlK5ELipqo4GbuoeT+fJqlrV3U7vjX8CuKyqXgY8Cpw7ZD2SxizDfPktyd3ACVX1UJIVwC1V9fJp9nu8ql44ZSzAz4BDq2pXkjcAH6uqk+ddkKSx23fI9YdU1UPd9k+AQ2bYb0mSLcAu4NKq+hqwDPh5Ve3q9nkQOGymH5TkfOB8gH2fv8/rlh5x4JCla5Se+pHf3J4kT/G//LKeznzW7jVUknwLOHSaqYv6D6qqksz0L+fwqtqR5Cjg5iRbgcfmUmhVrQfWA7x45bJ611W+oJkkd69+ZtwlaA42103zXrvXUKmqE2eaS/LTJCt6b38enuE5dnT325PcAhwL/CNwUJJ9u1crLwF2zOMYJC0gw56o3QCs67bXAV+fukOSpUkO6LaXA8cDd9XgZM63gbP2tF7SZBk2VC4F3pHkXuDE7jFJVie5vNvnlcCWJLczCJFLq+qubu7DwAeTbGNwjuXzQ9YjacyGOlFbVY8Ab59mfAtwXrd9K3DMDOu3A2uGqUHSwuI3aiU1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIauo5b3uaZFWS7ya5M8kdSd7dm/tCkvt7LVFXDVOPpPEbRdvTJ4D3VNWrgFOAv05yUG/+z3otUW8bsh5JYzZsqJwBXNltXwmcOXWHqrqnqu7ttn/MoDfQ7wz5cyUtUMOGymzbngKQZA2wP3Bfb/gvurdFl+3uDyRpco2q7SldB8MvAeuq6lfd8EcYhNH+DFqafhi4ZIb1/99L+YWHvmBvZUsak5G0PU3yIuBfgIuqalPvuXe/ynk6yd8BH9pDHb/WS3lvdUsaj1G0Pd0f+Crwxaq6bsrciu4+DM7H/HDIeiSN2Sjanr4LeDNwzjQfHX85yVZgK7Ac+PMh65E0ZqNoe3oVcNUM6982zM+XtPD4jVpJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ11SRUkpyS5O4k25L8RuvTJAckubab35zkiN7cR7rxu5Oc3KIeSeMzdKgk2Qf4NHAqsBI4O8nKKbudCzxaVS8DLgM+0a1dCawFdvdZ/kz3fJImVItXKmuAbVW1vap+CVzDoMdyX7/n8nXA27teP2cA11TV01V1P7Ctez5JE6pFqBwGPNB7/GA3Nu0+VbULeAxYNsu1wKDtaZItSbY8+ehTDcqW9FyYmBO1VbW+qlZX1ernL10y7nIkzaBFqOwAXtp7/JJubNp9kuwLHAg8Msu1kiZIi1D5PnB0kiO7vslrGfRY7uv3XD4LuLmqqhtf2306dCRwNPC9BjVJGpOh2p7C4BxJkguAG4F9gCuq6s4klwBbqmoD8HngS0m2ATsZBA/dfv8A3AXsAt5fVc8OW5Ok8cngBcNkefHKZfWuq/xKyyS5e/Uz4y5Bc7C5buIXtTPzWTsxJ2olTQZDRVJThoqkpgwVSU0ZKpKaMlQkNWWoSGrKUJHUlKEiqSlDRVJThoqkpgwVSU0ZKpKaMlQkNWWoSGrKUJHUlKEiqSlDRVJTo2p7+sEkdyW5I8lNSQ7vzT2b5LbuNvUPZkuaMEP/4ete29N3MGgG9v0kG6rqrt5u/wGsrqonkrwP+CTw7m7uyapaNWwdkhaGkbQ9rapvV9UT3cNNDPr7SFqERtX2tO9c4Ibe4yVdO9NNSc6caZFtT6XJMPTbn7lI8vvAauAtveHDq2pHkqOAm5Nsrar7pq6tqvXAehi06BhJwZLmbFRtT0lyInARcHpVPb17vKp2dPfbgVuAYxvUJGlMRtL2NMmxwOcYBMrDvfGlSQ7otpcDxzPoVihpQo2q7elfAS8EvpIE4L+r6nTglcDnkvyKQcBdOuVTI0kTpsk5laq6Hrh+ytjFve0TZ1h3K3BMixokLQx+o1ZSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKZG1fb0nCQ/67U3Pa83ty7Jvd1tXYt6JI3PqNqeAlxbVRdMWXsw8FEGvYAK+EG39tFh65I0HiNpe7oHJwMbq2pnFyQbgVMa1CRpTFr8Nf3p2p6+fpr93pnkzcA9wAeq6oEZ1k7bMjXJ+cD5AEt4Afcc7+mgSXLjj28bdwmagzUnP7H3nWYwqv+Z3wCOqKpXM3g1cuVcn6Cq1lfV6qpavV+WNC9QUhsjaXtaVY/0Wp1eDrxutmslTZZRtT1d0Xt4OvCjbvtG4KSu/elS4KRuTNKEGlXb0z9NcjqwC9gJnNOt3Znk4wyCCeCSqto5bE2SxidVNe4a5uxFz1tWxx1w6rjL0Bx88/7N4y5Bc7Dm5AfYcvtTmc9aP0KR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqmpUbU9vazX8vSeJD/vzT3bm9swda2kyTKStqdV9YHe/n8CHNt7iieratWwdUhaGMbR9vRs4OoGP1fSAtQiVObSuvRw4Ejg5t7wkiRbkmxKcuZMPyTJ+d1+W56ppxqULem50KKX8lysBa6rqmd7Y4dX1Y4kRwE3J9laVfdNXVhV64H1MGjRMZpyJc3VSNqe9qxlylufqtrR3W8HbuHXz7dImjAjaXsKkOQVwFLgu72xpUkO6LaXA8cDd01dK2lyjKrtKQzC5pr69ZaIrwQ+l+RXDALu0v6nRpImT5NzKlV1PXD9lLGLpzz+2DTrbgWOaVGDpIXBb9RKaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdRUq7anVyR5OMkPZ5hPkk91bVHvSPLa3ty6JPd2t3Ut6pE0Pq1eqXwBOGUP86cCR3e384G/BUhyMPBR4PUMOh1+NMnSRjVJGoMmoVJV3wF27mGXM4Av1sAm4KAkK4CTgY1VtbOqHgU2sudwkrTAjapD4UytUefSMvV8Bq9yWMILnpsqJQ1tYk7UVtX6qlpdVav3y5JxlyNpBqMKlZlao86lZaqkCTCqUNkAvKf7FOg44LGqeohBV8OTuvanS4GTujFJE6rJOZUkVwMnAMuTPMjgE539AKrqswy6F54GbAOeAP6wm9uZ5OMM+jEDXFJVezrhK2mBa9X29Oy9zBfw/hnmrgCuaFGHpPGbmBO1kiaDoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpqVG1Pf29rt3p1iS3JnlNb+6/uvHbkmxpUY+k8RlV29P7gbdU1THAx4H1U+bfWlWrqmp1o3okjUmrP3z9nSRH7GH+1t7DTQz6+0hahMZxTuVc4Ibe4wL+NckPutamkibYqHopA5DkrQxC5U294TdV1Y4kLwY2JvnPruH71LX2UpYmwMheqSR5NXA5cEZVPbJ7vKp2dPcPA18F1ky33l7K0mQYSagk+V3gn4A/qKp7euO/leS3d28zaHs67SdIkibDqNqeXgwsAz6TBGBX90nPIcBXu7F9gb+vqm+2qEnSeIyq7el5wHnTjG8HXvObKyRNKr9RK6kpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKZG1Uv5hCSPdf2Sb0tycW/ulCR3J9mW5MIW9Ugan1H1Ugb4t65f8qqqugQgyT7Ap4FTgZXA2UlWNqpJ0hg0CZWuo+DOeSxdA2yrqu1V9UvgGuCMFjVJGo9Rtj19Q5LbgR8DH6qqO4HDgAd6+zwIvH66xf22p8DTG5/68mJsOrYc+J9xF/Fc2GfFoj22xXpcL5/vwlGFyr8Dh1fV40lOA74GHD2XJ6iq9cB6gCRbumZki8piPS5YvMe2mI9rvmtH8ulPVf2iqh7vtq8H9kuyHNgBvLS360u6MUkTalS9lA9N19s0yZru5z4CfB84OsmRSfYH1gIbRlGTpOfGqHopnwW8L8ku4ElgbVUVsCvJBcCNwD7AFd25lr1Z36LuBWixHhcs3mPzuKbI4P+2JLXhN2olNWWoSGpqIkIlycFJNia5t7tfOsN+z/YuBViwJ3z3dmlCkgOSXNvNb05yxOirnLtZHNc5SX7W+x2dN44652oWl6Ekyae6474jyWtHXeN8DHN5zR5V1YK/AZ8ELuy2LwQ+McN+j4+71lkcyz7AfcBRwP7A7cDKKfv8MfDZbnstcO246250XOcAfzPuWudxbG8GXgv8cIb504AbgADHAZvHXXOj4zoB+Oe5Pu9EvFJh8NX9K7vtK4Ezx1jLsGZzaUL/eK8D3r77I/kFbNFeclF7vwzlDOCLNbAJOCjJitFUN3+zOK55mZRQOaSqHuq2fwIcMsN+S5JsSbIpyUINnukuTThspn2qahfwGLBsJNXN32yOC+Cd3VuE65K8dJr5STTbY59Eb0hye5IbkrxqNgtGee3PHiX5FnDoNFMX9R9UVSWZ6XPww6tqR5KjgJuTbK2q+1rXqnn7BnB1VT2d5I8YvBp725hr0szmdXnNggmVqjpxprkkP02yoqoe6l5WPjzDc+zo7rcnuQU4lsH7/IVkNpcm7N7nwST7Agcy+AbyQrbX46qq/jFczuBc2WKwKC83qapf9LavT/KZJMurao8XUE7K258NwLpuex3w9ak7JFma5IBuezlwPHDXyCqcvdlcmtA/3rOAm6s7c7aA7fW4ppxnOB340Qjrey5tAN7TfQp0HPBY7+36xNrD5TV7Nu4z0LM8S70MuAm4F/gWcHA3vhq4vNt+I7CVwacOW4Fzx133Ho7nNOAeBq+iLurGLgFO77aXAF8BtgHfA44ad82NjusvgTu739G3gVeMu+ZZHtfVwEPAMwzOl5wLvBd4bzcfBn9s7L7u397qcdfc6Lgu6P2+NgFvnM3z+jV9SU1NytsfSRPCUJHUlKEiqSlDRVJThoqkpgwVSU0ZKpKa+j+OvrsMYqOrqAAAAABJRU5ErkJggg==\n",
      "text/plain": [
       "<Figure size 432x288 with 1 Axes>"
      ]
     },
     "metadata": {
      "needs_background": "light"
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "# Plot the confusion matrix\n",
    "cm = metrics.confusion_matrix(yTest, y_pred)\n",
    "print(cm)\n",
    "plt.imshow(cm)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now let combine all the classifiers into VotingClassifier for robustness in the production to detect malware apk correctly."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 137,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "VotingClassifier Score 1.0\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/usr/local/lib/python3.5/dist-packages/sklearn/preprocessing/label.py:151: DeprecationWarning: The truth value of an empty array is ambiguous. Returning False, but in future this will result in an error. Use `array.size > 0` to check that an array is not empty.\n",
      "  if diff:\n"
     ]
    }
   ],
   "source": [
    "eclf2 = VotingClassifier(estimators=[('svc', svc), ('adaboost', clf), ('rf', rclf)], voting='soft')\n",
    "eclf2.fit(X, y)\n",
    "score = str(eclf2.score(xTest, yTest))\n",
    "print('VotingClassifier Score ' + score)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Lets evaluate result report of our VotingClassifier"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 138,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "             precision    recall  f1-score   support\n",
      "\n",
      "     benign       1.00      1.00      1.00        38\n",
      "    malware       1.00      1.00      1.00        50\n",
      "\n",
      "avg / total       1.00      1.00      1.00        88\n",
      "\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/usr/local/lib/python3.5/dist-packages/sklearn/preprocessing/label.py:151: DeprecationWarning: The truth value of an empty array is ambiguous. Returning False, but in future this will result in an error. Use `array.size > 0` to check that an array is not empty.\n",
      "  if diff:\n"
     ]
    }
   ],
   "source": [
    "y_pred = eclf2.predict(xTest)\n",
    "vote_report = metrics.classification_report(yTest, y_pred, target_names=['benign', 'malware'])\n",
    "print(vote_report)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 139,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[[38  0]\n",
      " [ 0 50]]\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<matplotlib.image.AxesImage at 0x7fb754c90da0>"
      ]
     },
     "execution_count": 139,
     "metadata": {},
     "output_type": "execute_result"
    },
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAARUAAAD8CAYAAABZ0jAcAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADl0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uIDMuMC4wLCBodHRwOi8vbWF0cGxvdGxpYi5vcmcvqOYd8AAAD/hJREFUeJzt3X+s3XV9x/HnaxTaqRMK3aBBVyASBYOCNkXFKAryK4aSSGbJNssC6XSyJRoXMSRocMvQ/cFiptMGmaAbMNnUusEYPyQuwaJ1AyootNQFqCiOIoZfxeJ7f5xvl+P1nvbeez6cc8/N85HcnO/5fL6fc9/fFF75nu853/tOVSFJrfzGuAuQtLAYKpKaMlQkNWWoSGrKUJHUlKEiqamhQiXJgUluSrKle1w6YL/nk9zZ/WzoGz88yR1Jtia5Nsl+w9QjafyGPVO5ELilqo4EbumeT+eZqjq2+zmzb/wTwGVV9QrgceC8IeuRNGYZ5stvSe4DTqyqR5IsB26rqldOs9+TVfWSKWMBfgocUlW7krwR+FhVnTrngiSN3aIh1x9cVY902z8GDh6w35Ikm4BdwKVV9VXgIOBnVbWr2+dh4NBBvyjJOmAdwKLfXPT6/VfsP2TpGqXnfvDLcZegWXiWp3iudmYua/caKkluBg6ZZuqi/idVVUkGnfasqKrtSY4Abk2yGXhiNoVW1XpgPcCyo5bV6qveOZvlGrMHj39q3CVoFu6oW+a8dq+hUlUnD5pL8pMky/ve/jw64DW2d4/bktwGHAf8M3BAkkXd2crLgO1zOAZJ88iwF2o3AGu77bXA16bukGRpksXd9jLgBODe6l3M+QZw9p7WS5osw4bKpcA7kmwBTu6ek2Rlksu7fY4CNiW5i16IXFpV93ZzHwY+mGQrvWssnx+yHkljNtSF2qp6DDhpmvFNwPnd9u3AMQPWbwNWDVODpPnFb9RKaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdTUC972NMmxSb6V5J4kdyd5d9/cF5L8sK8l6rHD1CNp/EbR9vRp4D1V9WrgNOBvkhzQN//nfS1R7xyyHkljNmyorAau7LavBM6aukNV3V9VW7rtH9HrDfTbQ/5eSfPUsKEy07anACRZBewHPNA3/Jfd26LLdvcHkjS5RtX2lK6D4ReBtVW1u7HuR+iF0X70Wpp+GLhkwPr/76X84kNevLeyJY3JSNqeJnkp8G/ARVW1se+1d5/l7Ezy98CH9lDHr/RS3lvdksZjFG1P9wO+AlxVVddNmVvePYbe9ZjvDVmPpDEbRdvT3wPeApw7zUfH/5BkM7AZWAb8xZD1SBqzUbQ9/RLwpQHr3z7M75c0//iNWklNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDXVJFSSnJbkviRbk/xa69Mki5Nc283fkeSwvrmPdOP3JTm1RT2SxmfoUEmyD/Bp4HTgaOCcJEdP2e084PGqegVwGfCJbu3RwBpgd5/lz3SvJ2lCtThTWQVsraptVfUccA29Hsv9+nsuXwec1PX6WQ1cU1U7q+qHwNbu9SRNqBahcijwUN/zh7uxafepql3AE8BBM1wL9NqeJtmUZNOzP3u2QdmSXggTc6G2qtZX1cqqWrnkgCXjLkfSAC1CZTvw8r7nL+vGpt0nySJgf+CxGa6VNEFahMp3gCOTHN71TV5Dr8dyv/6ey2cDt1ZVdeNruk+HDgeOBL7doCZJYzJU21PoXSNJcgFwI7APcEVV3ZPkEmBTVW0APg98MclWYAe94KHb75+Ae4FdwPur6vlha5I0PumdMEyWZUctq9VXvXPcZWgWHjz+qXGXoFm4o27h57Ujc1k7MRdqJU0GQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU6Nqe/rBJPcmuTvJLUlW9M09n+TO7mfqH8yWNGGG/sPXfW1P30GvGdh3kmyoqnv7dvtvYGVVPZ3kfcAngXd3c89U1bHD1iFpfhhJ29Oq+kZVPd093Uivv4+kBWhUbU/7nQfc0Pd8SdfOdGOSswYtsu2pNBmGfvszG0n+AFgJvLVveEVVbU9yBHBrks1V9cDUtVW1HlgPvRYdIylY0qyNqu0pSU4GLgLOrKqdu8eranv3uA24DTiuQU2SxmQkbU+THAd8jl6gPNo3vjTJ4m57GXACvW6FkibUqNqe/jXwEuDLSQAerKozgaOAzyX5Jb2Au3TKp0aSJkyTaypVdT1w/ZSxi/u2Tx6w7nbgmBY1SJof/EatpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNjart6blJftrX3vT8vrm1SbZ0P2tb1CNpfEbV9hTg2qq6YMraA4GP0usFVMB3u7WPD1uXpPEYSdvTPTgVuKmqdnRBchNwWoOaJI1Ji7+mP13b0+On2e9dSd4C3A98oKoeGrB22papSdYB6wCW8CIePP6pBqVrVG780Z3jLkGzsOrUp/e+0wCjulD7deCwqnoNvbORK2f7AlW1vqpWVtXKfVncvEBJbYyk7WlVPdbX6vRy4PUzXStpsoyq7enyvqdnAt/vtm8ETunany4FTunGJE2oUbU9/bMkZwK7gB3Aud3aHUk+Ti+YAC6pqh3D1iRpfFJV465h1l6aA+v4nDTuMjQLXqidLKtOfYhNdz2buaz1G7WSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDU1qranl/W1PL0/yc/65p7vm9swda2kyTKStqdV9YG+/f8UOK7vJZ6pqmOHrUPS/DCOtqfnAFc3+L2S5qEWoTKb1qUrgMOBW/uGlyTZlGRjkrMG/ZIk67r9Nv2CnYN2kzRmLXopz8Ya4Lqqer5vbEVVbU9yBHBrks1V9cDUhVW1HlgPvRYdoylX0myNpO1pnzVMeetTVdu7x23Abfzq9RZJE2YkbU8BkrwKWAp8q29saZLF3fYy4ATg3qlrJU2OUbU9hV7YXFO/2hLxKOBzSX5JL+Au7f/USNLkaXJNpaquB66fMnbxlOcfm2bd7cAxLWqQND/4jVpJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkpoyVCQ1ZahIaspQkdSUoSKpKUNFUlOGiqSmDBVJTRkqkppq1fb0iiSPJvnegPkk+VTXFvXuJK/rm1ubZEv3s7ZFPZLGp9WZyheA0/YwfzpwZPezDvg7gCQHAh8FjqfX6fCjSZY2qknSGDQJlar6JrBjD7usBq6qno3AAUmWA6cCN1XVjqp6HLiJPYeTpHluVB0KB7VGnU3L1HX0znJYwotemColDW1iLtRW1fqqWllVK/dl8bjLkTTAqEJlUGvU2bRMlTQBRhUqG4D3dJ8CvQF4oqoeodfV8JSu/elS4JRuTNKEanJNJcnVwInAsiQP0/tEZ1+Aqvosve6FZwBbgaeBP+rmdiT5OL1+zACXVNWeLvhKmudatT09Zy/zBbx/wNwVwBUt6pA0fhNzoVbSZDBUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKYMFUlNGSqSmjJUJDU1qranv9+1O92c5PYkr+2b+59u/M4km1rUI2l8RtX29IfAW6vqGODjwPop82+rqmOramWjeiSNSas/fP3NJIftYf72vqcb6fX3kbQAjeOaynnADX3PC/iPJN/tWptKmmCj6qUMQJK30QuVN/cNv7mqtif5HeCmJD/oGr5PXWsvZWkCjOxMJclrgMuB1VX12O7xqtrePT4KfAVYNd16eylLk2EkoZLkd4F/Af6wqu7vG39xkt/avU2v7em0nyBJmgyjant6MXAQ8JkkALu6T3oOBr7SjS0C/rGq/r1FTZLGY1RtT88Hzp9mfBvw2l9fIWlS+Y1aSU0ZKpKaMlQkNWWoSGrKUJHUlKEiqSlDRVJThoqkpgwVSU0ZKpKaMlQkNWWoSGrKUJHUlKEiqSlDRVJThoqkpgwVSU0ZKpKaMlQkNTWqXsonJnmi65d8Z5KL++ZOS3Jfkq1JLmxRj6TxGVUvZYD/7PolH1tVlwAk2Qf4NHA6cDRwTpKjG9UkaQyahErXUXDHHJauArZW1baqeg64BljdoiZJ4zHKtqdvTHIX8CPgQ1V1D3Ao8FDfPg8Dx0+3uL/tKbDz5rpuITYdWwb877iLeCHss3zBHttCPa5XznXhqELlv4AVVfVkkjOArwJHzuYFqmo9sB4gyaauGdmCslCPCxbusS3k45rr2pF8+lNVP6+qJ7vt64F9kywDtgMv79v1Zd2YpAk1ql7Kh6TrbZpkVfd7HwO+AxyZ5PAk+wFrgA2jqEnSC2NUvZTPBt6XZBfwDLCmqgrYleQC4EZgH+CK7lrL3qxvUfc8tFCPCxbusXlcU6T3/7YkteE3aiU1ZahIamoiQiXJgUluSrKle1w6YL/n+24FmLcXfPd2a0KSxUmu7ebvSHLY6KucvRkc17lJftr3b3T+OOqcrRnchpIkn+qO++4krxt1jXMxzO01e1RV8/4H+CRwYbd9IfCJAfs9Oe5aZ3As+wAPAEcA+wF3AUdP2edPgM9222uAa8ddd6PjOhf423HXOodjewvwOuB7A+bPAG4AArwBuGPcNTc6rhOBf53t607EmQq9r+5f2W1fCZw1xlqGNZNbE/qP9zrgpN0fyc9jC/aWi9r7bSirgauqZyNwQJLlo6lu7mZwXHMyKaFycFU90m3/GDh4wH5LkmxKsjHJfA2e6W5NOHTQPlW1C3gCOGgk1c3dTI4L4F3dW4Trkrx8mvlJNNNjn0RvTHJXkhuSvHomC0Z5788eJbkZOGSaqYv6n1RVJRn0OfiKqtqe5Ajg1iSbq+qB1rVqzr4OXF1VO5P8Mb2zsbePuSYNNqfba+ZNqFTVyYPmkvwkyfKqeqQ7rXx0wGts7x63JbkNOI7e+/z5ZCa3Juze5+Eki4D96X0DeT7b63FVVf8xXE7vWtlCsCBvN6mqn/dtX5/kM0mWVdUeb6CclLc/G4C13fZa4GtTd0iyNMnibnsZcAJw78gqnLmZ3JrQf7xnA7dWd+VsHtvrcU25znAm8P0R1vdC2gC8p/sU6A3AE31v1yfWHm6v2bNxX4Ge4VXqg4BbgC3AzcCB3fhK4PJu+03AZnqfOmwGzht33Xs4njOA++mdRV3UjV0CnNltLwG+DGwFvg0cMe6aGx3XXwH3dP9G3wBeNe6aZ3hcVwOPAL+gd73kPOC9wHu7+dD7Y2MPdP/trRx3zY2O64K+f6+NwJtm8rp+TV9SU5Py9kfShDBUJDVlqEhqylCR1JShIqkpQ0VSU4aKpKb+D0Qtuwq6y5hGAAAAAElFTkSuQmCC\n",
      "text/plain": [
       "<Figure size 432x288 with 1 Axes>"
      ]
     },
     "metadata": {
      "needs_background": "light"
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "# Plot the confusion matrix\n",
    "cm = metrics.confusion_matrix(yTest, y_pred)\n",
    "print(cm)\n",
    "plt.imshow(cm)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The confusion matrix above also says that by combining all the 3 classifiers it classifies 38 out of 38 of benign and 50 out of 50 of malware and achievieng 100% accuracy.\n",
    "\n",
    "finally storing the trained classifier into file storage."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 140,
   "metadata": {},
   "outputs": [],
   "source": [
    "import pickle\n",
    "\n",
    "# save the model to disk\n",
    "filename = 'classifier.dat'\n",
    "pickle.dump(eclf2, open(filename, 'wb'))\n"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.5.2"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}