A confusion matrix cross-tabulates actual classes against predicted classes, making correct and incorrect classification outcomes visible. section 12.4.1
Read the cells to understand where a classifier succeeds or fails:
- Rows show actual labels; columns show predicted labels. section 12.4.1
- Diagonal cells show correct predictions; off-diagonal cells show misclassifications, including false positives and false negatives. section 12.5.1
- In threat detection, many threats classified as normal may signal a security concern. section 12.5.1
Cybersecurity classifications
For news articles labeled high- or low-risk, the matrix shows how often each actual category receives each prediction. For network traffic classified as normal or threatening, it reveals missed threats as well as false alarms. section 12.4.1 section 12.5.1
Listing 12.4 NLP exercise
# Import required libraries
import pandas as pd #1
from sklearn.feature_extraction.text import #1
TfidfVectorizer #1
from sklearn.model_selection import train_test_split #1
from sklearn.linear_model import LogisticRegression #1
from sklearn.metrics import classification_report, #1
confusion_matrix #1
import seaborn as sns #1
import matplotlib.pyplot as plt #1
#1
# Step 1: Generate a balanced dataset #1
data = { #2
'Article': [ #2
"Ransomware targets financial institutions", #2
"Security patch released for major software vulnerability", #2
"Hackers steal millions of customer data in breach", #2
"Low-risk malware detected in corporate emails", #2
"Phishing campaign aims to steal credentials", #2
"Database vulnerability in hospital systems", #2
"Encryption policies updated to prevent breaches", #2
"Zero-day vulnerability in common software", #2
"Mandatory security training after an attack", #2
"Phishing attacks target large organizations" #2
] * 2, # Duplicate entries to balance classes #2
'Label': ['high-risk', 'low-risk', 'high-risk', #2
'low-risk', 'high-risk', #2
'low-risk', 'low-risk', 'high-risk', 'low-risk',
'high-risk'] * 2 # Balanced labels
}
df = pd.DataFrame(data) #3
# Step 2: Convert labels to numeric
df['Label'] = df['Label'].apply(lambda x:
1 if x == 'high-risk' else 0) #4
# Step 3: Split data into training and testing sets
X_train, X_test, y_train, y_test = train_test_split(
df['Article'], df['Label'], test_size=0.3,
random_state=42) #5
# Step 4: Apply TF-IDF and Logistic Regression
vectorizer = TfidfVectorizer(stop_words='english') #6
X_train_tfidf = vectorizer.fit_transform(X_train) #7
X_test_tfidf = vectorizer.transform(X_test) #7
model = LogisticRegression() #8
model.fit(X_train_tfidf, y_train) #8
# Step 5: Make predictions
y_pred = model.predict(X_test_tfidf) #9
# Step 6: Evaluate the model
print("Classification Report:\n",
classification_report(y_test, y_pred)) #10
conf_matrix = confusion_matrix(y_test, y_pred) #11
# Step 7: Plot the confusion matrix (Grayscale)
plt.figure(figsize=(6, 4)) #12
sns.heatmap(conf_matrix, annot=True, cmap='Greys', #12
fmt='d', #12
xticklabels=['Low-Risk', 'High-Risk'], #12
yticklabels=['Low-Risk', 'High-Risk']) #12
plt.title('Confusion Matrix (Grayscale)') #12
plt.xlabel('Predicted Labels') #12
plt.ylabel('True Labels') #12
plt.show() #12
Explore the NLP exercise that classifies cybersecurity articles and produces a confusion matrix alongside a classification report. section 12.4.1
Listing 12.5 Using neural networks to classify network traffic data
# Import required libraries
import pandas as pd #1
import numpy as np #1
import tensorflow as tf #1
from tensorflow.keras.layers import Input, Dense #1
from tensorflow.keras.models import Sequential #1
from sklearn.model_selection import train_test_split #1
from sklearn.preprocessing import StandardScaler #1
from sklearn.metrics import classification_report, #1
confusion_matrix #1
import matplotlib.pyplot as plt #1
import seaborn as sns #1
#1
# Step 1: Generate synthetic network traffic data #1
np.random.seed(42) #2
data = { #3
'Packet_Size': np.random.randint(50, 1500, size=1000), #3
'Connection_Duration': np.random.uniform(0.1, #3
10.0, size=1000), #3
'Protocol_Type': np.random.choice( #3
[0, 1, 2], size=1000), #3
'Threat': np.random.choice( #3
[0, 1], size=1000, p=[0.7, 0.3]) #3
} #3
df = pd.DataFrame(data) #4
# Step 2: Split data into features and labels
X = df.drop(columns=['Threat']) #5
y = df['Threat'] #5
# Step 3: Preprocess the data
scaler = StandardScaler() #6
X_scaled = scaler.fit_transform(X) #6
X_train, X_test, y_train, y_test = train_test_split(
X_scaled, y, test_size=0.2, random_state=42) #7
# Step 4: Define the neural network
model = Sequential([ #8
Input(shape=(X_train.shape[1],)), #8
Dense(64, activation='relu'), #8
Dense(32, activation='relu'), #8
Dense(1, activation='sigmoid') #8
]) #8
# Step 5: Compile the model
model.compile(optimizer='adam',
loss='binary_crossentropy',
metrics=['accuracy']) #9
# Step 6: Train the model
history = model.fit(X_train, y_train, epochs=20,
batch_size=32,
validation_data=(X_test, y_test),
verbose=0) #10
# Step 7: Evaluate the model
y_pred = (model.predict(X_test) > 0.5).astype(int) #11
print(classification_report( #11
y_test, y_pred, zero_division=1)) #11
# Step 8: Plot the confusion matrix
conf_matrix = confusion_matrix(y_test, y_pred) #12
plt.figure(figsize=(8, 6)) #12
sns.heatmap(conf_matrix, annot=True, fmt='d', #12
cmap='Greys', xticklabels=['Normal', 'Threat'], #12
yticklabels=['Normal', 'Threat']) #12
plt.title('Confusion Matrix') #12
plt.xlabel('Predicted Labels') #12
plt.ylabel('True Labels') #12
plt.show() #12
Explore the neural-network workflow for classifying network traffic and evaluating its predictions. section 12.5.1
