tutorial.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "c42ebe99",
   "metadata": {},
   "outputs": [],
   "source": [
    "###load example training data\n",
    "\n",
    "import pandas as pd\n",
    "import zipfile\n",
    "\n",
    "z_tr = zipfile.ZipFile('./data/SWaT_train.zip', \"r\")\n",
    "f_tr = z_tr.open(z_tr.namelist()[0])\n",
    "train_df=pd.read_csv(f_tr)\n",
    "f_tr.close()\n",
    "z_tr.close()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "7eaade4c",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Timestamp</th>\n",
       "      <th>FIT101</th>\n",
       "      <th>LIT101</th>\n",
       "      <th>MV101</th>\n",
       "      <th>P101</th>\n",
       "      <th>P102</th>\n",
       "      <th>AIT201</th>\n",
       "      <th>AIT202</th>\n",
       "      <th>AIT203</th>\n",
       "      <th>FIT201</th>\n",
       "      <th>...</th>\n",
       "      <th>P501</th>\n",
       "      <th>P502</th>\n",
       "      <th>PIT501</th>\n",
       "      <th>PIT502</th>\n",
       "      <th>PIT503</th>\n",
       "      <th>FIT601</th>\n",
       "      <th>P601</th>\n",
       "      <th>P602</th>\n",
       "      <th>P603</th>\n",
       "      <th>Normal/Attack</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>22/12/2015 4:00:00 PM</td>\n",
       "      <td>2.470294</td>\n",
       "      <td>261.5804</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>244.3284</td>\n",
       "      <td>8.19008</td>\n",
       "      <td>306.1010</td>\n",
       "      <td>2.471278</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>10.02948</td>\n",
       "      <td>0.0</td>\n",
       "      <td>4.277749</td>\n",
       "      <td>0.000256</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>Normal</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>22/12/2015 4:00:05 PM</td>\n",
       "      <td>2.425456</td>\n",
       "      <td>260.0495</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>244.5847</td>\n",
       "      <td>8.19008</td>\n",
       "      <td>306.1010</td>\n",
       "      <td>2.465127</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>10.02948</td>\n",
       "      <td>0.0</td>\n",
       "      <td>4.277749</td>\n",
       "      <td>0.000256</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>Normal</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>22/12/2015 4:00:10 PM</td>\n",
       "      <td>2.630753</td>\n",
       "      <td>261.7766</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>244.8090</td>\n",
       "      <td>8.19008</td>\n",
       "      <td>306.1010</td>\n",
       "      <td>2.470894</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>10.02948</td>\n",
       "      <td>0.0</td>\n",
       "      <td>4.277749</td>\n",
       "      <td>0.000256</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>Normal</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>22/12/2015 4:00:15 PM</td>\n",
       "      <td>2.616020</td>\n",
       "      <td>260.8346</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>245.0333</td>\n",
       "      <td>8.19008</td>\n",
       "      <td>305.8703</td>\n",
       "      <td>2.474097</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>10.02948</td>\n",
       "      <td>0.0</td>\n",
       "      <td>4.277749</td>\n",
       "      <td>0.000256</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>Normal</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>22/12/2015 4:00:20 PM</td>\n",
       "      <td>2.556769</td>\n",
       "      <td>261.6589</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>245.4499</td>\n",
       "      <td>8.19008</td>\n",
       "      <td>305.8703</td>\n",
       "      <td>2.471663</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>10.02948</td>\n",
       "      <td>0.0</td>\n",
       "      <td>4.277749</td>\n",
       "      <td>0.000256</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>Normal</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 53 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "               Timestamp    FIT101    LIT101  MV101  P101  P102    AIT201  \\\n",
       "0  22/12/2015 4:00:00 PM  2.470294  261.5804      2     2     1  244.3284   \n",
       "1  22/12/2015 4:00:05 PM  2.425456  260.0495      2     2     1  244.5847   \n",
       "2  22/12/2015 4:00:10 PM  2.630753  261.7766      2     2     1  244.8090   \n",
       "3  22/12/2015 4:00:15 PM  2.616020  260.8346      2     2     1  245.0333   \n",
       "4  22/12/2015 4:00:20 PM  2.556769  261.6589      2     2     1  245.4499   \n",
       "\n",
       "    AIT202    AIT203    FIT201  ...  P501  P502    PIT501  PIT502    PIT503  \\\n",
       "0  8.19008  306.1010  2.471278  ...     1     1  10.02948     0.0  4.277749   \n",
       "1  8.19008  306.1010  2.465127  ...     1     1  10.02948     0.0  4.277749   \n",
       "2  8.19008  306.1010  2.470894  ...     1     1  10.02948     0.0  4.277749   \n",
       "3  8.19008  305.8703  2.474097  ...     1     1  10.02948     0.0  4.277749   \n",
       "4  8.19008  305.8703  2.471663  ...     1     1  10.02948     0.0  4.277749   \n",
       "\n",
       "     FIT601  P601  P602  P603  Normal/Attack  \n",
       "0  0.000256     1     1     1         Normal  \n",
       "1  0.000256     1     1     1         Normal  \n",
       "2  0.000256     1     1     1         Normal  \n",
       "3  0.000256     1     1     1         Normal  \n",
       "4  0.000256     1     1     1         Normal  \n",
       "\n",
       "[5 rows x 53 columns]"
      ]
     },
     "execution_count": 2,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "train_df.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "a5314517",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>FIT101</th>\n",
       "      <th>LIT101</th>\n",
       "      <th>MV101</th>\n",
       "      <th>P101</th>\n",
       "      <th>P102</th>\n",
       "      <th>AIT201</th>\n",
       "      <th>AIT202</th>\n",
       "      <th>AIT203</th>\n",
       "      <th>FIT201</th>\n",
       "      <th>MV201</th>\n",
       "      <th>...</th>\n",
       "      <th>FIT504</th>\n",
       "      <th>P501</th>\n",
       "      <th>P502</th>\n",
       "      <th>PIT501</th>\n",
       "      <th>PIT502</th>\n",
       "      <th>PIT503</th>\n",
       "      <th>FIT601</th>\n",
       "      <th>P601</th>\n",
       "      <th>P602</th>\n",
       "      <th>P603</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2.470294</td>\n",
       "      <td>261.5804</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>244.3284</td>\n",
       "      <td>8.19008</td>\n",
       "      <td>306.1010</td>\n",
       "      <td>2.471278</td>\n",
       "      <td>2</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>10.02948</td>\n",
       "      <td>0.0</td>\n",
       "      <td>4.277749</td>\n",
       "      <td>0.000256</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>2.425456</td>\n",
       "      <td>260.0495</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>244.5847</td>\n",
       "      <td>8.19008</td>\n",
       "      <td>306.1010</td>\n",
       "      <td>2.465127</td>\n",
       "      <td>2</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>10.02948</td>\n",
       "      <td>0.0</td>\n",
       "      <td>4.277749</td>\n",
       "      <td>0.000256</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>2.630753</td>\n",
       "      <td>261.7766</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>244.8090</td>\n",
       "      <td>8.19008</td>\n",
       "      <td>306.1010</td>\n",
       "      <td>2.470894</td>\n",
       "      <td>2</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>10.02948</td>\n",
       "      <td>0.0</td>\n",
       "      <td>4.277749</td>\n",
       "      <td>0.000256</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>2.616020</td>\n",
       "      <td>260.8346</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>245.0333</td>\n",
       "      <td>8.19008</td>\n",
       "      <td>305.8703</td>\n",
       "      <td>2.474097</td>\n",
       "      <td>2</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>10.02948</td>\n",
       "      <td>0.0</td>\n",
       "      <td>4.277749</td>\n",
       "      <td>0.000256</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>2.556769</td>\n",
       "      <td>261.6589</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>245.4499</td>\n",
       "      <td>8.19008</td>\n",
       "      <td>305.8703</td>\n",
       "      <td>2.471663</td>\n",
       "      <td>2</td>\n",
       "      <td>...</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>10.02948</td>\n",
       "      <td>0.0</td>\n",
       "      <td>4.277749</td>\n",
       "      <td>0.000256</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 51 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "     FIT101    LIT101  MV101  P101  P102    AIT201   AIT202    AIT203  \\\n",
       "0  2.470294  261.5804      2     2     1  244.3284  8.19008  306.1010   \n",
       "1  2.425456  260.0495      2     2     1  244.5847  8.19008  306.1010   \n",
       "2  2.630753  261.7766      2     2     1  244.8090  8.19008  306.1010   \n",
       "3  2.616020  260.8346      2     2     1  245.0333  8.19008  305.8703   \n",
       "4  2.556769  261.6589      2     2     1  245.4499  8.19008  305.8703   \n",
       "\n",
       "     FIT201  MV201  ...  FIT504  P501  P502    PIT501  PIT502    PIT503  \\\n",
       "0  2.471278      2  ...     0.0     1     1  10.02948     0.0  4.277749   \n",
       "1  2.465127      2  ...     0.0     1     1  10.02948     0.0  4.277749   \n",
       "2  2.470894      2  ...     0.0     1     1  10.02948     0.0  4.277749   \n",
       "3  2.474097      2  ...     0.0     1     1  10.02948     0.0  4.277749   \n",
       "4  2.471663      2  ...     0.0     1     1  10.02948     0.0  4.277749   \n",
       "\n",
       "     FIT601  P601  P602  P603  \n",
       "0  0.000256     1     1     1  \n",
       "1  0.000256     1     1     1  \n",
       "2  0.000256     1     1     1  \n",
       "3  0.000256     1     1     1  \n",
       "4  0.000256     1     1     1  \n",
       "\n",
       "[5 rows x 51 columns]"
      ]
     },
     "execution_count": 3,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "###drop unwanted columns \n",
    "train_df = train_df.drop(['Timestamp', 'Normal/Attack'], axis=1)\n",
    "train_df.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "98d1ded7",
   "metadata": {},
   "outputs": [],
   "source": [
    "### define features and the PARAnomalyExplainer\n",
    "from pars import NumericFeature, CategoricFeature, PARAnomalyExplainer\n",
    "\n",
    "features = []\n",
    "for name in train_df.columns:\n",
    "    if len(train_df[name].unique()) > 5:\n",
    "        features.append( NumericFeature(name,min_value=train_df[name].min(), max_value=train_df[name].max(),\n",
    "                                    mean_value=train_df[name].mean(), std_value=train_df[name].std()) )\n",
    "    else:\n",
    "        features.append( CategoricFeature(name,values=train_df[name].unique().tolist()) )\n",
    "\n",
    "parexp = PARAnomalyExplainer(features)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "d6837fbf",
   "metadata": {},
   "outputs": [],
   "source": [
    "### let's train the PARAnomalyExplainer\n",
    "parexp.train(train_df, max_predicts4rule_mining = 75, max_times4rule_mining = 5, set_seed=False)\n",
    "\n",
    "### you can also save trained PARAnomalyExplainer to files\n",
    "parexp.save_model('./pars4swat')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "31afa43c",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Timestamp</th>\n",
       "      <th>FIT101</th>\n",
       "      <th>LIT101</th>\n",
       "      <th>MV101</th>\n",
       "      <th>P101</th>\n",
       "      <th>P102</th>\n",
       "      <th>AIT201</th>\n",
       "      <th>AIT202</th>\n",
       "      <th>AIT203</th>\n",
       "      <th>FIT201</th>\n",
       "      <th>...</th>\n",
       "      <th>P502</th>\n",
       "      <th>PIT501</th>\n",
       "      <th>PIT502</th>\n",
       "      <th>PIT503</th>\n",
       "      <th>FIT601</th>\n",
       "      <th>P601</th>\n",
       "      <th>P602</th>\n",
       "      <th>P603</th>\n",
       "      <th>Normal/Attack</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>28/12/2015 10:00:00 AM</td>\n",
       "      <td>2.427057</td>\n",
       "      <td>522.8467</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>262.0161</td>\n",
       "      <td>8.396437</td>\n",
       "      <td>328.6337</td>\n",
       "      <td>2.445391</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>250.8652</td>\n",
       "      <td>1.649953</td>\n",
       "      <td>189.5988</td>\n",
       "      <td>0.000128</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>Normal</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>28/12/2015 10:00:05 AM</td>\n",
       "      <td>2.609294</td>\n",
       "      <td>523.8673</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>262.0161</td>\n",
       "      <td>8.394514</td>\n",
       "      <td>328.6337</td>\n",
       "      <td>2.444110</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>250.7530</td>\n",
       "      <td>1.649953</td>\n",
       "      <td>189.5027</td>\n",
       "      <td>0.000128</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>Normal</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>28/12/2015 10:00:10 AM</td>\n",
       "      <td>2.630433</td>\n",
       "      <td>524.1028</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>262.0161</td>\n",
       "      <td>8.394514</td>\n",
       "      <td>328.6337</td>\n",
       "      <td>2.441803</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>251.1055</td>\n",
       "      <td>1.649953</td>\n",
       "      <td>189.8231</td>\n",
       "      <td>0.000128</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>Normal</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>28/12/2015 10:00:15 AM</td>\n",
       "      <td>2.567979</td>\n",
       "      <td>522.6505</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>262.0161</td>\n",
       "      <td>8.390669</td>\n",
       "      <td>328.6337</td>\n",
       "      <td>2.441803</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>251.1856</td>\n",
       "      <td>1.649953</td>\n",
       "      <td>189.9994</td>\n",
       "      <td>0.000128</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>Normal</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>28/12/2015 10:00:20 AM</td>\n",
       "      <td>2.489191</td>\n",
       "      <td>522.7290</td>\n",
       "      <td>2</td>\n",
       "      <td>2</td>\n",
       "      <td>1</td>\n",
       "      <td>262.0161</td>\n",
       "      <td>8.390669</td>\n",
       "      <td>328.3773</td>\n",
       "      <td>2.439881</td>\n",
       "      <td>...</td>\n",
       "      <td>1</td>\n",
       "      <td>251.1856</td>\n",
       "      <td>1.649953</td>\n",
       "      <td>189.8872</td>\n",
       "      <td>0.000128</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>Normal</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 54 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                Timestamp    FIT101    LIT101  MV101  P101  P102    AIT201  \\\n",
       "0  28/12/2015 10:00:00 AM  2.427057  522.8467      2     2     1  262.0161   \n",
       "1  28/12/2015 10:00:05 AM  2.609294  523.8673      2     2     1  262.0161   \n",
       "2  28/12/2015 10:00:10 AM  2.630433  524.1028      2     2     1  262.0161   \n",
       "3  28/12/2015 10:00:15 AM  2.567979  522.6505      2     2     1  262.0161   \n",
       "4  28/12/2015 10:00:20 AM  2.489191  522.7290      2     2     1  262.0161   \n",
       "\n",
       "     AIT202    AIT203    FIT201  ...  P502    PIT501    PIT502    PIT503  \\\n",
       "0  8.396437  328.6337  2.445391  ...     1  250.8652  1.649953  189.5988   \n",
       "1  8.394514  328.6337  2.444110  ...     1  250.7530  1.649953  189.5027   \n",
       "2  8.394514  328.6337  2.441803  ...     1  251.1055  1.649953  189.8231   \n",
       "3  8.390669  328.6337  2.441803  ...     1  251.1856  1.649953  189.9994   \n",
       "4  8.390669  328.3773  2.439881  ...     1  251.1856  1.649953  189.8872   \n",
       "\n",
       "     FIT601  P601  P602  P603  Normal/Attack  label  \n",
       "0  0.000128     1     1     1         Normal      0  \n",
       "1  0.000128     1     1     1         Normal      0  \n",
       "2  0.000128     1     1     1         Normal      0  \n",
       "3  0.000128     1     1     1         Normal      0  \n",
       "4  0.000128     1     1     1         Normal      0  \n",
       "\n",
       "[5 rows x 54 columns]"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#### load the test data\n",
    "z_tr = zipfile.ZipFile('./data/SWaT_test.zip', \"r\")\n",
    "f_tr = z_tr.open(z_tr.namelist()[0])\n",
    "test_df=pd.read_csv(f_tr)\n",
    "f_tr.close()\n",
    "z_tr.close()\n",
    "\n",
    "test_df.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "id": "b7309f84",
   "metadata": {},
   "outputs": [],
   "source": [
    "### extract anomalies in the test data\n",
    "test_df = test_df.loc[test_df['label']==1,:]\n",
    "\n",
    "featnames = [feature.name for feature in features]\n",
    "anomalies = test_df[featnames].values"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "ecf6810e",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "<pars.anomaly_explainer.PARAnomalyExplainer at 0x1a07203c1c8>"
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "### Load pretrained PARAnomalyExplainer from files\n",
    "pars2load = PARAnomalyExplainer()\n",
    "pars2load.load_model('./pars4swat')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "5c30cb6b",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Violated PARs:\n",
      "PIT501<252.15489959716797 and 262.59295654296875<=AIT201<265.79725646972656 and AIT503<263.9547424316406 ---> P203=2, sup: 0.0133756038647343, conf: 0.9984973703981967\n",
      "PIT501<252.15489959716797 and MV301=1 and AIT503<263.9547424316406 and 262.59295654296875<=AIT201<265.79725646972656 ---> P203=2, sup: 0.012811996779388084, conf: 0.9984313725490197\n",
      "AIT503<263.9547424316406 and 262.59295654296875<=AIT201<265.79725646972656 and 11.362474918365479<=AIT504<13.015894889831543 ---> P203=2, sup: 0.01252012882447665, conf: 0.9983948635634028\n",
      "AIT503<263.9547424316406 and 0.3034942001104355<=FIT504<0.30887484550476074 and 262.59295654296875<=AIT201<265.79725646972656 and 11.362474918365479<=AIT504<13.015894889831543 ---> P203=2, sup: 0.0125, conf: 0.9983922829581995\n",
      "PIT501<252.15489959716797 and AIT503<263.9547424316406 and 0.3034942001104355<=FIT504<0.30887484550476074 and 262.59295654296875<=AIT201<265.79725646972656 ---> P205=2, sup: 0.012489935587761675, conf: 0.9983909895414321\n"
     ]
    }
   ],
   "source": [
    "### you can use PARAnomalyExplainer to find top-k violated PARs for an individual anomaly\n",
    "rules = parexp.find_violated_pars(anomalies[0], topk=5)\n",
    "print('Violated PARs:')\n",
    "for rule in rules:\n",
    "    print(f'{rule}, sup: {rule.support}, conf: {rule.conf}')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "id": "543ec55b",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "anomalous feature: P203\n",
      "probability: 0.28112548742994664\n",
      "representive violated PAR: PIT501<252.15489959716797 and 262.59295654296875<=AIT201<265.79725646972656 and AIT503<263.9547424316406 ---> P203=2\n",
      "confidence of representive PAR: 0.9984973703981967\n",
      "support of the representive PAR: 0.0133756038647343\n",
      "violated locations: [0, 4, 5, 9, 10, 13, 14, 15]\n",
      "related features in the representive PAR: ['P203', 'PIT501', 'AIT201', 'AIT503']\n",
      "\n",
      "anomalous feature: FIT301\n",
      "probability: 0.2403296129010238\n",
      "representive violated PAR: FIT101>=2.537071943283081 and P101=1 and AIT503<263.9547424316406 ---> FIT301<1.940236508846283\n",
      "confidence of representive PAR: 1.0\n",
      "support of the representive PAR: 0.015780998389694042\n",
      "violated locations: [1, 2, 3, 6, 7, 8, 11, 12]\n",
      "related features in the representive PAR: ['FIT301', 'FIT101', 'P101', 'AIT503']\n",
      "\n",
      "anomalous feature: DPIT301\n",
      "probability: 0.16022001308567668\n",
      "representive violated PAR: FIT101>=2.537071943283081 and P101=1 and AIT503<263.9547424316406 ---> 0.6482488811016083<=DPIT301<7.5004801750183105\n",
      "confidence of representive PAR: 1.0\n",
      "support of the representive PAR: 0.015780998389694042\n",
      "violated locations: [1, 2, 3, 6, 7, 8, 11, 12]\n",
      "related features in the representive PAR: ['DPIT301', 'FIT101', 'P101', 'AIT503']\n",
      "\n",
      "anomalous feature: AIT202\n",
      "probability: 0.15978351893729326\n",
      "representive violated PAR: AIT203<342.9889373779297 and P205=2 ---> AIT202<8.395315170288086\n",
      "confidence of representive PAR: 0.9972630640952198\n",
      "support of the representive PAR: 0.630756843800322\n",
      "violated locations: [17, 18, 19]\n",
      "related features in the representive PAR: ['AIT202', 'AIT203', 'P205']\n",
      "\n",
      "anomalous feature: P205\n",
      "probability: 0.11951447276234836\n",
      "representive violated PAR: PIT501<252.15489959716797 and AIT503<263.9547424316406 and 0.3034942001104355<=FIT504<0.30887484550476074 and 262.59295654296875<=AIT201<265.79725646972656 ---> P205=2\n",
      "confidence of representive PAR: 0.9983909895414321\n",
      "support of the representive PAR: 0.012489935587761675\n",
      "violated locations: [0, 5, 9, 10, 13, 14, 15]\n",
      "related features in the representive PAR: ['P205', 'PIT501', 'AIT503', 'FIT504', 'AIT201']\n",
      "\n",
      "anomalous feature: FIT401\n",
      "probability: 0.019513447441855694\n",
      "representive violated PAR: 2.201453924179077<=FIT301<2.2097809314727783 and P205=1 and 1.240297019481659<=FIT502<1.260919988155365 ---> 1.679492473602295<=FIT401<1.710889995098114\n",
      "confidence of representive PAR: 0.9987179487179487\n",
      "support of the representive PAR: 0.01568035426731079\n",
      "violated locations: [4]\n",
      "related features in the representive PAR: ['FIT401', 'FIT301', 'P205', 'FIT502']\n",
      "\n",
      "anomalous feature: FIT501\n",
      "probability: 0.019513447441855694\n",
      "representive violated PAR: 2.201453924179077<=FIT301<2.2097809314727783 and P205=1 and 1.240297019481659<=FIT502<1.260919988155365 ---> 1.6884770393371582<=FIT501<1.7207130193710327\n",
      "confidence of representive PAR: 0.9987179487179487\n",
      "support of the representive PAR: 0.01568035426731079\n",
      "violated locations: [4]\n",
      "related features in the representive PAR: ['FIT501', 'FIT301', 'P205', 'FIT502']\n",
      "\n"
     ]
    }
   ],
   "source": [
    "### you can also find summarized anomaly explanation for a list of anomalies\n",
    "explanation = parexp.explain_anomalies(anomalies[0:20])\n",
    "\n",
    "# each explanation item is a tuple contains the following elements: \n",
    "# (anomalous feature,probability,violated rule,rule confidence,rule support,violated locations,related features)\n",
    "for exp_item in explanation.summary():\n",
    "    print(f'anomalous feature: {exp_item[0]}')\n",
    "    print(f'probability: {exp_item[1]}')\n",
    "    print(f'representive violated PAR: {exp_item[2]}')\n",
    "    print(f'confidence of representive PAR: {exp_item[3]}')\n",
    "    print(f'support of the representive PAR: {exp_item[4]}')\n",
    "    print(f'violated locations: {exp_item[5]}')\n",
    "    print(f'related features in the representive PAR: {exp_item[6]}')\n",
    "    print()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "df13a14f",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.11"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}