change evaluate ip way

app.py

@@ -53,10 +53,19 @@ ACTION_MAP = {
 log_history = []
 initial_df_abn = pd.DataFrame(columns=["timestamp", "ip_address", "cookie_id", "account", "role", "action", "status"])
 
+# --- 🌟 新增：網段標籤轉換器 (Rule-based Feature Engineering) ---
+def get_ip_category(ip_str):
+    ip = str(ip_str).split(" ")[0]
+    if ip.startswith("140.124."): return 0.0    # 信任網段：校內/宿舍
+    elif ip.startswith("61.228."): return 1.0   # 一般網段：國內家用
+    elif ip.startswith("210.61."): return 2.0   # 一般網段：公共場所
+    elif ip.startswith("45.33."): return 3.0    # 高風險網段：已知國外異常
+    else: return 4.0                            # 未知網段：新出現的 IP
+
 # --- 1. 載入模型與歷史資料 ---
 try:
     le_action = joblib.load('le_action.pkl')
-    le_ip = joblib.load('le_ip.pkl')
+    # 🛑 移除舊的 le_ip = joblib.load('le_ip.pkl')，改用上方的新轉換器
     
     print("📂 正在處理靜態訓練基底資料...")
     static_file = 'static_train_data.csv'
@@ -103,11 +112,8 @@ try:
     baseline_df['day'] = baseline_df['timestamp'].dt.day
     baseline_df['hour'] = baseline_df['timestamp'].dt.hour
     
-    clean_ips = baseline_df['clean_ip'].values
-    known_ips = set(le_ip.classes_)
-    unknown_ips = set(clean_ips) - known_ips
-    if unknown_ips:
-        le_ip.classes_ = np.append(le_ip.classes_, list(unknown_ips))
+    # 🌟 修改：即時將資料表內的 IP 轉換為「網段標籤」陣列
+    ip_codes = np.array([get_ip_category(ip) for ip in baseline_df['clean_ip'].values])
         
     actions = baseline_df['action'].astype(str).values
     known_actions = set(le_action.classes_)
@@ -115,16 +121,17 @@ try:
     if unknown_actions:
         le_action.classes_ = np.append(le_action.classes_, list(unknown_actions))
     
+    # 🌟 修改：將網段標籤組合進 AI 特徵矩陣中
     baseline_X = np.column_stack((
         baseline_df['month'].values,
         baseline_df['day'].values,
         baseline_df['hour'].values,
-        le_ip.transform(clean_ips),
+        ip_codes,
         le_action.transform(actions)
     ))
     
     AI_READY = True
-    print("✅ AI 模組與動態歷史基準資料載入成功！")
+    print("✅ AI 模組與動態歷史基準資料載入成功 (已套用智慧網段標籤)！")
 except Exception as e:
     AI_READY = False
     global_stats["total_count"] = 0
@@ -277,17 +284,16 @@ def explain_abnormal_log(log_text):
     except Exception as e: return f"⚠️ 呼叫 API 發生錯誤: {str(e)}"
 
 # --- 2. 核心邏輯與真實 HDBSCAN 異常偵測 ---
-# 🌟 修改：加入 gw (地理), fw (頻率) 接收參數
 def check_anomaly(ip, action, log_time, ow, tw, iw, dw, gw, fw):
     if not AI_READY: return "success" 
     if action in ["login_attempt", "logout"]: return "success"
 
     try:
         ow, tw, iw, dw = float(ow), float(tw), float(iw), float(dw)
-        gw, fw = float(gw), float(fw) # 將新增的地理與頻率參數轉為 float，供未來擴充使用
+        gw, fw = float(gw), float(fw) 
         
-        clean_ip = str(ip).split(" ")[0] 
-        ip_code = float(le_ip.transform([clean_ip])[0])
+        # 🌟 修改：直接將輸入的 IP 透過函式轉成分類標籤
+        ip_code = float(get_ip_category(ip))
         action_code = float(le_action.transform([action])[0])
         
         current_time = pd.to_datetime(str(log_time))
@@ -335,9 +341,11 @@ def check_anomaly(ip, action, log_time, ow, tw, iw, dw, gw, fw):
             min_distance = np.min(distances)
             max_tolerance_distance = time_multiplier * 15.0 + 1.0
             
-            # 💡 暫時實作：若為國外異常 IP (45.33.22.11)，根據敏感度(gw)縮小容忍度
-            if "45.33" in clean_ip:
-                max_tolerance_distance *= (1 - (gw / 100.0))
+            # 🌟 完成功能：將「IP 聲譽權重 (iw)」與網段標籤完美綁定！
+            # 如果是國外異常或未知 IP (標籤 3.0 或 4.0)，且管理員調高了 iw
+            # 系統會嚴格縮減對它的距離容忍度，迫使它更容易被判定為異常
+            if ip_code >= 3.0:
+                max_tolerance_distance *= (1 - (iw / 100.0) * 0.6)
                 
             if min_distance > max_tolerance_distance:
                 return "⚠️異常_作息或行為不符"
@@ -369,11 +377,10 @@ def record_log(ip, cookie, account, role, action, status, time_mode, custom_time
     if status == "success" and AI_READY:
         try:
             current_time = pd.to_datetime(str(log_time))
-            clean_ip = str(ip).split(" ")[0]
-            if clean_ip not in le_ip.classes_: le_ip.classes_ = np.append(le_ip.classes_, clean_ip)
             if action not in le_action.classes_: le_action.classes_ = np.append(le_action.classes_, action)
-                
-            new_row = np.array([[float(current_time.month), float(current_time.day), float(current_time.hour), float(le_ip.transform([clean_ip])[0]), float(le_action.transform([action])[0])]], dtype=float)
+            
+            # 🌟 修改：寫入基準資料時，轉換為網段標籤
+            new_row = np.array([[float(current_time.month), float(current_time.day), float(current_time.hour), float(get_ip_category(ip)), float(le_action.transform([action])[0])]], dtype=float)
             baseline_X = np.vstack((baseline_X, new_row))
         except: pass 
 
@@ -528,12 +535,12 @@ with gr.Blocks(title="模擬校園入口與資安防護系統") as demo:
                                     action_plot = gr.Plot(show_label=False)
 
                                 with gr.Accordion("▼ 防護強度微調 (AI 敏感度)", open=True, elem_classes="weight-card"):
-                                    gr.Markdown("<span style='color:gray; font-size:0.9em;'>手動輸入 0~100 的數值。系統尚未完成地理與頻率的訓練架構，目前的數值調整僅為 UI 預留介面與簡易模擬，須待架構升級後才能完整發揮。</span>")
+                                    gr.Markdown("<span style='color:gray; font-size:0.9em;'>手動輸入 0~100 的數值。系統目前已成功啟用 IP 聲譽權重；地理與頻率的訓練架構僅為預留介面，須待升級後發揮。</span>")
                                     with gr.Row():
                                         overall_weight = gr.Number(label="總體防護強度 (%)", value=75, minimum=0, maximum=100)
                                         time_weight = gr.Number(label="時間特徵權重 (%)", value=80, minimum=0, maximum=100)
+                                        # 🌟 已完成綁定
                                         ip_weight = gr.Number(label="IP 聲譽權重 (%)", value=65, minimum=0, maximum=100)
-                                    # 🌟 新增：將使用者要求的「地理偏移敏感度」與「行為頻率敏感度」加入介面中
                                     with gr.Row():
                                         device_weight = gr.Number(label="裝置指紋/行為權重 (%)", value=45, minimum=0, maximum=100)
                                         geo_weight = gr.Number(label="🌍 地理偏移敏感度 (%)", value=50, minimum=0, maximum=100)
@@ -584,7 +591,6 @@ with gr.Blocks(title="模擬校園入口與資安防護系統") as demo:
     time_mode.change(fn=toggle_time_input, inputs=time_mode, outputs=custom_time_input)
     btn_explain_log.click(fn=explain_abnormal_log, inputs=[abnormal_log_input], outputs=[ai_explanation_output])
     
-    # 🌟 修改：將 geo_weight 與 freq_weight 正式加入全域的輸入變數清單
     weight_inputs = [overall_weight, time_weight, ip_weight, device_weight, geo_weight, freq_weight]
     update_outputs = [main_router, role_tabs, login_msg, welcome_text, store_df_all, store_df_abn, abnormal_log_input]
     
@@ -594,7 +600,6 @@ with gr.Blocks(title="模擬校園入口與資安防護系統") as demo:
     fast_inputs = [mock_ip, mock_cookie, time_mode, custom_time_input] + weight_inputs
     fast_outputs = update_outputs + [acc_input] 
     
-    # 🌟 修改：更新所有按鈕的 Lambda 函式以接住並傳遞 gw, fw 參數
     btn_fast_student.click(fn=lambda ip, c, tm, ct, ow, tw, iw, dw, gw, fw: fast_login("student", ip, c, tm, ct, ow, tw, iw, dw, gw, fw), inputs=fast_inputs, outputs=fast_outputs)
     btn_fast_admin.click(fn=lambda ip, c, tm, ct, ow, tw, iw, dw, gw, fw: fast_login("admin", ip, c, tm, ct, ow, tw, iw, dw, gw, fw), inputs=fast_inputs, outputs=fast_outputs)
     btn_toggle_role.click(fn=toggle_role, inputs=[acc_input, mock_ip, mock_cookie, time_mode, custom_time_input] + weight_inputs, outputs=[role_tabs, welcome_text, store_df_all, store_df_abn, abnormal_log_input, acc_input])