{"nbformat":4,"nbformat_minor":0,"metadata":{"colab":{"provenance":[],"authorship_tag":"ABX9TyOTV7AEmRuR0QehnoU6uD4E"},"kernelspec":{"name":"python3","display_name":"Python 3"},"language_info":{"name":"python"}},"cells":[{"cell_type":"markdown","source":["# Construcción y evaluación de clasificadores de amenazas textuales\n","## Objetivo del laboratorio\n","Implementar un sistema de clasificación de textos que identifique diferentes tipos de amenazas de ciberseguridad utilizando técnicas de procesamiento de lenguaje natural y aprendizaje supervisado."],"metadata":{"id":"wsETJkcP_PpD"}},{"cell_type":"markdown","source":["## 1. Preparación del Entorno:\n","Importar las librerías necesarias\n","\n","Estas librerías permiten:\n","- manipular datos (pandas)\n","- vectorizar texto (TfidfVectorizer)\n","- entrenar modelos\n","- evaluar resultados."],"metadata":{"id":"1S5CaXIqAgbN"}},{"cell_type":"code","execution_count":null,"metadata":{"id":"-U7grBeZ_Jaf"},"outputs":[],"source":["import pandas as pd\n","\n","from sklearn.model_selection import train_test_split\n","from sklearn.feature_extraction.text import TfidfVectorizer\n","\n","from sklearn.naive_bayes import MultinomialNB\n","from sklearn.svm import LinearSVC\n","from sklearn.neural_network import MLPClassifier\n","\n","from sklearn.metrics import classification_report, confusion_matrix"]},{"cell_type":"markdown","source":["## 2. Creación del dataset de ejemplo\n","Crear un conjunto de datos etiquetado\n","\n","El dataset contiene ejemplos de cinco categorías:\n","- phishing\n","- malware\n","- ingeniería social\n","- incidente técnico\n","- spam legítimo"],"metadata":{"id":"hNDcUHkmA2vm"}},{"cell_type":"code","source":["data = [\n","(\"URGENTE verifique su cuenta ahora [URL]\", \"phishing\"),\n","(\"actualice sus credenciales inmediatamente\", \"phishing\"),\n","(\"confirmacion requerida para evitar suspension\", \"phishing\"),\n","\n","(\"descargue el parche de seguridad adjunto\", \"malware\"),\n","(\"instale el paquete enviado por soporte\", \"malware\"),\n","(\"ejecute el archivo comprimido para actualizar\", \"malware\"),\n","\n","(\"soy del departamento de TI necesito su acceso\", \"ingenieria_social\"),\n","(\"el gerente solicita su contraseña urgentemente\", \"ingenieria_social\"),\n","(\"proceso de auditoria requiere validacion\", \"ingenieria_social\"),\n","\n","(\"error de autenticacion en VPN\", \"incidente_tecnico\"),\n","(\"ticket abierto por falla del servidor\", \"incidente_tecnico\"),\n","(\"problema de conexion en red interna\", \"incidente_tecnico\"),\n","\n","(\"recordatorio reunion semanal\", \"spam_legitimo\"),\n","(\"invitacion a capacitacion corporativa\", \"spam_legitimo\"),\n","(\"newsletter institucional mensual\", \"spam_legitimo\")\n","]\n","\n","df = pd.DataFrame(data, columns=[\"texto\", \"etiqueta\"])\n","\n","print(df.head())"],"metadata":{"id":"KraxKJ5OBAam"},"execution_count":null,"outputs":[]},{"cell_type":"markdown","source":["## 3. Vectorización del texto\n","Convertir el texto en vectores TF-IDF\n","\n","Cada documento se transforma en un vector numérico que representa la importancia de cada palabra en el corpus."],"metadata":{"id":"yqo53Vi0BVzI"}},{"cell_type":"code","source":["vectorizer = TfidfVectorizer()\n","X = vectorizer.fit_transform(df[\"texto\"])\n","y = df[\"etiqueta\"]"],"metadata":{"id":"CFDRl26cBeh8"},"execution_count":null,"outputs":[]},{"cell_type":"markdown","source":["## 4. División de datos\n","\n","Dividir el dataset en entrenamiento y prueba\n","\n","Se utiliza el parámetro stratify para mantener la misma proporción de clases en ambos conjuntos."],"metadata":{"id":"qOsvQFmADQZb"}},{"cell_type":"code","source":["X_train, X_test, y_train, y_test = train_test_split(\n","    X,\n","    y,\n","    test_size=0.3,\n","    stratify=y,\n","    random_state=42\n",")"],"metadata":{"id":"tYJTaAyJDYlb"},"execution_count":null,"outputs":[]},{"cell_type":"markdown","source":["## 5. Entrenamiento de modelos\n","\n","### 5.1. Clasificador Naive Bayes"],"metadata":{"id":"OjIt1B-hDgZY"}},{"cell_type":"code","source":["nb_model = MultinomialNB()\n","\n","nb_model.fit(X_train, y_train)\n","\n","nb_pred = nb_model.predict(X_test)"],"metadata":{"id":"RzImfroMDr39"},"execution_count":null,"outputs":[]},{"cell_type":"markdown","source":["### 5.2. Clasificador SVM"],"metadata":{"id":"saTY3hYrDvDn"}},{"cell_type":"code","source":["svm_model = LinearSVC()\n","\n","svm_model.fit(X_train, y_train)\n","\n","svm_pred = svm_model.predict(X_test)"],"metadata":{"id":"Oa0kStwjDz6C"},"execution_count":null,"outputs":[]},{"cell_type":"markdown","source":["### 5.3. Red neuronal simple"],"metadata":{"id":"io-jFxWrD3eb"}},{"cell_type":"code","source":["nn_model = MLPClassifier(hidden_layer_sizes=(50,), max_iter=1000)\n","\n","nn_model.fit(X_train, y_train)\n","\n","nn_pred = nn_model.predict(X_test)"],"metadata":{"id":"1odPVY0CD7Bh"},"execution_count":null,"outputs":[]},{"cell_type":"markdown","source":["## 6. Evaluación de los modelos\n","\n","Generar métricas de evaluación\n","\n","Las métricas mostradas incluyen:\n","- precision\n","- recall\n","- F1-score\n","- matriz de confusión."],"metadata":{"id":"hlxwACvJD-IQ"}},{"cell_type":"code","source":["#Naive Bayes\n","print(\"Naive Bayes\")\n","print(classification_report(y_test, nb_pred))\n","print(confusion_matrix(y_test, nb_pred))\n","\n","#SVM\n","print(\"SVM\")\n","print(classification_report(y_test, svm_pred))\n","print(confusion_matrix(y_test, svm_pred))\n","\n","#Red neuronal\n","print(\"Red neuronal\")\n","print(classification_report(y_test, nn_pred))\n","print(confusion_matrix(y_test, nn_pred))"],"metadata":{"id":"C_gjy58DH-tL"},"execution_count":null,"outputs":[]},{"cell_type":"markdown","source":["7. Analizar el desempeño\n","Con los resultados puede responder a:\n","- ¿Qué modelo obtiene el mayor F1-score?\n","- ¿Qué modelo detecta mejor la clase phishing?\n","- ¿Qué tipo de error aparece con mayor frecuencia?\n","- ¿Cuál modelo sería más adecuado para un sistema de detección de amenazas?"],"metadata":{"id":"pH3C_DaRIRca"}}]}