{"nbformat":4,"nbformat_minor":0,"metadata":{"colab":{"provenance":[],"authorship_tag":"ABX9TyOE396mFgPjgC07cNKpBPL+"},"kernelspec":{"name":"python3","display_name":"Python 3"},"language_info":{"name":"python"}},"cells":[{"cell_type":"markdown","source":["# Detección semántica de intención maliciosa\n","\n","## Objetivo\n","Construir un módulo capaz de:\n","\n","* detectar intención maliciosa en textos,\n","* identificar patrones de ingeniería social,\n","* reconocer variantes semánticas de ataques,\n","* detectar mensajes anómalos,\n","* combinar todo en un sistema híbrido de decisión."],"metadata":{"id":"SLg1EfG1nx7O"}},{"cell_type":"markdown","source":["## 1. Preparación del entorno"],"metadata":{"id":"DjHXczjjoBUX"}},{"cell_type":"code","execution_count":null,"metadata":{"id":"KC7O7VSnnN9y"},"outputs":[],"source":["#Importar librerías\n","\n","import pandas as pd\n","import numpy as np\n","\n","from sklearn.feature_extraction.text import TfidfVectorizer\n","from sklearn.metrics.pairwise import cosine_similarity"]},{"cell_type":"markdown","source":["## 2. Crear dataset con intenciones"],"metadata":{"id":"2ZWvNoMWoWej"}},{"cell_type":"code","source":["data = [\n","    (\"verifique su cuenta inmediatamente\", \"ataque\"),\n","    (\"confirme sus credenciales ahora\", \"ataque\"),\n","    (\"actualice su contraseña para evitar bloqueo\", \"ataque\"),\n","    (\"el equipo de seguridad solicita validar su acceso\", \"ataque\"),\n","\n","    (\"reunion del equipo mañana\", \"legitimo\"),\n","    (\"actualizacion del sistema programada\", \"legitimo\"),\n","    (\"ticket resuelto correctamente\", \"legitimo\"),\n","    (\"informe adjunto para revision\", \"legitimo\")\n","]\n","\n","df = pd.DataFrame(data, columns=[\"texto\", \"etiqueta\"])\n","print(df)"],"metadata":{"id":"SdQzTwrjoWG2"},"execution_count":null,"outputs":[]},{"cell_type":"markdown","source":["## 3. Similitud semántica"],"metadata":{"id":"fVwiYSF1odmR"}},{"cell_type":"code","source":["#Vectorización\n","\n","vectorizer = TfidfVectorizer()\n","X = vectorizer.fit_transform(df[\"texto\"])\n","\n","#Comparar nuevo mensaje\n","nuevo_texto = [\"valide su acceso inmediatamente\"]\n","X_new = vectorizer.transform(nuevo_texto)\n","\n","similitudes = cosine_similarity(X_new, X)\n","\n","print(\"Similitudes:\", similitudes)\n","\n","#Interpretación\n","max_sim = similitudes.max()\n","\n","if max_sim > 0.5:\n","    print(\"Mensaje semánticamente similar a ataque\")\n","else:\n","    print(\"Mensaje no similar\")"],"metadata":{"id":"TB_FCeW4opBA"},"execution_count":null,"outputs":[]},{"cell_type":"markdown","source":["## 4. Detección de señales de ingeniería social"],"metadata":{"id":"JB9yM2Dqo820"}},{"cell_type":"code","source":["def detectar_senales(texto):\n","    texto = texto.lower()\n","\n","    urgencia = [\"urgente\", \"inmediatamente\", \"ahora\"]\n","    autoridad = [\"seguridad\", \"banco\", \"administrador\"]\n","    accion = [\"verifique\", \"actualice\", \"confirme\", \"valide\"]\n","\n","    score = 0\n","\n","    if any(p in texto for p in urgencia):\n","        score += 1\n","    if any(p in texto for p in autoridad):\n","        score += 1\n","    if any(p in texto for p in accion):\n","        score += 1\n","\n","    return score\n","\n","print(detectar_senales(\"valide su cuenta ahora\"))"],"metadata":{"id":"VazUUE8oo8iP"},"execution_count":null,"outputs":[]},{"cell_type":"markdown","source":["## 5. Detección de anomalías lingüísticas"],"metadata":{"id":"eWXOxhgKpWTf"}},{"cell_type":"code","source":["#Comparar con lenguaje natural\n","textos_normales = df[df[\"etiqueta\"] == \"legitimo\"][\"texto\"]\n","\n","X_norm = vectorizer.transform(textos_normales)\n","sim_norm = cosine_similarity(X_new, X_norm)\n","\n","print(\"Similitud con mensajes normales:\", sim_norm)\n","\n","#Detectar anomalía"],"metadata":{"id":"iCTX9t1OpaLI"},"execution_count":null,"outputs":[]},{"cell_type":"markdown","source":["## 6. Sistema híbrido de detección"],"metadata":{"id":"etJu2VdBps4i"}},{"cell_type":"code","source":["def sistema_hibrido(texto):\n","\n","    texto_vec = vectorizer.transform([texto])\n","\n","    # Similitud con ataques\n","    sim = cosine_similarity(texto_vec, X)\n","    sim_score = sim.max()\n","\n","    # Señales lingüísticas\n","    signal_score = detectar_senales(texto)\n","\n","    # Similitud con lenguaje normal\n","    sim_norm = cosine_similarity(texto_vec, X_norm)\n","    normal_score = sim_norm.max()\n","\n","    # Decisión\n","    if sim_score > 0.5 or signal_score >= 2 or normal_score < 0.3:\n","        return \"ALERTA: posible ataque\"\n","    else:\n","        return \"Mensaje legítimo\""],"metadata":{"id":"fWhcmZC0pwsC"},"execution_count":null,"outputs":[]},{"cell_type":"markdown","source":["## 7. Probar sistema"],"metadata":{"id":"_lDHrZ2cp2gt"}},{"cell_type":"code","source":["pruebas = [\n","    \"valide su acceso inmediatamente\",\n","    \"reunion de equipo mañana\",\n","    \"actualice sus datos ahora o perdera acceso\",\n","    \"informe mensual disponible\"\n","]\n","\n","for t in pruebas:\n","    print(t, \"→\", sistema_hibrido(t))"],"metadata":{"id":"mWLF5ednp62j"},"execution_count":null,"outputs":[]}]}